WO2004032412A1

WO2004032412A1 - Secure method for digital data transmission

Info

Publication number: WO2004032412A1
Application number: PCT/FR2003/002974
Authority: WO
Inventors: Franck Leprevost; Xavier-François ROBLOT; Alexei Pantchichkine; Roland Gillard
Original assignee: Universite Joseph Fourier
Priority date: 2002-10-07
Filing date: 2003-10-07
Publication date: 2004-04-15
Also published as: AU2003299160A1; FR2845542A1; FR2845542B1

Abstract

The invention concerns a secure method for digital data transmission which consists in transforming the digital data to be transmitted into a sequence of initial integers each of which is less than pd where p and d are two specific integers, and, for each of the initial integers, including the following steps which consists in: determining initial coefficients of an initial polynomial of degree less than d corresponding to the expression of the initial integer in base p; determining new coefficients of a new polynomial of degree less than d, image of the initial polynomial by an encryption bijection, said encryption bijection corresponding to the combination of intermediate bijective applications, at least one of said intermediate bijective applications being defined based on a Drinfeld module associated with an encryption key; defining a new integer based on the new coefficients; and transmitting the new integer.

Description

SECURE METHOD FOR TRANSMITTING DIGITAL DATA

The present invention relates to a secure method of transmitting digital data using public key encryption.

In areas such as telecommunications, the Internet, cell phone communications, wireless communications, transmitted data is carried over unsecured transmission channels that unauthorized third parties can access. To prevent a third party from accessing and possibly modifying data, data transmitted over an unsecured channel is generally coded before its transmission.

It is known to encode digital data using two keys, a public key and a private key. The keys are linked so that data encoded using the public key can only be decoded with the private key. The public key can then be made available to everyone, only the holder of the private key, which is kept secret, can decode messages encoded with the public key. The development of a public key encryption amounts to finding a bijective encryption function made public which is easy to implement but whose converse is difficult to calculate without know certain secret parameters, i.e. the private key.

Such functions are difficult to obtain and are generally based on mathematical equations which are difficult to solve. The best known encryption methods are based on mathematical operations of factorization of integers and calculation of discrete logarithms on a cyclic finite group.

An example of encryption, currently widely used and based on the problem of factorization of integers, is the RSA encryption described for example in US patent 4405829. The encryption consists in multiplying two prime integers p and q to provide an integer n, and determining an integer e prime with (p-1) (q-1). The integers e and n correspond to the public keys. The private key d secret is an integer such that the product ed is congruent to 1, modulo (p-1) (q-1). The cryptogram F associated with a message M to send corresponds to the _e th power, ^ _{e mo} dulo n. The initial message is found from the cryptogram F by calculating the power of ^^ ^® of the cryptogram F modulo n. The security of this encryption process is based on the fact that, to calculate the private key d, you must know the integers p and q and therefore be able to factorize the integer n, which is a problem which, in general, is difficult to solve when p and q are large. The problem of calculating discrete logarithms, implemented for example in ElGamal type ciphers, consists in determining a value x of a cyclic and finite group G such that a ^x = b, where a and b are elements of G The value x is called logarithm of b on the basis of a. The difficulty in determining x depends on the representation of G. In particular, the problem is difficult to solve if the order of G is divisible by a large prime number. In practice, the group G can be the multiplicative group of a finite field F _p comprising the integers modulo p, or the group E (Fp) of the points of an elliptic curve E on the finite body Fp. To estimate the security provided by a digital data transmission method using a specific encryption, one or more encryption reference parameters are generally used. For an encryption of the RSA type, the reference parameter s used is the size in bits of the integer n. For an encryption method of the ElGamal type, the reference parameter s used is for example the smallest integer dividing the order of group G. An attack against encryption consists in finding a message sent from the cryptogram of the message without knowing the private key. To estimate the effectiveness of an attack, the maximum number of "elementary" operations T which must be carried out by a computer during the implementation of the attack is determined. The effectiveness of the attack, or its complexity, is assessed by determining the evolution of the number T as a function of the reference parameter s. There are essentially three types of complexity: the attack is said to be of polynomial complexity if, T being the number of maximum operations necessary for a pirate decryption when the reference parameter has a value s, and T 'the number of maximum operations necessary when the reference parameter has a value 2s, T 'is less than T multiplied by a constant C independent of s; the attack is said to be of exponential complexity if T 'is greater than T raised to a power α strictly greater than zero and independent of s; and the attack is said to be of sub-exponential complexity if it is not possible to find the constants C or α defined above. Such complexity is intermediate between a polynomial complexity and an exponential complexity.

