WO2003007540A1

WO2003007540A1 - Commutative encryption/decryption method

Info

Publication number: WO2003007540A1
Application number: PCT/IT2001/000639
Authority: WO
Inventors: Simonetta Bisi; Walter Bisi
Original assignee: Universita' Degli Studi Di Roma 'la Sapienza'
Priority date: 2001-07-13
Filing date: 2001-12-18
Publication date: 2003-01-23
Also published as: EP1410560A1; ITTO20010694A1; ITTO20010694A0

Abstract

An encryption method designed for enabling a first processing unit to send an encrypted message, via a bi-directional communication network, to at least one second processing unit connected to said bi-directional network; the encryption method comprising the steps of performing, via the first processing unit, a first encryption (100) of a message, using at least one first private key (CHA), and of sending (110) the encrypted message, via the bi-directional communication network, to the second processing unit, which performs a second encryption (130) of the message, using a second private key (CHB); the second processing unit sends the encrypted message back to the first processing unit, which performs a decryption (160) of the message by removing the first encryption by means of the first private key (CHA) and re-transmits the encrypted message to the second processing unit, which in turn performs decryption (190) of the message by removing the second encryption by means of the second private key (CHB), in such a way as to obtain the decrypted message.

Description

COMMUTATIVE ENCRYPTION/DECRYPTION METHOD

TECHNICAL FIELD

The present invention relates to an encryption method.

The present invention finds an advantageous, but not exclusive, application in communication systems comprising at least one bi-directional communication network and at least two processing units designed to communicate with one another via the bi-directional communication network, to which the ensuing treatment will refer explicitly, without thereby losing in generality.

BACKGROUND ART As is known, Internet and the networks connected thereto are commonly used to enable exchange of information between individual users or organizations.

In this connection, the information is exchanged between two or more computers which are connected to the aforesaid networks and are able to encode the information itself, for example an e-mail message, into a packet of data, which are subsequently transmitted through the network.

In the aforesaid networks, interception of the communications by non-authorized users represents one of the major problems that currently afflict individual users and organizations.

In order to ensure protection against interception of the data packets, it is advisable to encrypt all the data transmitted. In particular, an encrypted transmission is a transmission that contains encrypted data, which can be decrypted only by applying a correct decryption key.

At present, mainly two types of encryption systems are known: single-key or symmetrical-key encryption systems, and public- key or asymmetrical-key encryption systems.

In particular, single-key encryption systems presuppose knowledge of the decoding key by both the parties involved, namely the sender and the addressee, who respectively encrypt and decrypt the message by means of one and the same private encoding/decoding key, which is known only to the sender and to the addressee.

Albeit easy to implement, the above-mentioned single-key encryption systems present the drawback of requiring sending of the encoding/decoding key via a secure channel, and hence of not guaranteeing secrecy of the information in the case where a non-authorized user intercepts the private key. As regards, instead, public-key encryption systems, these envisage the use of a pair of keys per person, which are related to one another: a public key, which is known to everybody, and a private key, which is known only to the corresponding user.

In detail, in the case where the sender wants to send a message not decryptable by others through a non-secure channel, he just has to encrypt the message with the public key of the addressee and to transmit the message to the latter, who can then decrypt it with his own private key.

Public-key encryption systems present the drawback of not ruling out the possibility of a non-authorized user intercepting the message at both ends; namely, the possibility of him picking up the public keys of both of the users who are exchanging messages and replacing them with a pair of keys that he can decrypt, in such a way that he will be able to intercept and decode any message exchanged between the users in question, thus infringing the secrecy of the message.

DISCLOSURE OF INVENTION The purpose of the present invention is therefore to provide an encryption method that will be free from the drawbacks described above.

