Method for plaintext encryption

Abstract

The invention relates to a method of encrypting (ENCRZF ENCR1, ENCR2) a plaintext (PT), which is part of a plaintext message Mp. The concept of the method is that a reversible decomposition function (ZF) is used, which assigns each plaintext (PT) to be encrypted into two plaintext portions (PT1, PT2). The ZF (PT) is equal to (PT1, PT2). The plaintext portions (PT1, PT2) are then encrypted, not in one step, but in two separate steps, for example with at least one encryption function (ENCR1, ENCR2) in sequence. As the decomposition function (ZF) is reversible, PT = ZF-1 (ZF (PT)) is applied for each plaintext to be encrypted, where ZF-1 is an inverse function of the decomposition function. Therefore, the original plaintext (PT) can always be derived from the plaintext parts (PT1, PT2) in a unique manner by means of the inverse function (ZF-1). This is now utilized in order to decrypt, by means of a suitable decryption (DECRZF DECR1, DECR2), a ciphertext message (MC), which is generated by encryption (ENCRZF ENCR1, ENCR2) and contains a ciphertext part (CT1, CT2). For this purpose, the ciphertext portions (CT1, CT2) are decrypted by means of at least one decryption function (DECR1, DECR2) in sequence in order to then obtain the plaintext (PT) therefrom. As a result, the traditional initial vector for encryption and decryption is then replaced by the selected or all bits of the second plaintext portion (PT2), or a sequence of bits derived therefrom. In this way, the message (MC) to be transmitted can be shortened without losing security.

Description

Technical Field

[0001] The present invention relates to a method for encrypting plaintext to be encrypted included in a plaintext message, which is defined in detail according to the preamble of claim 1. Background Art

[0002] The cryptographic function used for encryption is called an encryption algorithm. As used herein, the encryption algorithm consists of an encryption function and a decryption function. The encryption function transforms plaintext into ciphertext, and the corresponding decryption function transforms ciphertext into plaintext. Here, the two functions are naturally injective. The encryption function often uses an encryption key. If the encryption function ENCR uses the key K and needs to be explicitly represented, it is denoted herein by ENCR K or ENCR_K. Similarly, for the decryption function DECR, DECR K or DECR_K denotes that the decryption function decrypts using the key K.

[0003] The high-frequency transmission and reception of short messages are very important for certain applications in the vehicle ecosystem. For example, examples in this regard can be found in DE10 2021 001 095 A1. As shown in this disclosure, it is generally necessary to provide cryptographic integrity protection and / or cryptographic replay protection for these messages without excessively increasing the message length. As described in this published disclosure, for efficiency reasons, only symmetric methods can be considered. However, in some cases, it may be important to encrypt the entire message or at least a part of the message (e.g., the payload) to protect the confidential payload and / or make it difficult for potential attackers to read and interpret the message and reverse-engineer the used protocol.

[0004] Similar to the considerations regarding integrity and replay protection in DE 10 2021 001 095 A1, the same applies to encryption. In principle, especially short messages can be encrypted asymmetrically, for example, using an RSA-based method. However, the RSA ciphertext of the plaintext is at least as long as the key used for encryption. For example, when using RSA-2048, it is 2048 bits. Therefore, for example, an unencrypted message that is 20 bytes, i.e., 160 bits long, becomes an encrypted message to be transmitted that is at least 2048 bits long, which is completely contrary to the necessity of using short messages. In addition, asymmetric decryption takes several times longer than symmetric encryption or decryption. Therefore, only symmetric methods can effectively encrypt short, high-frequency messages.

