WO2007015034A2

WO2007015034A2 - Method and system for high-speed encryption

Info

Publication number: WO2007015034A2
Application number: PCT/FR2006/050787
Authority: WO
Inventors: Jean-Luc Stehle
Original assignee: Everbee Networks
Priority date: 2005-08-04
Filing date: 2006-08-03
Publication date: 2007-02-08
Also published as: FR2889637A1; WO2007015034A3; EP1911190A2; FR2889637B1

Abstract

The invention relates to a method and a system for encryption or decryption on the fly of a high-speed information stream. The information is in the form of blocks of bits (M0, M1,..., Mn-1 ), themselves grouped in sectors (S). The invention uses a block encryption method, for example, AES (Advanced Encryption Standard), carried out twice per sector and producing, for each sector, a secondary key (KS) used by a more rapid algorithm (for example XOR mask). The secondary keys are dependent on the sector content and the position thereof in the stream. The same information would be differently encrypted according to the context thereof. On decryption, the secondary key can be recalculated from the encrypted sector by means of the block encryption algorithm. The number of blocks per sector is adjusted to achieve the best compromise between speed of calculation and cryptographic security.

Description

FHOCEDE AND HIGH-RATE ENCRYPTION SYSTEM

Securing electronic communications is becoming increasingly important with the development of computer networks. It is no longer only communications between Internet users that must be secured, but more generally digital communications between more and more devices at increasingly higher speeds.

For example, audiovisual streams can be used for end-users (digital television, pay-TV, movie download) or in a professional environment (video cameras communicating with each other and / or with a server in a digital mode). ). A particular case is that of audiovisual data (music, video ...) stored on encrypted CDs or DVDs which will be decrypted on the fly, at the time of reading, on a special device provided with specific decryption means.

Other applications include communications between a computer's CPU and various storage media, which may be internal or external disks, or remote systems accessed by network. Let us also mention the automobiles of the future, in which the various organs communicate with each other electronically rather than mechanically.

Many encryption algorithms are available and are considered safe in the current state of our knowledge. This is the case of the Advanced Encryption Standard (AES) encryption algorithm as defined in 2000 by the American National Institute of Standards and Technology (NIST). These algorithms obviously require some computing power. It is usually considered that the evolution of technologies results in a doubling of the computing power of the processors every 18 months (Moore's law). It has been found that computer network speeds double every 6 to 12 months. The need for encryption therefore increases much faster than the calculation means, which causes a bottleneck. Let us also mention the need to perform certain encryption and / or decryption operations on limited power equipment (mobile phones, handheld computers, digital PDAs, etc.). Taking security into account then quickly leads to a very significant reduction in the power available for the various applications. It is therefore imperative to implement high-speed encryption solutions offering security comparable to that offered by algorithms such as AES, while reducing their impact on these applications.

An interesting solution is taught in the French patent 03/50626 filed on September 30, 2003, issued January 20, 2006, and in the international application PCT / FR2004 / 050299 of June 30, 2004. The security features, and in particular the encryption / decryption are subcontracted to a small outdoor unit, hereinafter referred to as a "dongle", having its own computing processor and having sufficient power to provide these features without significant impact on the performance of the host device. The dongle is connected to a port (for example a USB port) through which is rerouted the entire flow of data to or from a network or storage means, local or remote. This solution has the added advantage that cryptographic secrets never leave the dongle and are therefore never accessible by a software attack on the host device. However, there is a drawback: performance is no longer limited by the computing power but by the speed of the flow through the port used. Another approach may be the use of a less powerful but faster encryption algorithm. Indeed, in parallel with algorithms similar to AES, safe but demanding in computing power (algorithms hereafter called strong algorithms), there are many algorithms requiring a much lower computational power, but also having a good security. weaker (algorithms hereafter called weak algorithms). One of the fastest is the use of an XOR mask. A sequence of bits, called the mask, is generated with the same length as the information to be encrypted or decrypted. For each bit of information, the corresponding bit of the mask is then considered, and depending on whether the mask is at 1 or 0, the information bit is modified or not. This algorithm provides perfect security when using a key of the same length as the information to be encrypted or decrypted, this key then being taken as a mask. In practice, it is generally impracticable. To build the mask, we can for example concatenate successive copies of the encryption key. The algorithm is then vulnerable, for example to statistical attacks, and this vulnerability increases with the number of copies of the initial key that had to be made to generate the mask, so with the ratio between the number of bits of the information to process and number of bits of the key.