Provided according to the present invention is an encryption method which is designed to enable at least one first processing unit to send an encrypted message, via a bidirectional communication network, to at least one second processing unit connected to said bi-directional network; said encryption method being characterized in that it comprises the following steps: performing, via said first processing unit, a first encryption of a message, using at least one first private key associated to said first processing unit, and sending, via said bi- directional communication network, said encrypted message to said second processing unit; receiving said encrypted message via said second processing unit, and performing a second encryption of the message, using a second private key associated to said second processing unit, and sending said encrypted message, via said bi-directional communication network, back to said first processing unit; receiving said encrypted message, via said first processing unit, and performing a decryption of the encrypted message by removing said first encryption by means of said first private key, and re-transmitting said encrypted message to said second processing unit; and receiving said encrypted message via said second processing unit, and performing a decryption of the encrypted message by removing said second encryption by means of said second private key, in such a way as to obtain the decrypted message.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will now be described with reference to the annexed drawings, which illustrate a non-limiting example of embodiment thereof, and in which: Figure 1 illustrates a block diagram of an encryption method operating according to the teachings of the present invention;

Figure 2 illustrates a block diagram of a first encryption operation performed according to the encryption method illustrated in Figure 1;

Figure 3 illustrates a block diagram of a second encryption operation performed according to the encryption method illustrated in Figure 1;

Figure 4 illustrates a block diagram of a first decryption operation performed according to the encryption method illustrated in Figure 1;

Figure 5 illustrates a block diagram of a second decryption operation performed according to the encryption method illustrated in Figure 1; and Figure 6 illustrates a variant of the decryption method illustrated in Figure 1.

BEST MODE FOR CARRYING OUT THE INVENTION

According to what is described in detail hereinafter, the present encryption method is based upon the idea of carrying out a threefold bi-directional exchange of a message between a sender and an addressee, through a bi-directional channel, performing in sequence a first encryption and a second encryption of the message, using a first private key and a second private key, which are respectively known to the sender and to the addressee, and a subsequent first decryption and second decryption of the message by the sender and the addressee, respectively using the first private key and the second private key, in this way enabling reading of the message exclusively by the addressee, who is able to decode the message using only his own private key, the need for an exchange of keys between the two persons who are communicating thus being eliminated.

In particular, the present method is preferably, but not exclusively, suitable for implementation in a communication system (not illustrated) comprising a first processing unit (not illustrated) , which is designed to communicate, via the bi-directional channel, namely through a bi-directional communication network (not illustrated) , with at least one second processing unit (not illustrated) connected to said bidirectional communication network.

In detail, implementation of the present method in the above- mentioned system enables a first user to encrypt (via the first processing unit not illustrated) , a message, using a private key of his own, and to send the encrypted message, through the bi-directional communication network, to a second user, who is able to decrypt the message (via the second processing unit not illustrated) , using a private key of his own, which is different from the key of the first user.

In particular, the first communication unit and the second communication unit may be implemented, for instance, by means of computers (not illustrated) , of a known type, which communicate with one another through a bi-directional network of a known type, such as a LAN-type local network, Intranet, or a WAN global network, Internet (not illustrated) .

With particular reference to Figure 1, the operations of the method according to the present invention will now be illustrated.

The first processing unit, which will hereinafter be designated as "unit A", carries out a first encryption (described in detail in what follows) of a message MESS(N) of length N ("clear" message), using a secret private key CHA of its own (block 100), thus obtaining an encrypted message AMES(N), which is sent (block 110), through the bi-directional channel (not illustrated) , to the second processing unit (not illustrated) , which will be designated hereinafter as "unit B" . Unit B, upon receiving the cryptogram (block 120) , namely, the encrypted message AMES(N) transmitted by unit A, performs a second encryption (block 130) (i.e., it over-encrypts the cryptogram) of the encrypted message AMES(N), using a secret private key CHB of its own, thus obtaining a new encrypted message BAMES(N), which is transmitted (block 140) to unit A via through the bi-directional channel.

Upon receiving the message BAMES(N) (block 150) sent by unit B, unit A decrypts the message BAMES(N) (block 160) by removing the first encryption, using its own private key CHA, thus obtaining a message BMES(N) which only presents the encryption performed by unit B by means of the corresponding private key CHB.

At this point, unit A transmits (block 170) the message BMES(N), through the bi-directional channel, to unit B, which, upon receiving the message BMES(N) (block 180), is able to decode it (block 190), decrypting it by removing the second encryption, using its own private key CHB, thus obtaining the clear message MESS(N) completely decrypted.

With particular reference to Figure 2, there will now follow a detailed illustration of the first encryption operation (block 100) performed according to the method of the present invention.

Initially, the block 200 is reached, in which unit A detects the number N of alphanumeric symbols that make up the message to be transmitted and stores each symbol of said message in the vector MESS (N) having a size equal to N.