[0005] For symmetric encryption, a block cipher such as AES is usually used. The block size of the block cipher E is denoted herein by L E or L_E. In the Raw encryption of the block cipher E using the block size L E an exact L EA plaintext of length L, i.e., a so-called plaintext block, is encrypted with a symmetric key into a ciphertext of exactly length L, i.e., a so-called ciphertext block. Therefore, in Raw decryption, the decryption function D of the block cipher E belonging to the block size L is used to decrypt the (exactly length L) ciphertext block into the (exactly length L) plaintext block with the symmetric key. Therefore, in both cases, only one complete block is processed and inputs of different lengths are not accepted. The E-Raw encryption and D-Raw decryption are respectively called E and D. The E-Raw encryption of the symmetric key K is called E and the D-Raw decryption of the symmetric key K is called D. E In the encryption by the block cipher E, a plaintext longer than L bits is divided into blocks corresponding to the cipher block size L, and then these blocks are encrypted individually with the symmetric key. The completely independent encryption of individual plaintext blocks is called the ECB mode (a block cipher). Different from Raw encryption, the cipher in the ECB mode can process inputs of any length. If the last plaintext block is shorter than the block size of the block cipher, so-called padding is applied to pad the last plaintext block in a defined way. ECB is the simplest operation mode of the block cipher, but its disadvantage is that when the same key is used, the same plaintext block is encrypted into the same ciphertext block, which allows an attacker to draw conclusions related to the corresponding plaintext block. E To solve this weakness of ECB, more complex operation modes (CBC, CFB, OFB, CTR, etc.) have been developed, in which the encryption of individual plaintext blocks is more or less closely intertwined instead of directly encrypting individual plaintext blocks independently as in the ECB mode. Therefore, in addition to the plaintext block itself and the key, the encryption of the next plaintext block also includes other data generated during the encryption of its previous plaintext block, usually data of one block size, where this data entering the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or be independent of the previous plaintext block (OFB, CTR). E In the encryption by the block cipher E, a plaintext longer than L bits is divided into blocks corresponding to the cipher block size L, and then these blocks are encrypted individually with the symmetric key. The completely independent encryption of individual plaintext blocks is called the ECB mode (a block cipher). Different from Raw encryption, the cipher in the ECB mode can process inputs of any length. If the last plaintext block is shorter than the block size of the block cipher, so-called padding is applied to pad the last plaintext block in a defined way. ECB is the simplest operation mode of the block cipher, but its disadvantage is that when the same key is used, the same plaintext block is encrypted into the same ciphertext block, which allows an attacker to draw conclusions related to the corresponding plaintext block. E To solve this weakness of ECB, more complex operation modes (CBC, CFB, OFB, CTR, etc.) have been developed, in which the encryption of individual plaintext blocks is more or less closely intertwined instead of directly encrypting individual plaintext blocks independently as in the ECB mode. Therefore, in addition to the plaintext block itself and the key, the encryption of the next plaintext block also includes other data generated during the encryption of its previous plaintext block, usually data of one block size, where this data entering the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or be independent of the previous plaintext block (OFB, CTR). RAW and D RAW The E-Raw encryption of the symmetric key K is called E RAW K and the D-Raw decryption of the symmetric key K is called D RAW K .

[0006] In the encryption by the block cipher E, a plaintext longer than L bits is divided into blocks corresponding to the cipher block size L, and then these blocks are encrypted individually with the symmetric key. The completely independent encryption of individual plaintext blocks is called the ECB mode (a block cipher). Different from Raw encryption, the cipher in the ECB mode can process inputs of any length. If the last plaintext block is shorter than the block size of the block cipher, so-called padding is applied to pad the last plaintext block in a defined way. ECB is the simplest operation mode of the block cipher, but its disadvantage is that when the same key is used, the same plaintext block is encrypted into the same ciphertext block, which allows an attacker to draw conclusions related to the corresponding plaintext block. E To solve this weakness of ECB, more complex operation modes (CBC, CFB, OFB, CTR, etc.) have been developed, in which the encryption of individual plaintext blocks is more or less closely intertwined instead of directly encrypting individual plaintext blocks independently as in the ECB mode. Therefore, in addition to the plaintext block itself and the key, the encryption of the next plaintext block also includes other data generated during the encryption of its previous plaintext block, usually data of one block size, where this data entering the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or be independent of the previous plaintext block (OFB, CTR). E To solve this weakness of ECB, more complex operation modes (CBC, CFB, OFB, CTR, etc.) have been developed, in which the encryption of individual plaintext blocks is more or less closely intertwined instead of directly encrypting individual plaintext blocks independently as in the ECB mode. Therefore, in addition to the plaintext block itself and the key, the encryption of the next plaintext block also includes other data generated during the encryption of its previous plaintext block, usually data of one block size, where this data entering the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or be independent of the previous plaintext block (OFB, CTR).