One of the ideas on which the present invention is based is to make a strong algorithm, that is to say, but demanding in computing power and algorithm less secure, but much faster. The strong algorithm is a block algorithm (for example the AES) for which the information to be encrypted or decrypted is divided into blocks of fixed length (for example 128 bits in the case of the AES), each block being treated independently of others. In the state of the art, the strong algorithm is executed on each of the blocks. In contrast, in the invention, the blocks themselves are grouped into sectors, a sector comprising several blocks (or several tens or hundreds of blocks depending on the applications). Encryption and / or decryption execute in two stages. For each sector, it is initially calculated, using a strong algorithm, a secondary encryption key dependent including data in this sector and varying from one sector to another. This secondary encryption key is, in a second time, used to encrypt / decrypt all or part of the blocks of the sector using a faster algorithm.

If an attacker could decrypt a sector and / or access the secondary encryption key used when encrypting this sector, it would be of no use to him to decipher the other sectors. The encryption system thus achieved is all the stronger as there are few blocks in a sector. The number of blocks per sector can be adapted to the application, in order to achieve the best compromise between speed of calculation and need for cryptographic security. In the encryption of a video stream, one can in some cases consider that it is not too penalizing for an attacker to occasionally access a fraction of a second of film, and the size of a sector will be then the order of magnitude of what is needed for this fraction of a second. In other applications (especially financial transactions), the need for security is much greater and the size of a sector is limited to a few tens of blocks. to significantly reduce the vulnerability of the algorithm.

The invention ensures, on the one hand, that the encrypted information does not occupy more bits than the information in the clear, and, on the other hand, that the secondary encryption keys can be easily calculated, both from information in the clear only encrypted information, when we know the keys of the strong algorithm, and that these secondary encryption keys are impossible to find otherwise.

In more detail, the invention relates to a method for encrypting and / or decrypting information in the form of a sequence of bits grouped in blocks, these blocks being themselves grouped into sectors. The method encrypts and / or decrypts a sector hereinafter called the sector to be treated and comprises the following steps:

a step implementing a compression routine, which takes as argument the sector to be processed and provides as a result a sequence of bits comprising fewer bits than the sector to be processed, this result being hereinafter called the secondary encryption key,

a processing step of taking into account all or part of the blocks forming the sector to be processed and applying to each of them a fast encryption routine. This performs a calculation taking as argument the block taken into account, hereinafter called block to be processed, and provides as a result a new block hereinafter called result block. The computation performed by the fast encryption routine uses a sequence of bits called a fast key, determined from the secondary encryption key.

The result of the method is a sector hereinafter referred to as the result sector, composed of as many blocks as the sector to be treated, all or part of the blocks of the result sector being determined from the result blocks provided by the routine. fast encryption applied during the processing step.

The method implements one or more primary encryptors, each of them using a sequence of bits called primary key, and performing a calculation taking as argument a block and providing as a result a new block.

The compression routine comprises an intermediate step of determining a block hereinafter called the first intermediate block, and a calculation step of applying at least one primary encryptor to a block determined from this first intermediate block. The result of this calculation is used to determine the secondary encryption key. The method is further such that it is possible to find this secondary encryption key from the result sector. In a particular embodiment of the invention, the first intermediate block is determined from the result of the application of the "exclusive or bitwise" operator, hereinafter referred to as the XOR operator, between all or some of the blocks. constituting the sector to be treated. Advantageously, the determination of this first intermediate block takes into account a sequence of bits called mixing key. In a particular embodiment, the method uses a sequence of bits called the original encryption key and the mixing key can be determined from the original encryption key, and this during a step called first preliminary step.

Advantageously, each of the sectors to be treated composing the information to be encrypted or decrypted is assigned a number called sector number. The calculation step that contributes to determining the secondary encryption key then comprises the following two phases. The first phase, called the disturbance phase, consists in determining a block, hereinafter referred to as a disturbed block, taking into account, on the one hand, the first intermediate block and, on the other hand, a value depending on the sector number. . In a second phase, at least one primary cryptor is then applied to this disturbed block. In a particular embodiment of the invention, the disturbed block determined during the disturbance phase is obtained by applying the XOR operator, between, on the one hand, the first intermediate block and, on the other hand, a value depending on the sector number assigned to the sector to be treated.

