WO1999020018A1

WO1999020018A1 - Novel digital cryptography method by selector box

Info

Publication number: WO1999020018A1
Application number: PCT/FR1998/002169
Authority: WO
Inventors: Serge Vaudenay; Jacques Stern; Daniel Sabban
Original assignee: Compagnie Des Signaux
Priority date: 1997-10-10
Filing date: 1998-10-09
Publication date: 1999-04-22
Also published as: CA2274938A1; FR2769726B1; JP2001506773A; AU9544398A; FR2769726A1; EP0944975A1

Abstract

The invention concerns a cryptography method for data recorded in the form of bits on a medium by an arithmetic unit for processing input data m, for supplying output data m', comprising at least a data processing step whereby the arithmetic unit uses a function Ck (m) dependent on a key k. The function Ck (m) comprises a selector box M adapted for processing selector box input data (x1, ..., xj, ..., xr) with r≥2, where x1, ..., xr are bit blocks, to supply selector box output data, (y1, ..., yj, ..., ys), s≥2, where y1, ..., ys are bit blocks, said selector box which, when all selector box input data, except one, are fixed, produces for each selector box output data a value obtained by permutation of the value of the unfixed selector box input data.

Description

New digital cryptography process by mixing box

The present invention relates to a method of cryptography of data recorded in the form of bits on a medium usable by a calculation unit able to process input data m, to provide output data m ', comprising at least one processing step. in which the calculation unit uses a function C_ (m) dependent on a key k.

Many cryptographic methods are known. They allow encryption or encryption of data using a secret key, so that data becomes unintelligible to anyone who does not have the key. However, the process must be reversible so that the legitimate recipient of the data can understand it; it is deciphering.

Encryption and decryption constitute cryptography. The fundamental principles of cryptography were defined by Shannon in 1949. Nowadays, they are mainly based on the use of a calculation unit which processes functions and data by means of electronic circuits.

The Data Encryption Standard (DES) function proposed by the American government in 1977 is an example that has become an international standard.

The DES function was perfectly suited to the security needs and technology of the time, but it is now insufficient, as shown in the last Challenge RSA attack competition.

In addition, statistical attacks developed by Biham and Shamir on the one hand and by Gilbert and Matsui on the other exposed the structural weaknesses of the DES function.

DES should soon be replaced by a new standard, the Advanced Encryption Standard (AES).

The object of the invention is a method of data cryptography which ensures high security, which can be carried out with relatively simple functions requiring limited means of calculation and which ensures optimum performance with current technology, using as little as possible. of electronic circuits, for the sake of economy.

To this end, the invention relates to a cryptography method as defined above, characterized in that the function C _k (m) dependent on a key k, comprises a mixing box M able to process mixing box input data (x _1} ..., ^~ x _{i (} ..., x _r ), r ≥ 2, where x ,, ..., x _s are bit blocks, to provide mixing box output data, (y_, ... y _j , ... y _s ), s ≥ 2, where y _1? ..., y _s , are bit blocks, mixing box which, when all but one of the mixing box input data is fixed, produces for each mixing box output data a value which is obtained by permuting the value of the data non-fixed mixing box inlet.

As a general rule, the calculation unit is composed of one or more calculation boxes, in a network, a calculation box being a set capable of performing a calculation, for example a set of electronic circuits. According to an embodiment of the invention, the mixing box M is a permutation, and preferably, the mixing box M is a multipermutation.

According to a variant, the mixing box M is obtained by adding to a mixing box a permutation on at least any one of its input data or its output data. According to a preferred embodiment of the invention, the function CJ n) is obtained by the implementation of successive stages of data processing, each stage verifying the property of the mixing box output data.

Advantageously, the mixing box comprises a step of processing data by an invertible linear function φ (x). As an example, the function φ (x) is defined, in a data representation mode, by: φ (x „..., X _5> X ₄ , X _2> Xj, Xn) = (X _t >•••>s> X ₄ © X ₃ > X ₃ > X ₂ © j, ι> n © t)> where X _n , ..., x, are bit blocks and where ® represents the OR function bit-by-bit exclusive.