The block 200 is followed by the block 210, in which unit A carries out encoding of the N alphanumeric symbols S(j) contained in the vector MEΞS(N), converting them into a numeric format; i.e., in other words, the vector MESS(N) is converted into a numeric vector MCA(N) containing a plurality N of numbers MCA(j), each of which is uniquely associated to a corresponding symbol S(j) of the message contained in the vector MESS (N) .

In detail, the aforesaid encoding is preferably, but not necessarily, performed via an encoding/decoding matrix TA(1, h) designed to define a bi-unique relation between a set of h alphanumeric symbols and a set of h numbers, each of which is randomly determined.

In particular, the encoding/decoding matrix TA(1, h) may comprise, in the first row, the vector TA(1, h) , in which there is stored a pre-set number h of alphanumeric symbols (for example, h = 65) corresponding to the alphanumeric symbols that can be typed in by the user via a control keyboard of a known type (not illustrated) connected to the processing unit A, whilst in the subsequent rows, for example in the second row, there may be sorted h random numbers TA(2, j) (j-th component of the matrix TA(1, h) ) , each of which is associated to a respective alphanumeric symbol TA(1, j) set in the first row of the corresponding column.

With reference to what has been said above, it should be emphasized that the numeric vector MCA(N) is determined via a search algorithm of a known type, in which for each symbol contained in the vector MESS(N) a search is carried out in the matrix TA(1, h) for the random number to be assigned to the numeric vector MCA(N).

In detail, the search algorithm may be, for example, the following:

IF TA(1, d)=MESS(j) THEN MCA(j)=TA(2, d)

where it is assumed -that the matrix TA(1, h) is a matrix of size 2*h and that S(j) is the j-th symbol of the message MESS(N) .

With reference to the foregoing, it should be pointed out that each random number TA(2, h) associated to a given alphanumeric symbol is determined via a method for the generation of random numbers of a known type, and hence not described herein in detail .

It should moreover be pointed out that the matrix TA(1, h) can be a multidimensional matrix designed to associate, to each alphanumeric symbol, a plurality of random numbers.

The block 210 is followed by the block 220, in which unit A is designed to implement an algorithm for the generation of factors XA(j) which have a random character, i.e., which are determined by means of a method for the generation of random numbers (pseudo-random method) , through which there is calculated, via a given relation, a sequence of numbers starting from a pre-set initial condition, namely, starting from a pre-set initial number commonly referred to by the term "seed" .

In the case in point, the aforesaid algorithm may be preferably, but not necessarily, obtained using a multiplicative congruence method for determining random numbers via the following relation:

XA(j)=a*XA(j-l) MOD m

where XA(j), a and m are non-negative integers, and XA(j) is a number comprised between 0 and m. In particular, XA(j) is the j-th random number and has a value equal to the integer part of the remainder of the division a*XA(j-l)/m, whilst XA(0) corresponds to the "seed" used in the method, and is set at a value equal to the private key CHA=X(0) associated to unit A. With reference to the foregoing, it should be pointed out that the random factors XA(0), XA(1), ..., XA(j) are stored in a vector XA(N), hereinafter referred to as vector of random numbers or random-number vector XA(N).

It is obvious that for the generation of the random factors XA(j), as an alternative to the multiplicative congruence method, similar methods may be used, such as the additive congruence method or the mixed congruence method.

With reference to Figure 2, the block 220 is followed by the block 230, in which an encryption vector A(N) is obtained, which contains a number N of encryption factors A(j), each of which is determined as a function of N and of the random-number vector XA(N) .

In the case in point, each encryption factor A(j) of the encryption vector A(N) is determined by selecting a pre-set number NMA of figures (for example, the first two figures NMA=2) of a respective number XA(j) of the random-number vector XA(N) .

The block 230 is followed by the block 240, in which encryption of the message is performed by means of a pre-set function F_xi, for example an algebraic function. For reasons of simplicity of description, the use of the additive algebraic function F_xi will be considered in the sequel.

In particular, in the block 240 the encrypted message AMES(N) is determined via an addition operation between each component of the numerical vector MCA(N) and a respective component A(j) of the encryption vector A(N).

In particular, in the block 240 the following operation is carried out for each component of the numeric vector MCA(N) : AMES(j)=MCA(J)+A(J)

where the index j ranges from 0 to N.