Advantageously, the calculation step further comprises an additional phase of determining a block hereinafter called the second intermediate block, taking into account the result of the application of at least one primary encryptor to the secondary encryption key. Advantageously, when each sector to be treated is assigned a sector number, it is also taken into account in the determination of the second intermediate block.

Advantageously, the determination of all or part of the fast keys takes into account the first intermediate block and / or the second intermediate block.

In a particular embodiment of the invention, the method implements a function F for generating a series of numbers. The first number of this sequence is then generated from the secondary encryption key, and each subsequent number of the sequence is calculated by applying the function F to the number immediately preceding it in the series of numbers. All or part of the numbers of this suite are then taken into account to determine all or part of the quick keys used in the fast encryption routine.

Advantageously, the fast keys are such that there is at least one subset of the set of fast keys, this subset can be the whole set, such as if one applied the XOR operator between all the fast keys of this subset, we would find the same result by applying the XOR operator between the first intermediate block and the second intermediate block.

In a particular embodiment of the invention, at least one of the primary encryptors provides result the result that would provide the encryption algorithm AES implemented on the same argument and with a key identical to the primary key used by this primary encryptor.

In a particular embodiment of the invention, the fast encryption routine calculates a result block from the result of the operation of applying the XOR operator between one of the fast keys and the block to be treated as an argument. by this routine.

Advantageously, the method that is the subject of the present invention uses a series of bits called the original encryption key and comprises a second preliminary step of determining, from this original encryption key, all or part of the primary keys used by the primary encryptors. The invention also relates to an information processing system comprising calculation means and information storage means for implementing the previously described method.

In a particular embodiment, this system comprises two parts, respectively called host device and specific cryptographic device. The latter comprises processing means for performing the calculation step. It is also such that the primary keys used by the primary encryptors are never communicated outside this specific cryptographic device. The system includes link means enabling the host device to transmit to the specific cryptographic device information determined from the sector to be processed and link means allowing the specific cryptographic device to transmit the secondary encryption key to the host device. The host device comprises processing means for performing the processing step.

Advantageously, the specific cryptographic device has storage means for storing a series of bits called the original encryption key, and of processing means for calculating all or part of the primary keys used by the primary encryptors, taking into account the original encryption key. It is further such that the original encryption key is never communicated outside the specific cryptographic device.

Advantageously, the specific cryptographic device is removable and can be disconnected from the host device. In a particular embodiment, it is connectable by a self-powered port, including a USB port. In another embodiment, it is connectable to it by a wireless connection.

The invention also relates to the cryptographic device described above.

The invention also relates to any means of storing data in digital form, all or part of the data stored in this storage means having been encrypted using the method object of the present invention. The invention relates in particular to such storage means when all or part of the data is audiovisual data. It also relates in particular to such a storage means when it is intended to be read by optical reading.

The invention also relates to any means for transmitting data in digital form, all or part of the data transmitted in this data transmission means having been encrypted using the method of the present invention, especially when all or part of the data. transmitted are data of an audiovisual nature.

Several exemplary embodiments of the present invention are described below, in particular with reference to FIGS. 1 to 6. They differ in particular in the mode of calculation of the secondary encryption key from the sector to be treated and / or the result sector. All these examples are given here by way of illustration and not limitation.

FIG. 1 represents an embodiment of the present invention, in which the secondary encryption key KS can be recalculated from one of the blocks in the result area. In this embodiment, the invention implements two primary crypters CP1 and CP2, and preliminary steps make it possible to build, on the basis of an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, two primary keys KP1 and KP2 respectively used by the two primary CP1 and CP2 crypters.

The sector to be processed S (in this case, the information in the clear, which one proposes to encrypt) consists of n blocks M ₀ , Mi, ..., M _n _i and is assigned a number called NS area number. The final result of the calculation is a sector T, called sector result, composed of n blocks Co, Ci, ..., C _n - _I containing the encrypted information.

The details of the operations to be performed is then the following. An intermediate step E1 determines, from, on the one hand, n blocks M ₀ , Mi, ..., M _n _i composing the sector S to be processed, and, on the other hand, the sector number NS and the KM mixing key, a first intermediate block X.