According to another example, the function φ (x) is defined, in a data representation mode, by: φ (χ _t , ..., X ₅ ... X ₀ ) = (X, © X _t _, , .... X ₅ © X ₄ , X ₄ , X ₃ Θ X ₂ , X ₂ , Xj © Xo, Xo), where x ,,, ..., x, are blocks of bits and where © represents the bit-by-bit exclusive OR function.

According to a variant, the cryptography method comprises a step of processing data by a permutation P with 8 input bits and 8 output bits, such as:

DP _m „(P) = max _{aΛ, b} Pr _x“ ^ [P (x © a) © P (x) = b] ≤ T or LP _mlx (P) = max ^ (2 Pr _{x uniform} [x. a = P (x) .b] - l) ² ≤ 2 ^"4 , the permutation P being carried out by means of a logic circuit of lower depth or equal to 17. According to an improvement, the permutation P is an involution.

According to another variant, the cryptography method comprises a step of processing data by a permutation g with 4 input bits and 4 output bits, such as:

DP _{m «} (g) = max _{aΛ, b} Pr _{x uniform} . [g (x © a) © g (x) = b] ≤ 2 ^~ or LP _m „(g) = max ^ (2 Pr _{x uniforroe} [xa = g (x) .b] - l) ² ≤ 2 ^~ , the permutation g being carried out by means of a logic circuit of depth less than or equal to 4.

According to another variant, the cryptography method comprises a step of processing data by a function f with 4 input bits and 4 output bits, such as: DP _m „(f) = max ^ Pr _{x mii} _ _mt [ f (x © a) © f (x) = b] ≤ 2 ^"2 , or LP _mιx (f) = max ^ (2 Pr _{x uniform} [xa = f (x) .b] - l) ² ≤ 2 ^{" 2} , the function f being performed by means of a logic circuit of depth less than or equal to 2.

According to a particular embodiment, the function f is defined by f (x ₃ , x ₂ , x _1} Xo) =

[NO (NONx _3. X_), NO (NONx _2. X_),

. x ₀ ), NO (NONx _0. x ₃ )].

According to an improvement, the key k is broken down into at least two blocks k ^-1 and k ^-2 , and according to another improvement, the blocks k ^-1 and k ^"2 are treated by means of a Feistel diagram to produce sub-keys ko, ..., k „. An embodiment of the present invention will be described below with reference to the appended figures in which:

FIG. 1 represents an overall view of the encryption,

FIG. 2 represents each function F of FIG. 1, FIG. 3 represents the function g in which the letter "n" is an electronic NAND function,

FIG. 4 represents each permutation P of FIG. 2,

FIG. 5 represents the transformation E of FIG. 1 preceded by a series of transformations using the exclusive OR function,

FIG. 6 represents the functions M and M ^-1 of FIG. 5,

- Figure 7 schematically shows the decryption operations, that is to say the reverse operations such as those described in the previous figures.

According to this example, the cryptography method processes the data recorded m by blocks of fixed length equal to eight bytes.

The function C_ is carried out by means of a calculation unit consisting of a calculation box which uses a mixing box M (x, y) with two inputs.

Recall that a mixing box M (x ,, ..., x _r ) ar inputs (r ≥ 2) is a function that transforms r inputs into s outputs, so that each output has a uniform distribution by permutation if one arbitrarily fixes (r - 1) entries and that the remaining entry is random.

As appears in FIG. 1, the set of eight bytes of m undergoes successively through the calculation network eight similar transformation steps, then a final operation. Each step consists in carrying out an exclusive bit-by-bit or exclusive with a subkey k "calculated from k and which depends on the number of step i, then in performing a transformation E. The final step is one or bit-by-bit exclusive with a last subkey k ^{8, so} we have

C ^ m) = k ⁸ © E (k ⁷ © ... E (k ¹ © E (k ° © m))). The block of eight bytes which enters step i is denoted by m ¹ . (The block entering in step 0 is m ⁰ = m). The outgoing block is m ^{i + 1} ).