An encryption for which there is an attack of polynomial complexity does not guarantee sufficient security. Indeed, to prevent future attacks, it is necessary to choose a very large reference parameter size which must be increased very frequently. This in practice leads to calculation times and incompatible storage spaces with a ^common use of the encryption process. An encryption for which there is an attack of sub-exponential complexity presents a guarantee of sufficient security if the reference parameter is chosen sufficiently large. This can in practice be compatible with a common use of encryption when transmitting data over an insecure transmission channel.

The most favorable case is, of course, the case of an encryption for which there are only attacks of exponential complexity since it allows the use of a smaller reference parameter. For ciphers of the RSA and ElGamal type on the multiplicative group of a finite field Fp, there are currently only attacks of sub-exponential complexities. For the ElGamal type ciphers on the group E (F _p ) of the points of an elliptic curve E on the finite body Fp, there are currently only exponential attacks on well chosen curves. A transmission method using such encryption therefore presents a priori greater security than other types of encryption. However, such an encryption remains relatively more difficult to implement. In addition, it is desirable to provide encryption methods of various types to complicate the task of possible hackers.

The present invention provides an original secure method of data transmission which, compared to the attacks currently used, presents only exponential attacks.

To achieve this object, the present invention provides a secure method of transmitting digital data consisting in transforming the digital data to be transmitted into a series of initial integers each of which is less than p ^d where p and d are determined integers, and, for each of the initial integers, comprising the steps of determining initial coefficients of an initial polynomial of degree less than d corresponding to the expression of the initial integer in base p; determining new coefficients of a new polynomial of degree less than d, image of the initial polynomial by an encryption bijection, said encryption bijection corresponding to the combination of intermediate bijections, at least one of said intermediate bijections being defined from a Drinfeld module associated with an encryption key; define a new integer from the new coefficients; and pass the new whole number.

According to one embodiment of the invention, the determination of the intermediate bijection defined from a Drinfeld module comprises the steps consisting in determining the encryption key corresponding to a first polynomial of degree less than d selected in a first ring polynomials, these polynomials being polynomials of a first variable with coefficients in the finite field of integers modulo p; select a second polynomial in a second ring of polynomials of a second variable with coefficients in the first ring, this second ring being such that, in this second ring, the multiplication of the second variable by an element of the first ring is equal to the multiplication of said element raised to the power p by the second variable; determining the Drinfeld modulus associated with the encryption key as being a third polynomial of the second ring equal to the sum of powers of the second polynomial multiplied by the coefficients of the first polynomial; determining an intermediate function of the first ring in itself consisting for an element of the first ring in replacing in the third polynomial the second variable by said element raised to the power p; and determining said intermediate bijection as being equal to the remainder of the division of said intermediate function by a fourth irreducible polynomial of the first ring of degree d. According to an embodiment of the invention, the second polynomial is non-constant and of constant term equal to the first variable.

According to one embodiment of the invention, the encryption bijection corresponds to the combination of a first intermediate bijection defined from a Drinfeld module associated with a first encryption key, an intermediate bijection and a second intermediate bijection defined from a Drinfeld module associated with a second encryption key.

According to one embodiment of the invention, the second polynomial selected corresponds to the Carlitz module.

