WO2008065308A1

WO2008065308A1 - Data compression function of multiple lengths using single-lengths internal functions

Info

Publication number: WO2008065308A1
Application number: PCT/FR2007/052415
Authority: WO
Inventors: Henri Gilbert; Thomas Peyrin; Matthew Robshaw
Original assignee: France Telecom
Priority date: 2006-12-01
Filing date: 2007-11-28
Publication date: 2008-06-05
Also published as: FR2909498A1

Abstract

The invention relates to a data compression method, wherein extracted blocks Mu (where u= 1,...,m ) of a message M are processed and chaining blocks Hv (where v = 1,...,c, with c > 1 ), to give c new chaining blocks H'v (where v = 1,...,c), all blocks being n bits in length, the said method allowing the verifying of certain cryptographic security criteria, and comprising the following steps: on the input vector E = (M1,...,Mm,H1,...,Hc) is applied a GF(2) affine transformation LE producing t (where t ≥ 1) k-uplets of blocks (where k ≥ 1), each block having a length of n bits; is provided each of said k -uplets of blocks in input to a respective internal function f p (where p = 1,...,t ), which produces a block Sp of n bits in output; and obtaining the said new chaining blocks H '1,...,H' c by applying a GF(2) affine transformation Ls to the F = (M1,...,Mm,H 1,...,Hc,S1,...,St) vector. According to the invention, the said affine transformation LE combines linearly at least one message Mu block with at least one chain block H v to provide the input data of at least one of the said internal functions f p. Applicable to the construction of secure hash functions with output sizes of c. n bits.

Description

Multiple length data compression feature using single-length internal functions

The invention relates to the field of cryptography. More specifically, the invention relates to so-called "hash" functions (also called "condensation").

Hash functions are widely used in the context of information security. The calculation of hash functions inter alia in the generation of public key signatures and certificates, as well as in many cryptographic protocols such as the SSL / TLS (initials of "Secure Socket Layer I Transfer Layer Security") used on the Internet.

A hash function H is a function that takes as input any binary message of any size and produces a fixed size output. To be sure, this function should check the following three properties as best as possible:

• "resistance to preimages": given an output value y of H, it is difficult to find an entry x such that H (x) = y;

• "resistance to second preimages": given a pair of values (χ, y) such that H (x) = y, it is difficult to find a value x ¹ with x '≠ x such that H (x') = y;

• "collision resistance": it is difficult to find two distinct values x and x 'such that H (x) = H (x').

A hash function is said to be safe if the number of operations required to defeat these properties is of the order of, respectively, 2 ", 2", and 2 "^'2 .

It has been known since the work of Merkle-Damgérd that the problem of designing a safe hash function can be reduced to that of designing a safe compression function. A compression function h is a function that takes as input a fixed size value of (r + ri) bits and returns a value of size n bits; a compression function is considered safe if it satisfies three criteria similar to those described above for a safe hash function. The hash function H associated with the compression function h is iteratively calculated as follows. The chopping message M, of arbitrary size, is concatenated with a suffix making its length equal to L-r, with L integer, and the message thus completed is divided into message blocks M ^ω (where i = 1.2 , ..., L) of length r bits (we use for this purpose an unambiguous suffix, called Merkle-Damgârd, which guarantees that if h is safe, then H is too). At each iteration number /, h compresses the message block M ^ω of r bits, and a chaining variable H ⁽⁰ of n bits initialized at a constant H ^m at the beginning of the process.

_H m ₌ h (H ⁽ⁱ - ^χ) , M ⁽ⁱ⁾ ), where / = 1, 2, ..-, L. (L)

The hash H (M) is defined as the value H ^(L) of the chaining variable obtained at the end of the Lth compression (or any truncation of H ^(L) ).

Many hash function constructs have been proposed. Nowadays, the most used are either specific constructs or schemes using block ciphers such as DES (initials of the English words "Data Encryption Standard" meaning "Data Encryption Standard").