We therefore have: m ^{i + 1} = E ^ © m *) and m '= k ⁸ ® m ⁸ . The step keys, all eight bytes, are obtained from k by a key diversification process based on the Feisiel scheme. The key À- is originally a series of bytes of variable length (at most sixteen) which are completed over sixteen bytes with null bytes. These sixteen bytes are divided into two sequences of eight bytes / c ^{~ 2} and k ^"1 which initialize the sequence k ^{~ 2} , / o ^_1 , k °, / e ¹ , ..., k ^s . Two consecutive elements k ' and / c ^{î + 1} of this sequence determine a new element k ^{l + 2} by the formula of recurrence

/ c ^{1 + 2} = ΘF _c . _{+ -} (/ ^{î + 1} )

by means of a function E _ct +2 which uses a preset constant c ^{! +2} . Figure 1 illustrates the overview of the encryption process.

The function E _c . ₊ 2 first performs an exclusive bit-by-bit of the input with the constant c ^{l + 2} , then applies a transformation P on each of the eight bytes obtained, and finally a transformation T (see Figure 2). If we consider the eight bytes coming out of the P transformations as an array of eight lines of eight bits, the transformation T only swaps the lines and the columns.

The transformation P is described by a Feistel scheme. The entry is a byte split into two four-bit numbers. Each number enters one of the branches of the Feistel scheme described in Figure 4. We use two functions / and g.

The / function is defined by the hexadecimal table

X 0 1 2 3 4 5 6 7 8 9 a b c d e f f d b b 7 5 7 7 e d a b e d e f which comes from the formula

f (x ₃ , X ₂ , X Xθ) = (~ X3 ~ .X ₂ , X ^~ _.Xl, Xl.Xo, ^~ X (.X3) - The function / has a good non-linearity. There is indeed DP _nιa (/) = 2 ^{~ 2} cl LP, _{na \} (./) = 2 ^"2 - In addition, the function can be performed by a logic circuit of depth two.

The quantities DP, _nax and LP _ma measure the non-linearity according to criteria highlighted by Nyherg, Chabaud and Vaudenay, then Matsui. By definition, we have

DP _max () - max Pr [f (x φ α) φ f (x) = b] αφO, bx uniform

and

LP _max (/) = max 2 Pr [x ^• α = f (x) ^• 6] - 1 α, bτt0 \ x uniform

The function g is defined by the table

X 0 1 2 3 4 5 6 7 8 9 abcdefg ( ^χ ) a 6 0 2 bel 8 d 4 5 3 fc 7 9 which comes from the logic circuit of depth four represented in figure 3.

The function g is also a permutation and has good non-linearity since we have DP _max (#) = 2 ^-2 and LP _max (g) = 2 ^-2 .

The transformation P satisfies DP _max (P) = 2 ^{~ 4} and LP _max (P) = 2 ^-4 . This allows the encryption process to resist attacks from Biham and Shamir and Gilbert and Matsui.

The Feistel diagram of the transformation P successively uses the functions /, g and /. One consequence is that P has an involution property: the inverse transformation of P is P itself, which facilitates the decryption operation. permutation table P is

.0 .1 .2 .3 .4 .5 .6 .7 .8 .9 .a .b .c .d, e .f

0. 29 Od 61 40 9c eb 9e 8f lf 85 5f 58 5b 01 39 66

1. 97 2nd d7 d6 35 ae 17 16 21 b6 69 4th a5 72 87 08

2. 3c 18 e6 e7 fa ad b8 89 b7 00 f7 6f 73 84 11 63

3. 3f 96 7f 6th bf 14 9d ac a4 Oe 7th f6 20 4a 62 30

4. 03 c5 4b 5a 46 a3 44 65 7d 4d 3d 42 79 49 lb 5c

5. f5 6c b5 94 54 ff 56 57 Ob f4 43 Oc 4f 70 6d Oa

6. e4 02 3e 2f a2 47 eO cl d5 la 95 a7 51 5th 33 2b

7. 5d d4 Id 2c ee 75 ec dd 7c 4c a6 b4 78 48 3a 32

8. 98 af cO el 2d 09 Of le b9 27 8a e9 bd e3 9f 07

9. bl ea 92 93 53 6a 31 10 80 f2 d8 9b 04 36 06 8e a. be a9 64 45 38 le 7a 6b f3 al fO cd 37 25 15 81 b. fb 90 e8 d9 7b 52 19 28 26 88 fc dl e2 8c aO 34 c. 82 67 da cb c7 41 e5 c4 c8 ef db c3 ce ab ce ed d. dO bb d3 d2 71 68 13 12 9a b3 c2 ca de 77 de df e. 66 83 bc 8d 60 c6 22 23 b2 8b 91 05 76 cf 74 c9 f. aa fl 99 a8 59 50 3b 2a fe f9 24 bO ba fd fδ 55.