According to an embodiment of the invention, the intermediate bijection associates with a polynomial of the first ring the sum of the polynomial raised to a determined power and of a determined polynomial of said first ring of degree less than d.

The present invention also provides a method for decoding digital data transmitted by the secure data transmission method previously described, comprising the steps consisting in determining the reciprocal bijection of the encryption bijection from the intermediate reciprocal bijection of the defined intermediate bijection from the Drinfeld module associated with the encryption key; determining, for each coded whole number received, coefficients of a coded polynomial of degree less than d corresponding to the expression of the coded whole number in base p; determine the initial coefficients of the initial polynomial associated with the coded polynomial. by applying reciprocal bijection to the coded polynomial; and defining the initial integer associated with the integer encoded from the initial coefficients.

According to one embodiment of the invention, the determination of the intermediate reciprocal bijection of the intermediate bijection defined from the Drinfeld module associated with the encryption key comprises the steps consisting in determining a first function of the first ring in itself. even consisting for an element of the first ring to replace in the second polynomial the second variable by said element raised to the power p; determining a second function of the first ring in itself corresponding to the remainder of the division of said first function by the fourth polynomial; determining a fifth polynomial of the first ring corresponding to the characteristic polynomial of the second function; determining a decryption key corresponding to a sixth polynomial of degree less than d of the first ring such that the product of the decryption key and the encryption key is congruent to 1 unit modulo the fifth polynomial; determining the Drinfeld modulus associated with the decryption key as being a seventh polynomial of the second ring equal to the sum of powers of the second polynomial multiplied by the coefficients of the sixth polynomial; determining a third function of the first ring in itself consisting for an element of the first ring in replacing in the seventh polynomial the second variable by said element raised to the power p; and determining said intermediate reciprocal bijection as being equal to the remainder of the division of said third intermediate function by the fourth polynomial.

This object, these characteristics and advantages, as well as others of the present invention will be explained in detail in the following description of particular embodiments given without limitation in relation to the single attached figure representing a diagram of the transmission of a coded message from a transmitter to a receiver.

As shown in the single figure, a transmitter 10 (TRANSMIT) wishes to send a message to a receiver 12 (RECEIVER) via a communication channel 14. The transmitter 10 has an encoder 16 (ENCRYPT ) connected to the transmission channel 14. The receiver 12 has a decoder 18 (DECRYPT) connected to the transmission channel 14.

The method of transmitting a message according to the invention will be illustrated by a simple example. A more example realistic suitable for data transmission for usual data transmission systems is presented at the end of the description.

We denote by p a prime number and .A ≈ Fp [T] the ring of polynomials with a variable T and with coefficients in the field Fp. The body Fp is the finite body comprising the integers {θ, 1, 2, ..., pl} on which the arithmetic operations are carried out modulo p. We denote by B the quotient of l by a polynomial f of degree d strictly greater than 1. An element of B is therefore a polynomial of degree less than d which corresponds to the remainder of the division of any polynomial by f. The cardinal of B is p ¹ ^ -. In the present example, we choose f equal to: f (T) = T ³ + 2T ² + l (1)

The method according to the invention makes it possible to securely transmit integers varying from 0 to p ^ -l. As an example, we will take p and d equal to 3, which makes it possible to code the integers from 0 to 26.

The message to be transmitted is converted into one or more whole numbers which are then divided into message blocks M each corresponding to an integer less than p ^ -1.

The number M is transformed into a polynomial μ element of B using the writing of M in base p. As an example, we choose a message block M equal to 17. We then obtain:

M = lx3 ² + 2x3 + 2 (2) and therefore: μ = T ² + 2T + 2 (3)

The transmission method according to the invention uses an encryption function ψ of B in itself defined as follows: ψ (z) = (φ _cι ° _σ oφ _C2 ) (z) (3)

We will now describe obtaining functions fonctions _c . and φ _c _.