At this point, the first encryption operation terminates

With particular reference to Figure 3, there will now be illustrated in detail the second encryption operation (block 130) carried out according to the method of the present invention, in which it is assumed that unit B uses for encryption/decryption of the messages a matrix TB(1, h) which is the same as the matrix TA(1, h) described above and used by unit A.

Initially, the block 300 is reached, in which unit B detects the size N of the message AMES(N) encrypted and transmitted by unit A.

The block 300 is followed by the block 310 (substantially similar to the block 220 described above) , in which unit B implements an algorithm for the generation of factors XB(j) which have a random character, i.e., ones determined by means of a method for the generation of pseudo-random numbers, whereby there is calculated, using a given relation, a sequence of numbers, starting from a pre-set initial condition in which the seed is equal to the private key CHB associated to unit B.

Calculation of the vector XB(N) is substantially equivalent to calculation of the vector XA(N) described above, and consequently will not be explained any further.

In the block 310 there is moreover performed storage of the random factors XB(0), XB(1), ...,XB(j) in a random-number vector XB(N) . The block 310 is followed by the block 320, in which unit B determines the encryption vector B(N) comprising a number N of encryption factors B(j), each of which is determined as a function of N and of the random-number vector XB(N) .

In the case in point, each encryption factor B(j) is determined by selecting a pre-set number NMB of figures (for example the first two figures NMB=2) of a respective number XB(j) of the random-number vector XB(N).

The block 320 is followed by the block 330, in which the second encryption of the message AMES (N) is performed by means of a pre-set function F_x2, for example an algebraic function. It should be pointed out that, also in this case as in the case of block 240, as an alternative to the additive algebraic function, the pre-set function F_x2 may be of a multiplicative type.

In particular, in the block 330 the encrypted message BAMES(N) is determined via an addition operation between each component of the numeric vector AMES(N) and a respective encryption factor B(j) comprised in the encryption vector B(N) .

In particular, in the block 330 for each component of the numeric vector AMES(N) the following operation is carried out:

BAMES ( j ) =AMES ( j ) +B ( j )

where the index j ranges from 0 to N.

At this point, the second message-encryption operation terminates .

With particular reference to Figure 4, there will now follow a detailed illustration of the first decryption operation (block 160) implemented according to the method of present invention. Initially, the block 400 is reached, in which unit A detects the size N of the message ABMES(N).

The block 400 is followed by the block 410, in which unit A carries out decryption of the encrypted message ABMES(N) by removing its own first encryption, via the encryption vector A(N) determined using the private key CHA.

It should be pointed out that the first decryption is carried out using a pre-set algebraic function F_x3 which is the inverse of the algebraic function F_xι used in the first encryption. Consequently, the pre-set function F_x3 in this case is a subtractive function, in so far as the function F_xi used is of the additive type.

It is obvious that if, as an alternative to the additive function F_xi a multiplicative function F_xχ is used, the function F_x3 will be a division function.

In particular, in the block 410 a decrypted numeric vector BMES(N) is obtained using the following relation:

BMES(j)=BAMES(j)-A(j)

where the index j ranges from 0 to N.

At this point, the first decryption operation terminates.

With reference to what has been described above it should be pointed out that the message BMES(j) obtained via the first decryption can at this point be decrypted exclusively by the user B, who is the only owner of the private key CHB.

With particular reference to Figure 5, there will now follow a detailed description of the second decryption operation (block 190) adopted in the method according to the present invention.

Initially, the block 500 is reached, in which unit B detects the size N of the message BMES(N).

The block 500 is followed by the block 510, in which unit B carries out decryption of the message BMES (N) by removing the second encryption by means of the encryption factor B(N) determined using the private key CHB associated to unit B.

With reference to the foregoing, it should be pointed out that the second encryption is carried out using a pre-set algebraic function F_x4, which is the inverse of the algebraic function F_x2. Consequently, the pre-set function F_x4 is in this case a subtractive function in so far as the function F₂ used is of the additive type. It is obvious that if, as an alternative to the additive function F₂, a multiplicative function F_x2 is used, the function F_x4 will be a division function.

In particular, in the block 510 a numeric vector is obtained containing the decrypted message MCB(N) using the following relation:

MCB(j)=BMES(j)-B(j)

where the index j ranges from 0 to N.