[0007] To solve this weakness of ECB, more complex operation modes (CBC, CFB, OFB, CTR, etc.) have been developed, in which the encryption of individual plaintext blocks is more or less closely intertwined instead of directly encrypting individual plaintext blocks independently as in the ECB mode. Therefore, in addition to the plaintext block itself and the key, the encryption of the next plaintext block also includes other data generated during the encryption of its previous plaintext block, usually data of one block size, where this data entering the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or be independent of the previous plaintext block (OFB, CTR).

[0008] Thus, roughly speaking, the same plaintext block is usually encrypted into different ciphertext blocks, but this does not apply to the first plaintext block as it has no previous plaintext block from which additional input data can be obtained. To correct this situation, an initialization vector of the block size is usually used and serves as this additional data when encrypting the first block. The initialization vector can only be used for one plaintext at a time, otherwise (for the same key) the same ciphertext block will be generated for the same plaintext block. Therefore, during the use of the same key, the initialization vector must be a Nonce. The initialization vector only needs to be novel, i.e., a Nonce, and it does not need to be kept secret. More precisely, the initialization vector used for encryption is also required in decryption, so this initialization vector must be known to both the sender and the receiver. For example, since it does not need to be kept secret, it can also be transmitted as an explicit unencrypted part of the message. For example, TLS does this. If this is the case, it cannot be transmitted in encrypted form because without the initialization vector as a plaintext block, the receiver will not be able to decrypt the encrypted message.

[0009] However, explicitly transmitting the initialization vector, especially as part of a short message, is resource-intensive because the initialization vector is usually a block length, e.g., 128 bits in AES. If the maximum number of messages encrypted with the same key is known in advance, a counter can be reserved on the sender's side, which is incremented by 1 for each new message. Then, for example, through an appropriate padding method coordinated between the sender and the receiver, by which the counter bits are supplemented with additional bits, or through an encryption hash function and then necessary length adjustment if required, the sender can generate a new, usually block-length initialization vector for each new message because of the previously occurred increment of the counter and use it for the encryption of the message. Instead of sending the entire initialization vector with each message, only the counter, i.e., the counter bits representing the counter that indicates the corresponding message number, will be sent. Using a 32-bit long counter enables the space required in the message to be reduced from, for example, 128 bits to, for example, 32 bits.

[0010] Particularly space-saving is the use of an implicitly segmented initialization vector, where the sender and the receiver agree on a common starting initialization vector and a rule for generating a novel next initialization vector from the current initialization vector at the beginning, and then generate this next novel initialization vector synchronously for each new message for both sides with the help of the previously agreed rule. The problem here is that messages may be lost or arrive out of order, thus losing the synchronization of the initialization vectors led by the sender and the receiver.

[0011] Another equally space-saving way to implicitly synchronize the initialization vector between the sender and the receiver is to derive the vector from the message itself that must be transmitted anyway, and the sender and the receiver can do this independently. The problem here is that, on the one hand, the sender must know the initialization vector before the encryption operation and thus can be derived from the plaintext message, and on the other hand, the receiver must know the initialization vector before the decryption operation and thus can be derived from the encrypted message, which is a (at first glance) contradictory requirement.

[0012] The so-called synthetic initialization vector (SIV) is used in a special AEAD ("Authenticated Encryption with Associated Data") method, that is, a method that simultaneously implements encryption and authentication. It is characterized in that it generates the initialization vector for encryption from the message itself by generating a unique authentication tag (Tag) from the message, and then uses it as the initialization vector in the encryption of the message or a part thereof. Various AEAD variants of AEAD operating modes based on synthetic initialization vectors have been developed, such as the combination of CMAC and CTR (SIV-AES), AES-GCM (AES-GCM-SIV) or CCM (CCM-SIV) (see also DE 10 2019113026A1). However, since the initialization vector, that is, the authentication tag generated from the unencrypted message, is also required in message decryption, but the receiver cannot directly derive it from the encrypted message, it must be sent to the receiver in an unencrypted manner together with the encrypted message. Thus, by using the synthetic initialization vector, in the above method, no space in the message is saved.