Among the hash functions based on a specific construction, the most used currently are probably MD5 and SΗA-1. However, recent advances in cryptanalysis, such as the articles by X. Wang and H. Yu titled "How to Break MD5 and Other Hash Functions" (May 2005) and "Finding Collisions in the FuII SHA-T" (August 2005) , have uncovered some weaknesses allowing to build collisions (in the sense defined above) with a number of operations less than a brute force attack.A second family of hash functions has been standardized by the National Institute of Standards in the United States, but this construction is inefficient, and is also very close to SHA-1, which reduces the confidence that we can grant it given the results of cryptanalysis mentioned above.

Because trust based on hash functions based on specific constructs is currently being questioned, there is a renewed interest in schemas using block ciphers such as DES or AES (initials). English words "Advanced Encryption Standard" meaning "Advanced Encryption Standard"). Several of these schemes, which provide block-length output compression functions and thus block-length output hash functions, perform well, such as the Davies-Meyer construct (see the article by B. Preneel, R. Govaerts and J. Vandewalle entitled "Hash Functions Based on Block Ciphers: a Synthetic Approach", Advances in Cryptology CRYPTO'93, Springer, Lectures Notes in Computer Science, August 1993). However, these diagrams used alone have a major disadvantage: the output size of the usual block algorithms, which determines the output size of such a hash function, is not sufficient; DES operates on 64-bit blocks, and AES operates on 128-bit blocks, whereas a safe hash function requires at least 160 bits or 256 bits of output to avoid search for collision by brute force.

So there is a need to know how to build safe compression functions with an output size of cn bits, where c> \, in using n-bit block cipher primitives. The iteration of such compression functions by means of the Merkle-Damgard construction described above would indeed make it possible to deduce safe hash functions of output size c -n bits.

In fact, compression function constructs having a double output size (ie, c = 2) are known. The best known are MDC2 and MDC4 (see, for example, the book by AJ Menezes, PC van Oorschot, and SA Vanstone entitled "The Handbook of Applied Cryptography", CRC Press, 1996), which uses DES as an internal component. have shown that the security of these two schemas is weaker than expected, for example, when using DES as an internal component of MDC2, attacks providing a collision requiring only 2 ²⁸ calls to DES, instead of ^2M calls as desired, have been found.

Many other works have been done to build compression functions with a 2n bit output size using n-bit block cipher primitives. To date, all schemes using n-bit block ciphers and handling n-bit keys have been broken. It has also been proposed (see S. Hirose's article "Provably Secure Double-BIock-Length Hash Functions in a Black-Box Modef, International Conference on Information Security and Cryptology ICISC'04, Springer, Readings Notes in Computer Science, December 2004) a proven 2n-bit output-length hash function requiring n-bit block ciphering with a key length of 2 "bits, but this represents a limitation in the choice of usable block cipher algorithms, since this excludes algorithms like AES-128, which is the most widely used block cipher algorithm (indeed, AES-128 encrypts 128-bit blocks using a 128 key bits).

Without restricting itself to block cipher primitives, researchers have proposed (see the article by Mr. Nandi, W. Lee, K. Sakurai and S. Lee entitled "Security Analysis of a 2/3-rate Double Length Compression Function". in a Blackbox Modef, Advances in Cryptology, ASIACRYPT'05, Springer, Lectures Notes in Computer Science, January 2005) Two short-length hashing functions based on single-length primitives are proposed using several independent primitives. simple, whose outputs can be linearly combined, but these two hash functions have a lower security than expected for a 2-bit hash function.

The article "Combining Hash Functions and Block Cipher Based Hash Functions" by T. Peyrin, H. Gilbert, F. Muller and M. Robshaw (Advances in Cryptology ASIACRYPT'06, Springer, Lectures Notes in Computer Science, December 2006) studies a family of output length compression functions equal to an integer multiple of the n-bit output length ("single length") of internal primitives consisting of compression functions (which we will simply call "internal functions" below). The constructions considered involve not only these internal functions, but also a linear transformation L ^E of the input data and a linear transformation L ^s of the output data of these internal functions.