In a particular implementation of the present embodiment of the invention, this intermediate step EI calculates a block from the sector number NS and the mixing key KM and then performs an operation XOR (or exclusive bitwise) between this block and the n blocks M ₀ , Mi, ..., M _n _i composing the sector to be treated. The first intermediate block X is then the result of this XOR operation. It will be said in this particular implementation that the intermediate step EI is of type XOR.

In the present embodiment, a calculation step initially determines, starting from the first intermediate block X, a new block denoted Co, hereinafter referred to as discriminating block. In the embodiment shown in FIG. 1, the discriminant block Co is the first block of the final result, that is to say of the sector T. The determination of the discriminant block Co is done by applying to the intermediate block X the first encryptor CPl primary, using the first key Primary KPl. Once this block Co determined, the calculation step applies to it the second primary cryptor CP2, using the second primary key KP2.

The secondary encryption key KS is then equal to the result of this calculation. It is therefore possible to find it from the result sector T, because the discriminant block which makes it possible to calculate it is one of the blocks of this sector result T.

A processing step then makes it possible to encrypt the n-1 blocks Mi, M ₂ ,..., M _n -1, that is to say all the blocks constituting the sector to be treated S, excluding the first. This encryption is done using a fast cryptographic routine CR. To do this, n-1 sequences of bits, called fast keys, and noted respectively ki, k ₂ , ..., k _n _i, are calculated from the secondary encryption key KS. In the embodiment shown in the figure

1, the calculation of the quick keys is done in two stages. On the one hand we generate a sequence of n numbers K ₀ , K ₁ , K ₂ ..., K _n _i, the first of these numbers being equal to the secondary key KS, each of the following being calculated by applying a function F to number that precedes it in the sequel. The n-1 numbers Ki, K ₂ ..., K _n _i, then generate n-1 fast keys ki, k ₂ , ... k _n _i. Each of the n-1 blocks Mi, M ₂ ,..., M _n -i is then encrypted by the fast encryption routine CR using one of these fast keys, the result block resulting from this encryption giving the corresponding block in the sector result T.

A particular implementation consists in using as function F the function "Identity" providing a result equal to its argument. The fast keys are then all equal to each other and equal to the secondary key KS encryption, which allows faster computing, but at the expense of cryptographic security.

In a particular case of the present embodiment of the invention, the fast cryptographic routine CR is a simple XOR mask and the result block is obtained by applying the XOR operator between the block to be processed and the fast key. In certain variants of the present embodiment of the invention, the discriminant block may be any of the blocks of the result sector T, the position of this block may vary from one sector to another. In one of these variants, the position of the discriminator block in the result sector T is related to the sector number NS. In other variants, the discriminant block is taken into account in the calculation of the final result, that is to say the result sector T, so that it can be easily found from this sector result T, in particular by applying an XOR operator to all or some of the blocks forming the sector result T.

FIG. 2 represents another embodiment of the invention, the purpose of which is to perform the operation opposite to that represented in FIG. 1. In this embodiment, the sector to be treated is a sector to be deciphered T, composed of n blocks Co, Ci, ..., C _n - _I , the objective here being to find as sector result sector S which had been encrypted as shown in Figure 1, the sector number NS is the same. The same preliminary steps as in the example illustrated in FIG. 1 make it possible to build, from an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, KPL primary keys. and KP2.

In the present embodiment illustrated in FIG. 2, the first intermediate block is the block Co, the first block of the sector to be deciphered. In certain variant embodiments, the intermediate block is any one of the blocks of the sector to be deciphered or is determined from all or part of the sector to be decrypted, in particular by applying an XOR operator to all or part of the blocks forming the sector. T.

Once the first intermediate block has been determined, the second primary encryptor CP2 is directly applied to it, using the second primary key KP2, which generates the secondary encryption key KS. The fast keys ki, k ₂ , ... k _n _i are then calculated from the secondary encryption key KS in the same way as in the embodiment shown in FIG. 1, and each of the n-1 blocks to to treat Ci, C ₂ ,..., C _n _-I is then decrypted by routine CR ^'1 , which is a reciprocal of the fast encryption routine CR, and with the aid of the corresponding fast key, the result of this decryption giving the corresponding block in the sector result S. Thus the n-1 blocks Mi, M ₂ ,..., M _n -i of this sector are reconstituted. In the particular case in which the fast cryptographic routine CR is a simple XOR mask, the reciprocal routine CR ^'1 is identical to the fast cryptographic routine CR.