[0013] WO 2009 / 013420 A1 defines an authentication method similar to CBC-MAC based on block ciphers, which calculates the message authentication code (MAC) only from the message itself, rather than, as in CBC-MAC, from a message extended with a prefix containing the message hash value.

[0014] In addition, WO 2019 / 079 890A1 discloses a computer-implemented method for a receiver to verify a message received from a transmitter. The message includes a first part and a second part. The method includes receiving a token and a key associated with the transmitter from a verification unit. To verify the message, the method processes and compares the first part of the message using the token, and processes and compares the second part of the message using the key.

[0015] For addressing the above weaknesses, the general requirement of using a novel initialization vector to encrypt each new plaintext is sufficient but not absolutely necessary. If it can be ensured that the first block of the plaintext is always novel, then the requirement of using a novel initialization vector in the operating modes that link blocks, specifically including the previous block, especially the previous ciphertext block (e.g., CBC, CFB), can be omitted. Thus, in some cases, it is sufficient for the combination of the initialization vector and the first plaintext block to be novel for a fixed key. If the first plaintext block is always novel, then in these specific cases, the use of the initialization vector can even be completely omitted.

[0016] For example, if you wish or must omit a guaranteed novel (explicit or implicit) initialization vector for each plaintext to be encrypted, it makes sense to design the format of the plaintext to maximize the probability that the first block of the plaintext is always novel.

[0017] Due to the probability of "novelty" of a single plaintext, i.e., the probability of being pairwise different is greater than the probability that the first block of the respective plaintext is novel, i.e., the probability of being pairwise different, it makes sense to collect the "novelty" of the entire plaintext in the first block in order to achieve a novel first block with the highest possible probability. Thus, design the first block of the respective plaintext such that the first blocks of two different plaintexts are also always different.

[0018] Now, depending on the difference between plaintext pairs, the difference between two plaintexts may occur at different positions in the plaintext, so the "novelty" may be distributed across the entire plaintext bit positions. Thus, in general, no plaintext format can be found that guarantees a novel first plaintext block with the highest possible probability by simply reordering the respective plaintext bits. However, the "novelty" contained in the plaintext can be well accumulated by applying the cryptographic hash function HASH to a sequence of certain selected bits for which their combination has the potential to be novel. If a difference occurs in at least one bit in the two bit sequences BF1 and BF2 of two different plaintexts used to form the hash value, then the hash values HashTag1 := HASH(BF1) and HashTag2 := HASH(BF2) of the two bit sequences containing the different bit are also very likely to be different.

[0019] The hash value HashTag := HASH(BF) calculated in this way can now be used directly as the initialization vector, or an initialization vector can be derived therefrom, which is always novel if the plaintext bit sequence BF used for calculating the hash value is its. For example, the above-mentioned synthetic initialization vector (SIV) is carried out in this way. As already explained above, the problem here is that the initialization vector must be known to the recipient so that it can decrypt all or part of the encrypted plaintext. If it is not desired for the initialization vector to be explicitly transmitted in an unencrypted manner as part of the plaintext, this would mean that any part of the bit sequence BF used to form the hash value HashTag cannot be encrypted, otherwise the recipient will not be able to derive from the received partially or fully encrypted plaintext the initialization vector used by the sender for encryption. Summary of the Invention

[0020] The object of the present invention is to provide an improved method for encrypting plaintext to be encrypted contained in a plaintext message, wherein, although a bit sequence derived from the plaintext is used during encryption, high security can still be achieved.

[0021] According to the present invention, this object is achieved by a method having the features of claim 1. Advantageous embodiments are shown by the relevant dependent claims.

[0022] The method according to the present invention is used to encrypt the plaintext PT to be encrypted contained in the plaintext message M P ENCR ZF ENCR1,ENCR2 M , wherein the plaintext message consists of the plaintext to be encrypted and additional or associated data blocks AD (“Associated Data”) that do not need to be encrypted.