The block 510 is followed by the block 520, in which unit B carries out final decoding of the message.

It should be emphasized that the vector MCB(N) is the same as the vector MCA(N) obtained during the first encryption (block 100) .

The "clear" message MESS(N) is obtained from the vector MCB(N) via a search algorithm, in which for each number MCB(j) contained in the vector MCB(N) a search is carried out in the matrix TB(1, h) for the alphanumeric symbol to be assigned to the vector MESS(N), in such a way as to determine the initial message, i.e., the starting message.

In detail, the search algorithm may be, for example, the following:

IF TB(2, k)=MCB(j) THEN MESS ( j ) =TB ( 1, k)

At this point, the second decryption operation is completed.

With reference to what has been described above, it should be pointed out that the sequential operations comprising the first and second encryptions and the first and second decryptions can be repeated for each alphanumeric symbol included in the message .

In particular, in this case, each "clear" message is broken down into alphanumeric symbols, each of which undergoes the threefold bi-directional exchange during which it undergoes double encryption/decryption by means of the first key CHA and second key CHB.

In particular, the method associates, to each symbol S(J), a respective first key CHAj and second key CHB-,, thus rendering the complete message unencryptable to a non-authorized user.

Once decrypted by unit B, each symbol S(J) is queued in a vector MESS(j) designed to contain the message.

Unit B will be able to "reconstruct" and decrypt the complete message upon reception and decryption of the last symbol S(J) transmitted by unit A.

With particular reference to Figure 6, there will now follow a detailed illustration of a variant of the present method.

In particular, the said variant envisages the use of a "symmetrical" private key, namely a key used both by the sender and by the user for respectively encrypting and decrypting the message .

Initially the block 600 is reached, in which the user A carries out encryption of the message, using one or more private keys.

In particular, unlike the case of the first encryption described previously (block 100) , in which a single key CHA is used, the present variant envisages the use of a plurality of keys designed to increase the difficulty of decryption of the message by a user who is not authorized to read the message.

For example, the present variant envisages the use of the following four keys:

- a first private key CHA1, which encodes the seed used in congruence generators of random numbers for the calculation of the random-number vector XA(N);

- a second private key CHA2, which encodes a given number NMA of figures used for obtaining the encryption vector A(N);

- a third private key CHA3, designed to encode a given matrix TAj(l, h) for encryption/decryption of the message; in detail, the method according to the present variant envisages the use of a plurality of encoding/decoding matrices TA (l, h) , each of which can be identified by means of a given key CHA3; and

- a fourth private key CHA4, which encodes a specific algebraic function F_Xn, used in encryption, for example a function of addition, division, multiplication, or subtraction.

The block 610 is followed by the block 620, in which a single vector CMES(K) is determined which comprises the encrypted message and the keys used for encrypting the message itself. In particular, the private keys are in turn encrypted and are set in the vector CMES(K) according to a pre-set position which is known beforehand both to unit A and to unit B. For example, the keys may be set at the "head" or at the "tail" of the vector CMES (K) according to a pre-set order which enables recognition of the keys during decryption of the message stored in the vector.

It should be pointed out that, as an alternative to the pre-set arrangement of the keys in the vector CMES(K), it is possible to encode, in the vector CMES (K) , an encrypted numeric value containing indications for enabling unit B to detect the position of each of the keys sent.

The block 620 is followed by the block 630, in which unit A sends the encrypted vector CMES (K) to unit B.

The block 630 is followed by the block 640, in which unit B receives the encrypted vector CMES(K) from unit A. The block 640 is followed by the block 650, in which unit B carries out detection, namely decoding, of the keys present in the vector CMES(K) .

The block 650 is followed by the block 660, in which unit B carries out decryption of the message MESS(N), using the keys detected.

In particular, after decryption of the keys unit B is able to derive all the information for decrypting the message, namely: the information regarding the seed used in the congruence generators of random numbers for the calculation of the random- number vector XA(N), the number NMA used for obtaining the encryption vector A(N), the matrix TA_σ(l, h) for encrypting/decrypting the message, and the function F_Xn used in encryption, from which the inverse function used for decrypting the message is selected. With reference to the foregoing, it should be emphasized that the method according to the above-described variant may be preferably, but not necessarily, applied in the case of communications between a restricted group of users (for example, a communication network used for military purposes or for communications within firms), where there is likely to be exchange of strictly confidential information.