For example, we have F (26) = b8. Indeed, we have / (6) = 7, 2 φ 7 = 5, g () = e, 6 φ e = 8, (8) = e and finally 5 φ e = b.

This table also defines the constants c used in the system of diversification of step keys:

Co = 290d61409ceb9e8f

c ₂ = 972ed7d635ael716 c ₃ = 21b6694ea5728708 c ₄ = 3cl8e6e7faadb889 c ₅ = b700f76f73841163 c ₆ = 3f967f6ebfl49dac c ₇ = a40e7ef6204a6230 c ₈ = 03c54b5a46a34465. The transformation E used in each step of the encryption is a superposition of three stages illustrated in FIG. 5 (we have included the or exclusive with the key of step k ¹ in this figure).

Each stage consists of one or exclusive, with a step key, or a constant c or c ', of four boxes of mixture M, and of byte position exchanges.

The constant c and c 'are defined by the development of the mathematical constant

e = 2, b7el51628aed2a6abf7158δ09cf4f3c762e7160f38b4da56a7

is

c = b7el5162δaed2a6a c = bf7158809cf4f3c7.

Each box M transforms two bytes x _g and X _d into two bytes y _g and y ^ by the formula

y _g = P (ψ ( ^χ ₉ ) ® ^χ _d ) y _d = P (R {x _g ) ® x _d )

where R is the circular rotation defined by

R {X7, Z ₆ , Z ₅ ,. . . , Xo) = (≈ ₆ , Z ₅ ,, • • •, ^X 0, XT)

and where ψ is a function defined by

φ (x ₇ ,..., x ₀ ) = {x7, Xβ Θ X5, Z5, z ₄ θ £ 3, ^ 3, 22 θ rcι, œι, a ^; o φ -c ₇ ).

The M function is constructed to satisfy the mixing box property. One construction criterion was to make it easy to achieve with current technology. It is also such that the inverse function ^~! is also easy to do. In fact, the functions M and M ^{~ l} can be performed by the circuits shown in Figure 6 (we have included the exclusive or with the constant (C _S ,) in this figure). The function ψ 'is defined by

φ '{. r ₇ ,. . . , x _Q ) = (x φ x ₆ , xβ _s s θ £, .r, .τ ₃ φ x ₂ , x ₂ , .r _x φ x ₀ , x ₀ ).

It also realizes the property of midtipermutation defined by Schnorr and Vaudenay.

In general, a multipermutation with r inputs and n outputs is a function f = (/ i,..., F _n ) such that each family pair

(x ₁ ,..., x _r , fι (x ₁ ,..., x _r ),... ₁ f _n (x..., x _r ))

differs in at least - 1 positions.

The byte position exchange of each stage is based on the fast Fourier transform graph, used in the Pαrαllel FFT function

Hαshmg of Schnorr and Vaudenay, and in the SAFER function of Massey. It has the best diffusion and confusion properties.

Decryption is carried out in a similar way, going up each step illustrated in Figure 7.

The encryption process can be carried out by a circuit which uses "pipeline" technology: by cutting the calculation network into several successive layers, each layer is produced by a logic circuit and registers are inserted between each layer. This makes it possible to process a stream of data to be encrypted with a higher speed.