[0023] Therefore, it applies: M P =(PT, AD).

[0024] This encryption method includes a method for decrypting DECR C the ciphertext parts CT1, CT2 contained in the ciphertext message M ZF DECR1,DECR2 M , wherein the ciphertext message consists of the ciphertext parts to be decrypted and unencrypted associated data blocks. In both cases, a novelty bit sequence ImplAD (“Implicit Associated Data”) can be included as an additional source of novelty.

[0025] According to the present invention, a reversible decomposition function ZF is provided, which assigns its decomposition function to the plaintext to be encrypted to become decomposition parts PT1 and PT2. The "decomposition" used herein means the result of applying the decomposition function to the plaintext, and the decomposition function provides plaintext parts. In addition, at least one encryption function ENCR1, ENCR2 is provided, which is implicitly equipped with appropriate fixed key materials, and encrypts the plaintext to be encrypted using the encryption function in consideration of the variable input bit sequence N, where the input bit sequence is recognized as the first parameter, and the plaintext to be encrypted is recognized as the second parameter. In addition, at least one decryption function DECR1, DECR2 belonging to the at least one encryption function is provided, which is implicitly equipped with appropriate fixed key materials, and decrypts the ciphertext CT generated by the encryption function in consideration of the same variable input bit sequence, where the input bit sequence is recognized as the first parameter, and the plaintext to be encrypted is recognized as the second parameter.

[0026] Here, in consideration of the novelty bit sequence, the plaintext to be encrypted included in the plaintext message is encrypted and two ciphertext parts are provided, where the first ciphertext part can be obtained by means of the at least one encryption function from the second plaintext part, the associated data block and the novelty bit sequence concatenated in any order as the first parameter and the first plaintext part as the second parameter. The second ciphertext part can be obtained by means of the at least one encryption function from the first ciphertext part and the second plaintext part as the first parameter and the second parameter. In consideration of the novelty bit sequence, the decryption related to encryption returns the plaintext from the ciphertext parts included in the ciphertext message, where the plaintext part can be obtained by means of decryption from the first ciphertext part, the second ciphertext part, the associated data block and the novelty bit sequence, where the second plaintext part can be obtained by means of the at least one encryption function from the ciphertext parts as the first parameter and the second parameter, and thus the first plaintext part can be obtained separately by means of the at least one decryption function from the second plaintext part, the associated data block and the novelty bit sequence concatenated in the order used during encryption as the first parameter and the first ciphertext part as the second parameter.

[0027] Therefore, the concept of the method according to the present invention is to use a reversible decomposition function ZF, which assigns each plaintext PT to be encrypted to two plaintext parts PT1 and PT2. That is, ZF(PT) = (PT1, PT2). Then, instead of in one step, these plaintext parts are encrypted in two separate steps, for example, sequentially. Since the decomposition function is reversible, for each plaintext to be encrypted, PT = ZF -1 (ZF(PT)) holds, where ZF -1represents the inverse function of the decomposition function. Therefore, it is always possible to derive the original plaintext from the plaintext part in an unambiguous manner with the help of the inverse function. In the context considered here, it is not necessary to define the decomposition function for all bit sequences, but only for a set of plaintexts to be encrypted, usually with the same key. For example, if only plaintexts with a length greater than 20 bytes should be encrypted, it is sufficient to define the decomposition function for plaintexts with a length greater than 20 bytes.

[0028] It can be seen that due to the invertibility of each decomposition function, each decomposition function is novelty-preserving, because for two different plaintexts PT and PT′, their decompositions ZF(PT) = (PT1, PT2) and ZF(PT′) = (PT′1, PT′2) are also different, that is, from PT ≠ PT′, it always follows that PT1 ≠ PT′1 or PT2 ≠ PT′2.