The present embodiment illustrated in FIG. 2 comprises a complementary phase, during which a second intermediate block X is calculated by applying to the block Co the reciprocal algorithm of the first primary encryptor CP1 with the first primary key KP1. The block MQ is finally determined from the blocks Mi, M ₂ ,..., M _n-1 , the sector number NS, the mixing key KM, and the second intermediate block X. This calculation is the operation EI ^"1 , symmetrical of the intermediate step EI put into play during the encryption In the particular case where this intermediate step EI is of type XOR, the block MQ is reconstituted by an operation XOR between the second intermediate block X, the n -1 result blocks Mi, M ₂ , ..., M _n _i already calculated and a block calculated from the sector number NS and the mixing key KM.

Figure 3 shows another embodiment of the invention. The same preliminary steps as in the preceding examples make it possible to build, from an original encryption key KO, on the one hand, a KM mixing key and, on the other hand, the two primary keys KP1 and KP2 respectively used. by the two primary crypters CP1 and CP2.

The sector to be treated S (in this case, the information in the clear, which one proposes to encrypt) consists of n blocks M ₀ , Mi, ..., M _n _i and is assigned a number called NS area number. The final result of the calculation will be a sector T composed of n blocks Co, Ci, ..., C _n - _I containing the encrypted information.

The details of the operations to be performed is then the following. An intermediate step EI determines a first intermediate block X from the n blocks M ₀ , Mi, ..., M _n _i composing the sector S to be processed and the mixing key KM.

The secondary encryption key KS is obtained in two phases. During a first phase, called disturbance phase, an XOR operator is applied between the first intermediate block X and a value dependent on the sector number NS, providing as a result a block hereinafter called BP disturbed block. The second phase calculates the secondary encryption key KS by applying the first primary encryptor CP1 to the disturbed block BP. During a complementary phase, the second primary encryptor CP2 is then applied to the encrypted secondary key KS thus calculated, and an operator XOR is then applied between the result of the preceding operation and a value dependent on the sector number NS. which gives as a result a second intermediate block Y.

The secondary encryption key KS is used to generate the fast keys k ± by a method similar to that used in the example shown in FIG. 1. In order not to burden FIG. 3, the details are not shown. These fast keys ki will be used by a fast cryptographic routine CR which encrypts all the blocks of the sector to be treated S to supply the corresponding blocks of the sector result T.

A particular variant of implementation of the embodiment of the invention illustrated in FIG. 3 makes use of the properties of the XOR operator. In this particular variant, the fast CR encryption routine simply consists in the application of an XOR operator between the block to be processed Mi and the corresponding fast key ki. The two intermediate blocks X and Y are taken into account in the generation of fast keys ki. More specifically, these are built of such that, by applying the XOR operator between all the fast keys k ±, one would obtain the same result as by applying the XOR operator between the two intermediate blocks X and Y. A particular mode of construction of fast keys ki verifying these properties are given here as an illustrative and nonlimiting example of the possibilities of carrying out this particular variant. This particular mode of construction is realized in three stages. A first step consists in calculating intermediate fast keys, for example in a manner similar to that of the example illustrated in FIG. 1. A second step consists in applying the XOR operator between, on the one hand, all the keys intermediates and the intermediate blocks X and Y. A third step is to build one of the fast keys by applying the XOR operator between the corresponding intermediate fast key and the result of step 2, the other quick keys being equal to the corresponding intermediate keys.

In a particular embodiment of this particular mode of construction, that of the intermediate fast keys to which the XOR operator is thus applied is variable from one sector to another and is chosen taking into account the sector number NS of the sector to be treated.

In a simple version of this particular variant, the KM mixing key is not taken into account and the first intermediate block X is obtained by applying the XOR operator between the n blocks M ₀ , Mi, ..., M _n _i composing the sector to be treated S.

It can then be shown that by applying the XOR operator between the n blocks Co, Ci, ..., C _n - _I component result T sector, there is the second intermediate block Y. The calculation thereof from the sector result T is possible and can be done similarly to the calculation of the first intermediate block X from the sector to be treated S. In a more sophisticated version of this particular variant, the block X is calculated by first permuting the bits of all or part of the n blocks composing the sector to be treated S, before applying to them the operator XOR, the permutation to be performed. being determined from the KM mixing key. In a particular implementation of this more sophisticated version, the permutation to be performed is variable from one block to another.