Claims

1. A method of cryptography of data recorded in the form of bits on a medium usable by a calculation unit capable of processing input data m, to provide output data m ', comprising at least one step of processing data in which the calculation unit uses a function. (m) dependent on a key k, characterized in that the function includes a mixing box M capable of processing input data of the mixing box (x_, ..., x _t , ..., x. ), with r ≥ 2, where x _{1 (} ..., x _r are bit blocks, to provide mixing box output data, (y_, ..., y _{j (} ..., x, s ≥ 2, where y_, ..., y _s , are blocks of bits, mixing box which, when all but one of the mixing box input data are fixed, produces for each output data of mixing box a value which is obtained by swapping the value of the non-fixed mixing box input data.

2. Cryptography method according to claim 1, characterized in that the mixing box M is a permutation.

3. Cryptography method according to claim 1 or 2, characterized in that the mixing box M is a multipermutation.

4. cryptography method according to any one of the preceding claims, characterized in that the mixing box M is obtained by adding to a mixing box a permutation on at least any one of its input data or of its output data.

5. Cryptography method according to any one of the preceding claims, characterized in that the function C _j . (M) is obtained by the implementation of successive stages of data processing, each stage verifying the property of the data of mixing box outlet.

6. Cryptography method according to any one of the preceding claims, characterized in that the mixing box comprises a step of processing data by an invertible linear function φ (x).

7. Cryptography method according to claim 6, characterized in that the function φ (x) is defined, in a data representation mode, by: φ (X „..., X ₅ , X ₄ , X ₂ , X _\ , XQ) - (X _t , ..., X ₅ , X © X ₃ , X ₃ , X © Xj, X_, X _Q © x_), where Xo, ..., x, are blocks of bits and where © represents the bit-by-bit exclusive OR function.

8. Cryptography method according to claim 6, characterized in that the function φ (x) is defined, in a data representation mode, by: φ (x „..., x ₅ ... x ₀ ) = (x, Θ x _t _ _!, ..., x ₅ © x ₄ , ^χ ₄ , x ₃ © x ₂ , x ₂ , x, Θ X ₀ , Xo), where X _Q , ..., x, are blocks of bits and where © represents the bit-by-bit exclusive OR function.

9. Cryptography method according to any one of the preceding claims, characterized in that it comprises a step of processing data by a permutation P with 8 input bits and 8 output bits, such as:

DP _mx (P) = max _{aΛ> b} Pr _{x uniform} [P (x © a) © P (x) = b] ≤ 2 ^" *, or LP _miX (P) = max ^ (2 Pr _{x uniform} [x. a = P (x) .b] - l) ² ≤ 2 ^~ *, the permutation P being carried out by means of a logic circuit of depth less than or equal to 17.

10. Cryptography method according to claim 9, characterized in that the permutation P is an involution.

11. Cryptography method according to any one of the preceding claims, characterized in that it comprises a step of processing data by a permutation g with 4 input bits and 4 output bits, such as:

DP _m „(g) = max _{i 0) b} Pr _{x uniform} [g (x © a) © g (x) = b] ≤ 2 ^{" 2} , or LP _{m "} (g) = max. ^ (2 Pr _{x uniform} [xa = g (x) .b] - l) ² ≤ 2 ^"2 , the permutation g being carried out by means of a logic circuit of depth less than or equal to 4.

12. Cryptography method according to any one of the preceding claims, characterized in that it comprises a step of processing data by a function f with 4 input bits and 4 output bits, such as: DP _m „( f) = max ^ Pr _{x uniform} [f (x θ a) © f (x) = b] ≤ 2 ^"2 , or LP _m „ (f) = max _{≠ 0} (2 Pr _{x uniform} [xa = f (x ) .b] - l) ² ≤ 2 ^' , the function f being performed by means of a logic circuit of depth less than or equal to 2.

13. Cryptography method according to claim 12, characterized in that the function f is defined by f (x ₃ , x ₂ , x _lf X _Q ) =

[NO (NONx _3. X_), NO (NONx _2. X_),

. x ₀ ), NO (NONX _Q. x ₃ )].

14. Cryptography method according to any one of the preceding claims, characterized in that the key k is broken down into at least two blocks k ^-1 and r ² .

15. Cryptography method according to the preceding claim, characterized in that the blocks k ^-1 and k ^{~ 2} are processed using a Feistel scheme to produce subkeys ko, ..., k _n .