The present method affords the advantage that no exchange is required of public or private keys between two or more users, the possibility for a non-authorized user to decrypt a message being thus drastically reduced.

In addition, the high number of encoding/decoding tables T(l, h) , the high number of possible algorithms for the generation of random numbers, and the extremely high number of initial keys render any forced attempt to decrypting the message altogether of no avail.

Finally, the present method affords the advantage of being extremely simple and inexpensive to implement.

Claims

1. An encryption method designed to enable at least one first processing unit to send an encrypted message, through a bi- directional communication network, to at least one second processing unit connected to said bi-directional network; said encryption method being characterized in that it comprises the following steps: performing, via said first processing unit, a first encryption (100) of a message (MESS(N)), using at least one first private key (CHA) associated to said first processing unit, and sending (110), through said bi-directional communication network, the encrypted message (AMES (N) ) to said second processing unit; receiving (120) said encrypted message (AMES(N)) via said second processing unit, and performing a second encryption of the message (130), using a second private key (CHB) associated to said second processing unit, and sending (140) said encrypted message (BAMES(N)), through said bi-directional communication network, back to said first processing unit; receiving (150) said encrypted message (BAMES (N) ) , via said first processing unit, and performing a decryption (160) of the encrypted message (BAMES (N) ) by removing said first encryption using said first private key (CHA), and re-transmitting (170) said encrypted message (BMES(N)) to said second processing unit; and receiving (180) said encrypted message (BMES(N)) via said second processing unit, and performing a decryption (190) of the encrypted message (BMES(N)) by removing said second encryption using said second private key (CHB) , in such a way as to obtain the decrypted message (MESS(N)).

2. The method according to Claim 1, characterized in that said first and second encryption steps (100), (130) comprise the steps of randomly generating (220) , (310) said first and second private keys (CHA) , (CHB) .

3. The method according to either Claim 1 or Claim 2, characterized in that said first and second message-encryption steps (100), (130) comprise the following steps: determining (220), (310) a sequence of random factors (A(J)), (B(J)) starting from an initial number pre-set by means of a pre-set relation that generates random numbers; and encrypting (240), (330) the message (MESS(N)), (AMES(N)) by means of said random factors (A(J)), (B(J)) via a pre-set encryption function (F_xi) , (F_x2) .

4. The method according to Claim 3, characterized in that said first encryption step (100) comprises the step of encoding (210) each alphanumeric symbol (S(j)) comprised in the message (MESS (N) ) , converting it into a numeric format via a pre-set encoding function.

5. The method according to Claim 4, characterized in that said encoding function is defined by at least one encoding matrix ((TA(l,h)), (TB(l,h))) which is designed to establish a bi- unique relation between a plurality of alphanumeric symbols ((TA(l,h)), (TB(l,h))) and a plurality of respective numbers ((TA(2,h)), (TB(2,h))) determined in a random way.

6. The method according to any of Claims 3 to 5, characterized in that said pre-set function (F_xi) , (F_x2) designed to encrypt the message (MESS(N)), (AMES(N)) by means of said random factors (A(J)), (B(J)) is an algebraic function.

7. The method according to any of Claims 3 to 6, characterized in that said pre-set relation designed to determine a sequence of numbers starting from a pre-set initial number is a congruence function that generates random numbers.

8. The method according to any of Claims 3 to 7, characterized in that said first and second decryption steps (160) , (190) for decrypting the message comprise the steps of decrypting the messages (BAMES (N) ) , (BMES(N)) by means of said random factors (A(J)), (B(J)) via a pre-set encryption function (F_x3), (F_x4) .

9. The method according to Claim 8, characterized in that said second decryption step (190) for decrypting the message

(BMES (N) ) comprises the step of decoding (520) said message (BMES(N)) by means of said encoding/decoding relation.

10. The method according to Claim 9, characterized in that said decoding relation is defined by at least one decoding matrix

(TB(1, h) ) designed to establish a bi-unique relation between a plurality of alphanumeric symbols (TB(1, j) and a plurality of respective numbers (TB(2, j) determined in a random way.

11. The method according to any of Claims 8 to 10, characterized in that said decryption function (F₃), (F_x4) is an algebraic function which is the inverse of said encryption function (F_xi) , (F_x2) .