This prior permutation is particularly interesting in the case of ASCII files, for which some bytes are more frequent than others, because it will have the consequence that the bytes of the first intermediate block are statistically well distributed. At the end of the process, the inverse permutation is applied to the blocks resulting from the application of the XOR operator between the fast keys ki and the blocks of the sector to be treated S.

In this more sophisticated version, the calculation of the second intermediate block Y from the result sector T is possible and can be done similarly to the calculation of the first intermediate block X from the sector to be processed S.

FIG. 4 represents another embodiment of the invention, the purpose of which is to carry out the reverse operation of that carried out in the particular variant of the embodiment illustrated in FIG. 3. The sector to be treated is here a sector to decipher T , composed of n blocks Co, Ci, ..., C _n - _I , the objective being to find as final result the sector S which had been encrypted by this particular variant, the sector number being the same.

The details of the operations to be performed is then the following. An intermediate step EI determines a block Y which acts here as the first intermediate block, this block Y being determined from the n blocks composing the sector T to be processed and the mixing key KM.

The secondary encryption key KS is obtained in two phases, similar to the embodiment illustrated in FIG. FIG. 3. During a first disturbance phase, an XOR operator is applied between the first intermediate block Y and a value dependent on the sector number NS, providing as a result a block hereinafter called the disturbed block BP. The second phase calculates the secondary encryption key KS by applying to the disturbed block BP the second primary encryptor in decryption mode (denoted here CP2 ^"1 ) .The first primary encryptor is then applied in decryption mode (noted here CPl ^'1 ) to the secondary encryption key KS, then an XOR operator is applied between the result of the previous operation and a value dependent on the sector number NS, which results in a block X which plays the role of second intermediate block.

The secondary encryption key KS is then the same as that which was used during the encryption. Quick keys are built identically and are identical to those used for encryption. The fast CR encryption routine here consisting of a simple XOR operator application with a fast key, this fast CR encryption routine is its own reciprocal. The decryption operation here is therefore similar to the encryption operation, provided that the two primary encryptors are replaced by their reciprocal function, that is to say by making them operate in decryption mode, and to swap them. that is, to apply the second before the first. In all the embodiments described above, the mixing key KM is determined from the original encryption key KO. It is also possible to make variants in which the KM mixing key is public and fixed once and for all. As described with respect to the more sophisticated version of the particular variant of the embodiment illustrated in FIG. 3, its interest is mainly of a statistical nature, to ensure a statistical equidistribution of the values taken by the intermediate blocks.

FIG. 5 illustrates an exemplary implementation in which the invention is implemented on a system comprising a host device and a specific cryptographic device DCS. The latter supports the preliminary step of determining the two primary keys KP1 and KP2, from the original key KB, and the calculation step in which the primary CP1 and CP2 encryptors are implemented using these primary keys KP1. and KP2. The host device is responsible for the rest of the processing. The cryptographic secrets that are the first primary key KPL, the second primary key KP2 and the original encryption key KO are never communicated outside the specific cryptographic device DCS.

In this particular example of implementation, the host device determines a block called BP disturbed block from the first intermediate block X and a value dependent on a sector number NS assigned to the sector to be processed. The disturbed block BP is transmitted to the specific cryptographic device DCS. The latter applies the first primary encryptor CP1 to generate the secondary key KS which is communicated to the host device. It then applies the second primary encryptor CP2 to the secondary key KS to generate the second intermediate block Y which is also communicated to the host device. The latter, using the information communicated to him, then determines the fast keys and implements the fast CR encryption routine.

The information flows to or from the specific cryptographic device DCS are illustrated in the figure by triple arrows.

The specific cryptographic device DCS is removable and can be detached from the host device. In its absence, it is impossible to perform encryption and / or decryption operations, which ensures total confidentiality of the encrypted information using the method object of the present invention. In a particular implementation of this exemplary implementation, the specific cryptographic device DCS is presented as a "USB stick" connectable on a USB port, as taught in the patent. French 03/50626 filed September 30, 2003 issued January 20, 2006 and International Application PCT / FR2004 / 050299 June 30, 2004.

In the present example of implementation, the invention is implemented either without the use of a mixing key, or by using a KM mixing key that does not depend on the original encryption key KO, which is therefore identical for all the blocks. In the second case, the KM mix key is used during the intermediate step EI supported by the host device. In all the embodiments described above, the primary crypters CP1 and CP2 implement a block cipher algorithm. In particular cases of implementation of these embodiments, the algorithm used is the AES algorithm, and is therefore the same for the two primary encryptors. It is then possible to use identical primary keys KP2 and KP2, but this may weaken the cryptographic security of the invention.