We note - {x) the ring of polynomials with a variable τ and with coefficients in the ring _^ 4 for which the following switching rule is used: τ ^k xa = a ^p xτ ^k (5)

We define a Drinfeld module as a morphism φ of Fp-algebra of _^ 4 in - {τ) such that φ (T) is a non-constant polynomial with constant term T. For an element a such that:

where m is any integer, we get: mm φ (a) = ∑a _i φ (T ⁱ ) = ∑a _i φ (T) ⁱ (7) i = 0 i≈O

The Drinfeld module φ is therefore completely defined once φ (T) has been chosen. The expression of φ (T) is given by the following relation: t φ (T) = ∑Φ _k τ ^k (8) k = 0 where φk is an element of _^ 4, and by definition φ ₀ is equal to T .

There is a more general definition of Drinfeld's modules as morphisms of a commutative ring in a noncommutative ring formed by endomorphisms of an object of algebraic geometry.

By way of example, the Carlitz module defined by: φ (T) = τ + T (9) is chosen as the Drinfeld module.

With the element φ (a) of _^ 4 {τ}, we associate the function φ _a of _^ 4 in itself as follows: q> (a) = ∑ _i τ ¹ (10) i≈O mi φ _a (z) = ∑h _iZ ^p (11) i≈OA φ _a corresponds to the function φ _a of B in itself.

We can show that there exists a unitary polynomial f _φ such that φ _a , = φ _a2 if and only if a _j ≈ a2 modulo f _φ . An application φ _a is then bijective if and only if a is first with f _φ and in this case the inverse map is φ _a ι where a 'belongs to _^ 4 and is such that aa'≡ 1 modulo f _φ .

We can show that the polynomial f _φ is equal to the polynomial characteristic of the matrix A _φ of the map φ _τ expressed in the vector space {1, T, ..., T ^d_1 }.

In this example, from equations (9) and (11), we obtain:

^" φ ^" _τ ( ^'" l) ^' = T + l (12) φ _τ ^~ (T) = T ³ + T ² = 2T ² + 2 (13) φ _τ (T) = T ° + T ^J = 2T + 2 (14)

We deduce the matrix of the map φ _τ in the vector space {1, T, T ² }:

The polynomial f _φ , equal to the characteristic polynomial of the matrix A

We then choose polynomials ci and c ₂ of _^ 4 prime with f, φ for example: c ₁ = T ² + T + 2 (17) c ₂ = 2T ^z + T + l (18)

To calculate φ _c and φ _c „, we use the fact that for a polynomial a of degree strictly less than d, we can write according to equation (7)

The terms Φ _τ i (z) are linked by the recurrence relation

Φl (z) (20)

Φ _τ i (z) = Φτ (Φ _τ i-ι (z)) for i> 0 (21) From equations (9) and (11), we can calculate the expressions of the polynomials in B of φ _C] and φ _C2 .

Φl (z) = z (22) φ _τ (z) = z ^J + Tz (23)

Φ _τ 2 (z) = Φτ (z + Tz) = z + (T + T + 2) z ^J + T ^z z (24)

From equation (19), we deduce:

Φcι ( ^z ) = Φ _τ 2 (z) + φτ (z) + 2φι (z) (25)

= z ⁹ + (T ² + T) z ³ + (T ² + T + 2) z φ ^c 2 (z) = φ _τ 2 (z) + φ _τ (z) + φ! (z) (26) = 2z ⁹ + (2T ² + 2T + 2) z ³ + (2T ² + T + l) z

According to equation (8), and for any polynomial of P (z) of B [z] of the type: m P (z) = ∑π _i z ¹ (27) i = 0 we can write: tm _ k. k φ _τ (P (z)) = ∑ ∑ φ _k π z ^φ (28) k = 0i = 0

We can then determine the encryption function ψ given by equation (3) by taking as function σ a simple and quick to calculate bijective function given in the form of a polynomial. For example, by choosing an integer e less than p ^ -1, not divisible by p and prime with p ^ -1, the function σ can be of the form: σ (z) = z ^e + δ (29 ) where δ is an element taken at random from B.