[0029] For a set of potential plaintexts to be encrypted, if there is a decomposition function, one of the encryption communication partners participating in encryption / decryption (e.g., the transmitter) can encrypt not the original plaintext PT, but the plaintext parts PT1 and PT2 contained in the decomposition ZF(PT) independently of each other, for example, sequentially, and transmit the two resulting ciphertext parts CT1, CT2. For the other communication partner, here the receiver, the ciphertext parts can be decrypted separately after transmission. After decrypting the two ciphertext parts, the original plaintext can be determined from the two plaintext parts obtained by decryption with the help of the inverse function of the decomposition function. Therefore, it holds that: PT = ZF -1 (PT1, PT2).

[0030] The advantage of encrypting the plaintext parts contained in the decomposition sequentially instead of encrypting the entire original plaintext in one step is that the individual plaintext parts contained in the decomposition or the bit sequences generated in a novelty-preserving manner therefrom, for example, encrypting the plaintext parts, can be used as an initial vector or to generate an initial vector when encrypting the corresponding other plaintext parts contained in the decomposition.

[0031] In particular, selected bits or all bits of the second plaintext part can be used as an initial vector or to form an initial vector when encrypting the first plaintext part. Then the encryption of the first plaintext part generated in this way can be used as an initial vector or to form an initial vector when encrypting the second plaintext part.

[0032] Therefore, with the method according to the invention, it is possible to symmetrically encrypt novelty-preserving plaintexts without using the traditional initial vectors having the problems described above, without a significant loss in security, and to achieve complete encryption of the plaintext here.

[0033] Basically, only one encryption function and a corresponding decryption function are needed here to implement the present invention respectively. However, preferably, according to a very advantageous improvement scheme, it can be stipulated to use two pairs of encryption and decryption functions respectively. These functions can be assigned to separate plaintext or ciphertext parts. For example, for the plaintext part PT1 to be encrypted, it can be encrypted with the first encryption function ENCR1, and the second plaintext part PT2 can be encrypted with the second encryption function ENCR2. And when decrypting the ciphertext parts CT1 and CT2, the corresponding first decryption function DECR1 or the second decryption function DECR2 must be used again.

[0034] Thereby, the encryption ENCR ZF ENCR1,ENCR2 M provides the ciphertext parts, which are based on:

[0035] ENCR ZF ENCR1,ENCR2 M (PT, AD, ImplAD):=(CT1, CT2),

[0036] where CT1 := ENCR1(PT2 || AD || ImplAD, PT1) and CT2 := ENCR2(CT1, PT2),

[0037] and where (PT1, PT2) is the decomposition of the plaintext PT using ZF, i.e., (PT1, PT2):= ZF(PT).

[0038] Considering ImplAD, the ciphertext pair (CT1, CT2) included in the ciphertext message M C =(CT1, CT2, AD) belongs to the decryption DECR ZF ENCR1,ENCR2 M of ENCR ZF DECR1,DECR2 M , i.e., DECR DECR1,DECR2 M (CT1, CT2, AD, ImplAD) is defined as follows:

[0039] DECR ZF DECR1,DECR2 M (CT1, CT2, AD, ImplAD):= PT, where PT2 := DECR2(CT1, CT2), PT1 := DECR1(PT2 || AD || ImplAD, CT1) and PT := ZF -1 (PT1, PT2).

[0040] By means of unencrypted associated data blocks, the data to be transmitted is made highly flexible because encrypted and unencrypted data parts can be combined. Further, if the probability of plaintext novelty is insufficient, it can be increased by using a novelty bit sequence. Nevertheless, in many cases, it is also possible to dispense with the use of these parts, so that a very advantageous improvement of the method according to the invention can specify the associated data blocks and / or the novelty bit sequence as empty.

[0041] Within the scope of the present invention, if there exists u > 0 such that for all plaintexts PT of length greater than u, from ZF(PT) = (PT1, PT2) it is always obtained that L(PT1) = u and PT = PT1||PT2, then this decomposition function is called a conventional decomposition function. Here, L(BF) denotes the bit length of the bit sequence BF. Accordingly, all other decomposition functions are called non-conventional.