This article establishes a set of criteria that a compression function must check to be able to withstand all known attacks; in the context of the present invention, these criteria will be called "PGMR criteria" (initials of the authors of this article). Indeed, the analysis of these constructions makes it possible to establish impossibility results, ie lower bounds on the number t of calls to the internal functions of simple length necessary to construct a multiple length compression function, depending previously defined parameters: the number c of blocks of n bits at the output of the multi-length compression function, the number k of blocks of n bits taken at the input of each internal function of simple length, the number m of blocks of n message bits taken as input to the multiphase compression function. These impossibility results can be obtained thanks to two generic attacks. The first one expresses the fact that any linear combination of the output blocks must depend on all inputs. If this condition is not fulfilled, it is possible to attack some output blocks independently, and security is irretrievably affected. The second generic attack expresses the fact that it must be impossible to generate several pre-images on certain output blocks in a number of operations less than what would be expected in the case of an ideal compression function. For a complete formulation of these "PGMR criteria", refer to this article.

In particular, this article shows that it is possible in principle to construct, from internal functions of n-bit output size, compression functions satisfying the PGMR criteria and having a c-n bit output size, with c> \. However, this article proposes only a very limited number of ways of constructing, in practice, a compression function h having the aforementioned properties.

The present invention therefore relates to a data compression method, in which blocks M _n (where u = 1, ..., m) are extracted from a message M and chaining blocks H _v (where v = 1 , ..., c, with c> \), to give c new chaining blocks H \ (where v = l, ..., c), all blocks being of length n bits. This method verifies the "PGMR criteria" of cryptographic security, and includes the following steps:

- is applied to the input vector E = (M _ι , ..., M _m , H _v ..., H _c ) a transformation GF (2) -affine L ^E producing t (where t ≥ 1) k - tuples of blocks (where k ≥ l), each block being of length n bits, each of said input block tuples / t-tuples is provided with a respective internal function f _p (where p = \, ..., t), which produces a block S _p of n bits at the output, and

said new H \, ..., H ' _C chain blocks are obtained by applying a GF (2) -affine I? to the vector

F = (M _v ..., M _m , H _ι,,, H _c , S _ι , ..., S _t ).

Said affine transformation L ^E is remarkable in that it linearly combines at least one message block M ₁₁ with at least one chaining block H _v to supply the input data of at least one of said internal functions f _p . In other words, the "or-exclusive of at least one bit of at least one message block M ₁₁ and at least one bit of at least one chaining block H _v is in the affine expression at least one of the k -n input bits of at least one of the internal functions f _p .

Of course, said message M processed according to the invention may in fact be the result of the concatenation of an original hash message, with an unambiguous suffix, as explained above.

Thus, according to the invention, the affine transformation L ^E according to the invention mixes (using an "exclusive-or-exclusive") at least some bits of the chaining blocks with certain bits of the message blocks in order to produce some of the This approach, similar to handling message blocks and chaining blocks in a similar way, is contrary to that suggested by the structure of the compression functions used to build some known hash functions, such as MD5 or SHA-1, where message blocks and chaining blocks are treated in a very different way from each other.

According to particular features, the number c of chaining blocks is equal to 2; in other words, the compression function has, in this embodiment, a double output size (c = 2) of that of the internal functions used. This embodiment is very useful in practice; it allows for example to have a 256-bit output while using AES-128 as a primitive (for internal functions).

In the case where, as previously, the number c of output blocks is equal to 2, and where, moreover, we have internal functions taking as input k = 2 blocks of n bits (obtained for example by calling to a block cipher function with a length key a block), it can be established, on the basis of the PGMR criteria, that there is no safe parallel parallel output length construction such that the number m of block message processed by the compression function be equal to one block or two blocks, and using strictly less than t = 5 calls to single-size internal functions. That is why, according to even more particular characteristics, we take c = 2, k = 2, m = 2, and t = 5.