From the expressions of φ _cι (z), φ _c (z) given by equations (25), (26), we obtain the expression of σ (φ _c „) (z) then the expression of ψ ( z). Note that in this calculation we replace each term of the form γz ^m , where m is greater than p ^d , by the term γz, where r is the remainder of the Euclidean division of m by p ^ -1. The polynomial ψ finally obtained is therefore of degree bounded by p ^. According to the above, taking in the expression of σ, given by equation (29), e is equal to 7 and δ equal to T + T + 1, we obtain: ψ (z) = (T ² + T + 2) z ²¹ + (T + 2) z 19 + (T + 2) z ¹⁵ + (2T ² + 2T) z ^U

5 + 2T ² z ⁹ + (T ² + T) z ⁷ + 2T ² z ⁵ + (T + 2) z ³ + (T ² + T) z + T ² + 2T

(30) In this example, to transmit the message M, we determine μ the polynomial of equation (3), then we determine the coded polynomial χ from the polynomial μ as follows 10. χ = ψ ( μ) = ψ (T ² + 2T + 2) = 2T ² + T + l (31) which corresponds to the following coded message C:

C = l + lx3 + 2x3 ² = 22 (32)

The message C is then transmitted to the receiver 12 by the transmission channel 14.

The public key corresponds to the function ψ which is made public. Conventionally in secure methods of transmitting data by encryption, the transmitter 10 which wishes to transmit the message M can obtain the polynomial 20 ψ from a trusted authority. By means of the encoder 16, the transmitter 10 can then transmit to the receiver 12 via the transmission channel 14 the coded message C.

The private keys held only by the receiver 12 correspond to the expressions of the polynomials ci, c ₂ , δ and of the integer e.

To decode the coded message C, the receiver 12 needs to determine the reciprocal function ψ ^~ of the function ψ.

The converse of the function σ is obtained by determining an integer h such that e ≡l modulo p ^ -1. The converse σ of σ is then given by: σ ^_1 (z) = (z-δ) ^h (33)

As explained above, the reciprocals of the functions φ _c , φ _c are obtained from CiCi polynomials ≡ l mo

c ₂ = T ² + 2T + l (35)

= (<p - o σ ^{~ 1} ) (2T ² + l) = φ. (2T + 1) = T ² + 2T + 2 C2 c ₂

In practice, the integer p is chosen to be very large with respect to d. However, in order to optimize the efficiency of the calculations, it is desirable that p be less than 2 ³² so that the integers modulo p used by the present method can be stored on a "long word" of 32 bits. The size of the polynomial ψ (z) increasing with the exponent e appearing in the expression of σ given by equation (29), it is preferable that the exponent e is small. Furthermore, e having to be prime with p ^ -1, e is odd. Reasonable choices are e = 5 or e = 7. For use compatible with other secure transmission methods by secret key encryption, in particular the AES (Advanced Encryption Standard) method, it is desirable that p ^ be greater than ^2,160 , that is to say substantially 10- ¹ - ⁸ .

A realistic example of the transmission method according to the invention is as follows: p = 1073741477 at = 6 f (T) = T ⁵ + 13775595T ⁴ + 788683423T ³ + 305120033T ²

+ 585880735T + 686 097 596 e = 5 φ (T) = τ + T cj = 437605822T ⁵ + 392755332T ⁴ + 925212769T ³ + 890100049T ² + 541320556T + 287 847 229 c ₂ = 246570738T ⁵ + 49624932T ⁴ + 883670503T ³ + 909401730T ² + 64842034T + 732 002 645 δ = 842509909T ⁵ + 193124111T ⁴ + 551953889T ³

+ 843139803T ² + 188647249T + 872485075 With such parameters, ψ (z) is a polynomial with 235 terms and the storage of the encryption data requires approximately 26 kilobytes.

The present invention provides a particularly secure data transmission method. Indeed, the attacks currently known are attacks of exponential complexity compared to the transmission method according to the present invention.