[0042] As described above, depending on the encryption method used, the novelty contained in the plaintext can be advantageously "collected" in the first or second plaintext part. In the method according to the invention, the decomposition of the plaintext is controlled by a decomposition function, where non-conventional decomposition functions offer particular flexibility. Thus, according to a particularly advantageous improvement of the invention, it can be provided to use a non-conventional decomposition function as the decomposition function.

[0043] All the following examples of decomposition functions are examples of such non-conventional decomposition functions. For example, it is now possible to select a decomposition function such that the first plaintext part is formed by the first half of the plaintext and the second plaintext part is formed by the second half of the plaintext, and if the number of bits in the plaintext is odd, the first plaintext part has one more bit than the second plaintext part. Another option is to assign all the even bits of the plaintext to the first plaintext part and all the odd bits of the plaintext to the second plaintext part. Even if there are few advantageous applications in practice, the sum of the lengths of the two plaintext parts does not have to be the same as the length of the plaintext. For example, the first plaintext part can be formed by the first twenty bytes of the plaintext and the second plaintext part can be formed by the entire plaintext.

[0044] Within the scope of the present invention, an encryption function that is implicitly equipped with suitable fixed key material and encrypts plaintext into ciphertext considering a variable input bit sequence is considered to maintain novelty. For each fixed plaintext to be encrypted, different variable input bit sequences are used to generate different ciphertexts with a probability high enough for the application, that is, for each plaintext to be encrypted, two different input bit sequences, namely N1≠N2, reliably produce results ENCR(N1,PT)≠ENCR(N2,PT) for the application. Here, the restrictive condition "with a probability high enough for the application" is imposed because the input bit sequence N does not have to be directly the initial vector, but the required initial vector must also be formed by pseudo-randomization (e.g., by applying an encryption hash function) and / or length adjustment (both internally in ENCR) if necessary. Here, it is impossible to completely prevent collisions, that is, the same initial vector is generated by different input bit sequences N.

[0045] In the method, advantageously, the novelty contained in the input bit sequence when encrypting the plaintext using the encryption function is not lost, but is transmitted to the corresponding ciphertext as well and as completely as possible. Therefore, according to a particularly advantageous embodiment of the present invention, an encryption function that maintains novelty is used as the at least one encryption function.

[0046] Especially in the case of two encryption functions, this is particularly important for the first encryption function because the encryption of the first plaintext part by the first encryption function will be used as the input bit sequence in the encryption of the second plaintext part by the second encryption function.

[0047] Therefore, a decomposition function is used to decompose the plaintext into two plaintext parts to be encrypted separately. The decomposition function is selected so that the generated plaintext parts match the encryption or decryption method used, especially to meet the preconditions of the encryption function for security applications as much as possible. For this purpose, for example, the decomposition function is selected such that for the message to be encrypted, the novelty probability of the first plaintext part is maximized by the plaintext.

[0048] Here, according to a particularly advantageous improvement of the present invention, the decomposition function will be determined once and implemented in both encryption and decryption. Therefore, between the encryption entity, such as the transmitter, and the decryption entity, such as the receiver, a fixed decomposition function that best meets the above requirements is agreed upon and then used. Here, the decomposition function to be used can be specified or agreed upon in a fixed manner throughout the entire service life of the system. Alternatively, according to a particularly advantageous embodiment of the present invention, the decomposition function can also be negotiated between the encryption entity and the decryption entity between different sessions, or during the coordination (so-called "Handshake") phase before actual operation for multiple consecutive sessions. Here, the selected decomposition function should optimally ensure the messages expected to be exchanged in the upcoming session.

[0049] In another advantageous alternative, it can also be provided that the encryption system or the decryption system is equipped with a fixed set of decomposition functions supported by the encryption system or the decryption system. In this case, then, for example, during the handshake, it can be determined between the encryption and transmission system and the receiving and decryption system which of the decomposition functions available in both systems will be used subsequently.