Thanks to these arrangements, when building, as explained above, a hash function H by successive iterations of the compression function h is used at each iteration a ^ω message block M consisting of two blocks of length n bits M, ^(o and Mf, while using an internal function f _p as seldom (ie, 5 times) as theoretically possible, thus the message to be chopped M is processed quickly, with guaranteed security for the hash function H. The n-bit blocks M, ^ω and M ₂ ⁽ⁱ⁾ will be denoted M ₁ and M ₂ in the following, in contexts where it is not necessary to specify the number d Iteration i considered.

It can be shown that, still in the embodiment where c = 2, k = 2, m = 2, and t = 5, the PGMR criteria are satisfied if the linear transformations If and If are chosen in the following way:

L ^ε (u) [E] ≈ M _λ Φ H ₂

EV ₂ ) [E] = H ₂

ZV) [E] = M ₂ Θ H ₂

lfw) [E] ≈ M _λ ®H ₂

EV ₂ ) [E] = H ₂

EV ₂ ) [E] = H ₁

L ³ _H ) [F] = S ^ S ₄ Φ S ₅ where lf _{pq) (where p = 1, ... j and q = 1, ..., k) denotes the GF (2) -affine function of (m + c) - n bits to n bits whose output constitutes the g-th block supplied as input to the internal function f _p , and L ^s _ivj (where v = 1, ..., c) denotes the function GF (2) -affine of (t + m + c) -n bits to n bits whose output constitutes the block

As explained above, knowing how to build safe hash functions of multiple size is of particular interest when one wants to build internal functions using schemas using block cipher algorithms such as AΕS or OF. This is why, according to particular characteristics, the internal functions / "..., /" Are constructed from an n-bit block cipher algorithm and using n-bit keys.

Moreover, several types of safe constructions are known for producing an internal function of output size of a block by means of a block algorithm. To do this, one can for example use the construction of Davies-Meyer already mentioned.

The invention also relates to a hashing method implementing successive iterations of any of the data compression methods succinctly described above. As explained above, one can for example use the construction of Merkle-Damgârd.

Correlatively, the invention relates to a data compression device, in which are processed blocks M ₁₁ (where u = 1, ..., m) extracted from a message M and chaining blocks H _v (where v = l, ..., c, with c> \), to give c new chaining blocks H \ (where v = l, ..., c), all the blocks being of length n bits, said processing satisfying the " PGMR Cryptographic Security Criteria, said device comprising: means for applying to the input vector E = (M _i , ..., M _m , H _i , ..., H _c ) a GF (2) transformation - affine L ^E producing t (where t ≥ 1) k -uplets of blocks (where k ≥ 1), each block being of length n bits,

means for supplying each of said k -uplets of input blocks to a respective internal function f _p (where p = \, ..., t), which produces a block S _p of n bits at the output, and

- means for obtaining said new chaining blocks H \, ..., H \ by applying a transformation GF (2) -affine L ^s to the vector

F = (M _ι , ..., M _m , H _ι ,., H _c , S _ι , ..., S _t ) -

Said affine transformation Zf is remarkable in that it linearly combines at least one message block M _n with at least one H ₉ chaining block to provide the input data of at least one of said internal functions f _p .

According to particular features, the number c of chaining blocks is equal to 2.

According to even more particular characteristics, k = 2, m = 2, and t = 5.

The invention also relates to a hash device comprising any of the data compression devices succinctly set forth above. According to particular features, any of the data compression devices or the hashing device succinctly set forth above may be embodied in the context of an electronic circuit. This electronic circuit may, for example, be constituted by a wired logic chip.

The advantages offered by these devices are essentially the same as those offered by the correlative methods succinctly set forth above.

The invention also relates to a computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor. This computer program is notable in that it includes instructions for performing the steps of any of the data compression methods or hashing method succinctly set forth above, when executed on a computer. computer.

The advantages offered by these devices and this computer program are essentially the same as those offered by said methods.