FIG. 6 is a simplified diagram of the embodiment described in FIG.

Claims

1. A method for encrypting and / or decrypting information in the form of a series of bits grouped into blocks of bits, hereinafter called blocks, said blocks themselves being grouped into sectors; said method encrypting or decrypting a sector hereinafter called the sector to be treated (S; T) and comprising the following steps:

a step implementing a compression routine, said compression routine taking as argument said sector to be processed (S; T), and providing as a result a series of bits comprising fewer bits than said sector to be processed (S; T); ), the result of said compression routine thus implemented being hereinafter called secondary encryption key (KS); a processing step of taking into account all or part of the blocks (Mi; Ci) constituting said sector to be treated (S; T) and applying to each of the blocks (Mi; Ci) thus taken into account a fast routine of encryption (CR), said fast encryption routine (CR) performing a calculation taking as argument the block (Mi; Ci) thus taken into account, hereinafter referred to as a block to be processed, and providing as a result a new block hereinafter called result block (Ci; M ₁ ); the calculation performed by said fast encryption routine (CR) using a sequence of bits called a fast key (ki), the determination of said fast keys (ki) taking into account said secondary encryption key (KS); the result of said method being a sector hereinafter called result sector (T; S), and composed of as many blocks as said sector to be treated (S; T), all or part of the blocks of said result sector (T; S) being determined from said result blocks provided by said fast encryption routine (CR) applied during said processing step; said method implementing at least one primary encryptor (CP1; CP2), using a sequence of bits called a key primary (KP1; KP2), and performing a calculation taking as argument a block and providing as a result a new block; said compression routine comprising

an intermediate step (EI) of determining a block hereinafter called the first intermediate block

(X; Y),

a calculation step of applying at least one primary encryptor (CP1; CP2) to a block determined from said first intermediate block (X; Y); said secondary encryption key (KS) resulting from said compression routine then being determined by taking into account the result of said calculating step; said method being further such that it is possible to retrieve said secondary encryption key (KS) from said result sector (T; S).

2. Method according to claim 1, said intermediate step of said compression routine being such that the determination of said first intermediate block (X; Y) takes into account the result of the application of the operator "or bitwise exclusive" between all or part of the blocks constituting said sector to be treated (S; T).

3. Method according to claim 1 or 2, said intermediate step of said compression routine being such that the determination of said first intermediate block (X; Y) takes into account a sequence of bits called mixing key (KM).

4. The method of claim 3, said method using a sequence of bits called original encryption key (KO); said method further comprising a first prior step of determining said mixing key (KM) by taking into account said original encryption key (KO).

5. Method according to any one of claims 1 to 4, each of said sectors to be treated (S; T) comprising said information to be encrypted or decrypted being assigned a number called sector number (NS); said computation step comprising the following two phases: a first phase called a disturbance phase, said perturbation phase consisting of determining a block hereinafter called a disturbed block (BP), the determination of said disturbed block (BP) taking into account, on the one hand, said first intermediate block (X; Y) and, on the other hand, a value dependent on said sector number (NS) assigned to said sector to be processed

(S; T) - a second phase of applying at least one primary cryptor (CP1; CP2) to said disturbed block determined during said disturbance phase.

6. The method of claim 5, said disturbance phase being such that said disturbed block determined by said disturbance phase is equal to the block obtained by applying the operator "or bitwise exclusive" between, on the one hand, said first intermediate block (X; Y) and, secondly, a value dependent on said sector number (NS) assigned to said sector to be treated (S; T).

7. Method according to any one of claims 1 to 6, said calculating step further comprising a complementary phase of determining a block hereinafter called second intermediate block (Y; X), determining said second intermediate block (Y X) taking into account the result of the application of at least one primary encryptor (CP2; CPl) to said secondary encryption key (KS).

8. The method of claim 7, each of said sectors to be treated (S; T) comprising said information to be encrypted or decrypted being assigned a number called sector number (NS); said complementary phase of said calculating step being such that the determination of said second intermediate block (Y; X) further takes into account a value dependent on said sector number (NS) assigned to said sector to be processed (S; T).