Of course, the present invention is susceptible to various variants and modifications which will appear to one skilled in the art. In particular, additional digital processing can be carried out on the coded messages before their transmission.

Claims

1. Secure method for transmitting digital data consisting in: transforming the digital data to be transmitted into a series of initial integers each of which is less than p where p and d are determined integers, and, for each of the initial integers, comprising the following steps: determining initial coefficients of an initial polynomial of degree less than d corresponding to the expression of the initial integer in base p; determining new coefficients of a new polynomial of degree less than d, image of the initial polynomial by an encryption bijection, said encryption bijection corresponding to the combination of intermediate bijections, at least one of said intermediate bijections being defined from a Drinfeld module associated with an encryption key; define a new integer from the new coefficients; and pass the new whole number.

2. Method according to claim 1, in which the determination of the intermediate bijection defined from a Drinfeld module comprises the following steps: determining the encryption key corresponding to a first polynomial of degree less than d selected in a first ring polynomials, these polynomials being polynomials of a first variable with coefficients in the finite field of integers modulo p; select a second polynomial in a second ring of polynomials of a second variable with coefficients in the first ring, this second ring being such that, in this second ring, the multiplication of the second variable by an element of the first ring is equal to the multiplication of said element raised to the power p by the second variable; determine the Drinfeld module associated with the encryption key as being a third polynomial of the second ring equal to the sum of powers of the second polynomial multiplied by the coefficients of the first polynomial; determining an intermediate function of the first ring in itself consisting for an element of the first ring in replacing in the third polynomial the second variable by said element raised to the power p; and determining said intermediate bijection as being equal to the remainder of the division of said intermediate function by a fourth irreducible polynomial of the first ring of degree d.

3. Method according to claim 2, in which the second polynomial is non-constant and of constant term equal to the first variable.

- 4. The method of claim 2, wherein the encryption bijection corresponds to the combination of a first intermediate bijection defined from a Drinfeld module associated with a first encryption key, an intermediate bijection and a second intermediate bijection defined from a Drinfeld module associated with a second encryption key.

5. Method according to claim 2, in which the second selected polynomial corresponds to the Carlitz module.

6. The method of claim 4, wherein the intermediate bijection polynomial associated with a first ring of the sum of the high power polynomial to a ^'determined and a polynomial determined from said first ring of degree less than d.

7. Method for decoding digital data transmitted by a method according to one of claims 2 to 6, comprising the following steps: determining the reciprocal bijection of the encryption bijection from the intermediate reciprocal bijection from the intermediate bijection defined from the Drinfeld module associated with the encryption key; determining, for each coded whole number received, coefficients of a coded polynomial of degree less than d corresponding to the expression of the coded whole number in base p; determining the initial coefficients of the initial polynomial associated with the coded polynomial by applying the reciprocal bijection to the coded polynomial; and defining the initial integer associated with the integer encoded from the initial coefficients.

8. The method of claim 7, wherein the determination of the intermediate reciprocal bijection of the intermediate bijection defined from the Drinfeld module associated with the encryption key comprises the following steps: determining a first function of the first ring in itself consisting 'for an element of the first ring to replace in the second polynomial the second variable by said element raised to the power p; determining a second function of the first ring in itself corresponding to the remainder of the division of said first function by the fourth polynomial; determining a fifth polynomial of the first ring corresponding to the characteristic polynomial of the second function; determining a decryption key corresponding to a sixth polynomial of degree less than d of the first ring such that the product of the decryption key and the encryption key is congruent to 1 unit modulo the fifth polynomial; determining the Drinfeld modulus associated with the decryption key as being a seventh polynomial of the second ring equal to the sum of powers of the second polynomial multiplied by the coefficients of the sixth polynomial; determining a third function of the first ring in itself consisting for an element of the first ring in replacing in the seventh polynomial the second variable by said element raised to the power p; and determining said intermediate reciprocal bijection as being equal to the remainder of the division of said third intermediate function by the fourth polynomial.