Other aspects and advantages of the invention will appear on reading the detailed description below of particular embodiments, given by way of non-limiting examples. The description refers to the accompanying drawings, in which:

FIG. 1 is a block diagram illustrating the general principle of a compression function according to the invention, and

FIG. 2 is a block diagram illustrating an embodiment of a compression function according to the invention.

The invention constructs known attack-resistant compression functions, which can in particular be used to construct safe hash functions, for example by means of the Merkle-Damgard construction described above. To this end, the invention proposes compression functions h, of which FIG. 1 illustrates the general principle.

According to this general principle, the compression function h takes as input m blocks M ₁₁ (where u = \ ..., m) of message of n bits each, and c blocks

(where o 1) chaining variables H ₁ ,..., H _c of n bits each, and returns at the output c blocks H ¹ ,,..., H ' _C of n bits each.

We denote E = (M _λ , .., ₁ M _m , H _i , ..., H _c ) the input vector. We apply to the vector E a GF (2) -linear transformation (where GF (2) denotes the finite field with two elements), or more generally GF (2) -affine (ie "linear + constant additive") called L ^E. The output of the transformation L ^E consists of (k • t) blocks (where k ≥ 1 and t ≥ 1) of length n (note: (m + c) is not necessarily equal to (£ • /)) . We then use t internal functions /"...,/, of output size equal to n bits, each taking k blocks of n bits in input and returning a block S _p (where p = \, ..., t) of n bits in exit. We will note in the following F the vector

(M _ι , ..., M _m , H _ι , -, H _c , S _v ..., S _l ). Finally, a GF (2) - linear or more generally GF (2) -affinity L ^s transformation is applied to the vector F to obtain the vector {H \, ..., H ' _C ).

More precisely, the input transformation L ^E makes it possible to express each of the n bits of each of the k input blocks of each of the internal functions f _p as the sum modulo 2 of a fixed linear combination of

(m + c) -n bits of the input E and a binary constant. The g-th input block of the p-th internal function is thus defined using a GF (2) -affine function of (m + c) - n bits to n bits L ^E _pq) (where p = \, ..., t and q = \, ..., k) applied to the input E. With regard to the output, the compression function h has a GF (2) -affinity I? allowing to express each of the n bits of each of the c output words H \ (where v = 1, ..., c) as the sum modulo 2 of a fixed linear combination of the bits of F and a binary constant . Each output block H 1 of the compression function h is thus defined using the function GF (2) -affine of (t + m + c) -n bits to n bits Lf _v) applied to the vector F. This procedure can be described using the following equations:

H \ = L \ _v) [F} = L ^s _iv) [M _x, ..., M _m, H _x, ..., H _c, _λ S, ..., S _t l where v = l , ..., c (3)

According to the invention, said affine transformation L ^E linearly combines at least one message block M ₁₁ with at least one chaining block H _v to supply the input data of at least one of said internal functions f _p .

We will now describe a particular construction, illustrated in FIG. 2, having the above characteristics and producing a compression function h of double output size (c = 2), taking as input m = 2 message blocks denoted M ₁ and M _x and 2 chaining blocks denoted H ₁ and H ₂ . The compression function then returns 2 blocks of n bits (H \, H \) = h {M _γ , M ₂ , H _j , H ₂ ). Thus, in this embodiment, E = (M _ι, M _2, M ,, M ₂₎ and F = (M _ι, M _2, H _ι, H ₂ N- _2, S _3, S _4, S ₅ ).

To complete the description of this embodiment, it is then sufficient to specify the affine transformations L ^E and L ^s . They are given by the following equations, where the bitwise exclusive-or-bitwise operation (also called "XOR") between two blocks of n bits is represented by the symbol Θ:

EV ₂ ) [E] = H ₂

EV ₂ ) [E] = H ₁ e H ₂

EVo [E] = M ^ H ₂

IV ₂ ) [E] = H ₂

EV [E] = S ₁ θ S ₂ θ S ₃

It can be shown that this particular choice of the cut (Lr, Lf) allows the resulting compression function h to resist all types of attacks known to date. Specifically, there is no known attack to date against this compression function that would be more efficient in terms of computation time, than generic attacks against any function of An bits to 2n bits.