9. Method according to any one of claims 1 to 8, the determination of all or part of said fast keys (ki) further taking into account said first intermediate block

(X, Y) •

10. The method of claim 7 or 8, the determination of all or part of said fast keys (ki) further taking into account said second intermediate block (Y;

X).

11. Method according to any one of claims 1 to 10, said method implementing a function F for generating a series of numbers K ₀ , K i, K ₂ ,... K i, ... the first number of said a sequence of numbers being generated from said secondary encryption key (KS), each of the following numbers of said series of numbers being calculated by applying said function F to the number immediately preceding it in said series of numbers, the determination of all or part of said fast keys (ki) used in said fast encryption routine (CR) for providing said result blocks (Ci; M ₁ ) then taking into account all or part of the numbers (K ₁ ) of said series of numbers.

12. Method according to any one of claims 7, 8 or 10, the set of said fast keys (ki), used during the encryption or decryption of said sector to be treated (S; T), being such that it exists at minus a subset, or the entire set, such as applying the "or exclusive bit-to-bit" operator between all the fast keys (ki) contained in this subset, or in the whole set, the result of this calculation would be identical to the result that one would obtain by applying the operator "or exclusive bit-to-bit" between said first intermediate block (X; Y) and said second intermediate block (Y; X).

The method according to any one of claims 1 to 12, at least one of said primary encryptors (CP1; CP2) providing as a result the result that would give the AES encryption algorithm if said algorithm of AES encryption was implemented on an argument identical to the argument taken by said primary encryptor and with a key identical to said primary key (KP1; KP2) used by said primary encryptor (CP1; CP2).

14. Method according to any one of claims 1 to 15, the computation performed by said fast encryption routine (CR), when it takes as argument said block to be processed (Mi; Ci) and uses said fast key (ki). , being such that said result block (Ci; M ₁ ) is determined from the result of the operation of applying the operator "or exclusive bitwise" between said fast key (ki) and said block to be treated (M ₁ ; C ₁ ).

A method according to any one of claims 1 to 14, said method using a sequence of bits called the original encryption key (KO) and comprising a second preliminary step of determining all or part of said primary keys (KP1; KP2), used by said primary encryptors

(CPl; CP2), from said original encryption key

(KO);

16. An information processing system comprising calculation means and information storage means for implementing the encryption and / or decryption method according to any one of claims 1 to 15.

17. System according to claim 16, said system comprising two parts; one of the parts of said system being hereinafter called specific cryptographic device (DCS) and comprising processing means for performing said calculation step; another of the parts of said system being hereinafter referred to as the host device; said specific cryptographic device (DCS) being such that said primary keys (KP1; KP2), used by said primary encryptors (CP1; CP2) during said calculation step, are never communicated outside said specific cryptographic device (DCS); said system comprising link means enabling said host device to transmit to said specific cryptographic device (DCS) information determined from said sector to be processed (S; T); said system comprising link means enabling said specific cryptographic device (DCS) to transmit to said host device said secondary encryption key (KS); said host device comprising processing means for performing said processing step.

18. The system of claim 17, said specific cryptographic device (DCS) having storage means for storing a sequence of bits called original encryption key (KO) and comprising processing means for determining all or part of said primary keys. (KP1, KP2), used by said primary (CP1; CP2) encryptors, taking into account said original encryption key (KO); said specific cryptographic device (DCS) being such that said original encryption key (KO) is never communicated outside said specific cryptographic device (DCS).

19. The system of claim 17 or 18, said specific cryptographic device (DCS) being removable and disconnectable from said host device.

20. The system of claim 19, said specific cryptographic device (DCS) being connectable to said host device by a self-powered port, including a USB port.

21. The system of claim 19, said specific cryptographic device (DCS) being connectable to said host device by a wireless connection.

22. Specific cryptographic device (DCS) for a system according to any one of claims 17 to 21.

23. Digital data storage means, all or part of said data stored in said storage means having been encrypted using the method according to any one of claims 1 to 15.

24. Storage means according to claim 23, all or part of said data stored in said storage means being audiovisual data.

25. Storage means according to claim 23 or 24, said storage means being intended to be read by optical reading.

26. Digital data transmission means, all or part of said data transmitted in said data transmission means having been encrypted using the method according to any one of claims 1 to 15.

27. A data transmission means according to claim 26, all or part of said data transmitted in said transmission means being data of an audiovisual nature.