This construction satisfies the terminal t = 5, mentioned above, in the case where m = 2; this value of m is very interesting in practice, compared with the case m = 1, because it corresponds to a gain of a factor close to 2 in terms of speed of execution during the implementation of the hash function H corresponding.

On the other hand, if one examines (again for the parameters c = 2, k = 2, m = 2, t = 5) the most natural class of affine transformations Lf, namely that of the affine transformations for which each of the (k -t) input blocks of internal functions Z ₁ Q f ₁ result from the "exclusive-or" bit-by-bit of a subset of (m + c) input blocks M ₁ , M ₂ , H _x and H ₂ , it can be verified that one can not obtain a compression function h resistant to the types of attacks known to date, unless, indeed, to perform a mixture between the blocks M ₁ and M ₂ of one hand, and H, and H ₂ on the other hand.

As explained above, it is possible to construct a hash function H of output size two blocks and resistant to the types of attack known to date, from the compression functions h according to the invention by means of the Merkfe- Damgård. Specifically, the message to be chopped is divided into 2-bit message blocks, if necessary by adding a suffix to obtain the number of bits to be chopped to be a multiple of 2n (this suffix can specify the size of the original message so to avoid any ambiguity about the interpretation of the message thus extended). We then use the compression function h which compresses, at each iteration i, 2 blocks of messages M ₁ and M ₂ of n bits each and 2 chaining blocks H ₁ and H ₂ of n bits each, to provide 2 chaining blocks H 1 and H 1 of n bits each; in other words, with reference to equation (1) above:

M ⁽ⁱ⁾ = (M ₁₅ M ₂ ), H ^(M) = (H ₁₅ H ₂ ), and H ^(I) = (H 1, H ' ₂ ). (E)

Many other embodiments of the present invention may be contemplated.

Indeed, the compression function described above is a member of an entire family of compression functions in that, on the one hand, there are other compression functions described using systems of equations. having an analogous structure, but whose detail of expression differs, and where, on the other hand, any bijective affine transformation of the inputs and / or outputs of a compression function produces an equivalent compression function from the point of view resistance to attack, and relatively close to the point of view of employment efficiency. In accordance with the present invention, all valid affine transformations for which each output block of L ^E is defined as the "exclusive-or" of a subset of the input blocks necessarily include a mixture of message blocks and messages. chaining blocks.

Note also that, in the embodiment presented above, the result of the linear transformation I? depends only on the blocks S _p (where p = \, ..., t); however, the invention does not exclude generally that the result of the linear transformation L ^s depends on the blocks M _u or H _v (as expressed in equation (3) above).

To construct safe compression functions using a plurality of internal functions f _p , it is preferable that the different internal functions are rather different from each other. This can be achieved by various methods. For example, it is possible to use different simple variants of the same block cipher algorithm (use of AES variants preceding or following the calculation of one of the AES turns by the addition of internal constants specific to each variant).

As indicated above, the present invention also relates to a computer system implementing the data compression method described above. This computer system conventionally comprises a central processing unit controlling signals by a memory, as well as an input unit and an output unit.

In addition, this computer system can be used to execute a computer program comprising instructions for implementing the data compression method according to the invention.

Indeed, the invention also relates to a downloadable computer program from a communication network comprising instructions for performing the steps of a data compression method according to the invention when executed on a computer. This computer program may be stored on a computer readable medium and may be executable by a microprocessor.

This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape.

The invention also relates to a computer-readable information medium, comprising instructions of a computer program as mentioned above.

The information carrier may be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk ("floppy dise"). ) or a hard disk.

On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet type network.

Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

Claims

A method of data compression, in which blocks M ₁₁ (where u = 1, ..., m) are extracted from a message M and chaining blocks H _v (where v - 1, ... , c, with ol), to give c new chaining blocks H \ (where v = 1, ..., c), all the blocks being of length n bits, said method verifying the "criteria PGMR" of cryptographic security, and comprising the following steps:

the input vector E = (M _] , ..., M _m , H ₁ ,..., H _c ) is subjected to a GF (2) -affine transformation If t (where t ≥ \) £ - tuples of blocks (where k ≥ 1), each block being of length n bits,

each of said--uplets of input blocks is provided with a respective internal function f _p (where p = 1,..., t), which produces a block S _p of n bits at the output, and

- is obtained in said new block chaining H \, ..., H _'C by applying a transformation GF (2) -affine L ^s to the vector

F = (M _ι , ..., M _m , H _ι , ..., H _c , S _ι , ..., S _t ), characterized in that said affine transformation If linearly combines at least one message block M ₁₁ with at least one H _v chaining block to provide input data of at least one of said internal functions f _p.

Data compression method according to claim 1, characterized in that the number c of chaining blocks is 2.

Data compression method according to claim 2, characterized in that k = 2, m = 2, and t = 5.

4. Data compression method according to claim 3, characterized in that the linear transformations L ^E and If are defined as follows:

L ^E M) [E] = M ₂

1 ^, V ₂ ) [E] = H ₂

EVυ [E] = M ₁ e H ₂

EV ₂ ) [E] = H ₂

If ₁₅ I) [E] = M ₁ ⁽ BM ₂

I ⁵ _O ) [F] = S ₁ θ S ₂ Φ S ₃

S ₅ where L ^k _(pq) (where p = \, ..., t and ^ = 1, ..., Jk) denotes the GF (2) -affine function of (m + c) - n bits to n bits whose output is the g-th block input to the internal function f _p , and L ^s _(v) (where v = 1, ..., c) denotes the GF (2) -affine function of (t + m + c) -n bits to n bits whose output is the block

Data compression method according to one of claims 1 to 4, characterized in that the internal functions /,,,,,,,,,,, are constructed from an n-bit block cipher algorithm and using n-bit keys.

6. A hashing method implementing successive iterations of a data compression method according to any one of claims 1 to 5.

7. Data compression device, in which are processed blocks M _n (where u = 1, ..., m) extracted from a message M and chaining blocks H ₁ , (where v = 1, .. .c, with ol), to give c new chaining blocks H \ (where v = l, ..., c), all the blocks being of length n bits, said processing verifying the cryptographic security "PGMR criteria" , said device comprising: means for applying to the input vector E = (M _ι , ..., M _m , H _i , ..., H _c ) a GF (2) -affine transformation producing t (where t ≥ 1) k -uplets of blocks (where k ≥ \), each block being of length n bits,

means for supplying each of said input block -uplets to a respective internal function f _p (where p - \,.,., t), which produces a block S _p of n output bits, and

- means for obtaining said new block chaining H \, ..., H _'C by applying a transformation GF (2) -affine L ^s to the vector

F = (M _i , ..., M _m , H _ι , ..., H _c , S _ι , ..., S _t ), characterized in that said affine transformation L ^E linearly combines at least one block of M ₁₁ message with at least one H _v chaining block to provide the input data of at least one of said internal functions / 'P.

8. Data compression device according to claim 7, characterized in that the number c of chaining blocks is equal to 2.

Data compression device according to claim 8, characterized in that k = 2, m = 2, and t = 5.

A hashing device comprising a data compression device according to any one of claims 7 to 9.

11. Electronic circuit, characterized in that it comprises a data compression device according to any one of claims 7 to 9, or a hash device according to claim 10.

12. Electronic circuit according to claim 11, characterized in that it consists of a wired logic chip.

13. Computer program downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, characterized in that it comprises instructions for the execution of the steps of the compression method of data according to any one of claims 1 to 5 or the hash method according to claim 6 when executed on a computer.