[0050] However, the types of messages usually exchanged during a session are not known, that is, in this case, it is difficult to evaluate which decomposition function is most suitable for the corresponding session. Particularly advantageously, when encrypting the plaintext, a particularly suitable decomposition function is selected for this particular plaintext if necessary. In order for the decryption entity to be able to determine which decomposition function was used when encrypting the plaintext, this situation must be informed to the decryption entity. For this purpose, for the decomposition functions supported by the decryption entity, for example, they can be given consecutive numbers known to both the encryption entity and the decryption entity, and the plaintext is extended with the number of the decomposition function used by the encryption entity. First of all, this extension goes against the purpose that the message to be transmitted should be as short as possible. However, if only a small number of decomposition functions are supported, for example 16, then only a small number of bits (for example, 4 bits in the case of 16 possible decomposition functions) are required to encode the number of the decomposition function used during the encryption process.

[0051] It is proposed to extend all or part of the plaintext with the number of the decomposition function ZF used. Additionally, for all plaintexts PT, when encoding the number of the decomposition function ZF used, it is proposed to agree on a fixed position within the plaintext PT, for example at the beginning or end of the plaintext, and to agree on a fixed number of bits for the encoding of the number between the encryption entity and the decryption entity.

[0052] Furthermore, the following situation may occur, that is, not every plaintext PT requires a special decomposition function, but many plaintexts PT can also be reliably encrypted using a pre-agreed default or standard decomposition function ZF. For this situation, advantageously, instead of transmitting the number of the decomposition function ZF used, the encryption entity can be informed that the default decomposition function should be used for decrypting the plaintext. In order for the decryption entity to be able to determine whether the received plaintext contains the number of the decomposition function ZF used, the plaintext must be extended with this binary information, here called the indicator bit.

[0053] Therefore, in an improved embodiment of the present invention, it is proposed to extend each plaintext with an indicator bit that indicates whether this plaintext has been extended with the number of the decomposition function ZF used. Additionally, for all plaintexts, it is proposed to agree between the encryption entity and the decryption entity on the position of the indicator bit in the thus extended plaintext, for example using the first or last bit of the original plaintext extended by the indicator bit for this information.

[0054] Since the decomposition function is always applied to the plaintext, the extension of the original plaintext related to the decomposition function used, i.e., the indication bits and / or the number of the decomposition function used, can be encrypted together by the encryption entity. Here, it must be taken into account that when the plaintext is decomposed by the decomposition function, the positions of individual bits within the plaintext may change, especially in the case of using a non-conventional decomposition function. If additional data is encrypted, advantageously, the position of the additional data can be agreed upon not for the original plaintext but for two plaintext parts, so that the decryption entity can determine the decomposition function to be used based on the two plaintext parts before application.

[0055] Here, in particular, it can be stipulated that the indication bits included in the extended plaintext and / or the number of the decomposition function used in the extended plaintext during encryption are encrypted together with the plaintext. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Other advantageous embodiments and different implementation schemes of the method according to the present invention are also embodied in the embodiments described in detail below with reference to the drawings.

[0057] Wherein:

[0058] Figure 1 Encryption and decryption in the first embodiment are schematically shown; and

[0059] Figure 2 Encryption and decryption in the second embodiment are schematically shown. DETAILED DESCRIPTION OF THE INVENTION

[0060] In Figure 1 the illustration of, an encryption and decryption scheme of the plaintext PT can be seen.

[0061] The proposed encryption method ENCR ZF ENCR1,ENCR2 M obtains a plaintext message M including a plurality of components P and other data as input content, and encrypts the components of the message M P by means of two encryption functions ENCR1 and ENCR2. Then the description of the encryption method ENCR ZF ENCR1,ENCR2 M includes a description of the components used in this method, a description of the input format, and a description of the actual method, which generates a fully or partially encrypted ciphertext message M P from the components of the plaintext message M C .

[0062] Encryption system ENCR ZF ENCR1,ENCR2 MComponents:

[0063] - Reversible decomposition function ZF

[0064] - Encryption function ENCR1 equipped with appropriate fixed key material in an implicit manner, which encrypts the plaintext PT to be encrypted into ENCR1(N, PT) considering the variable input bit sequence N

[0065] - Second encryption function ENCR2 equipped with appropriate fixed key material in an implicit manner, which encrypts the plaintext PT into ENCR2(N, PT) considering the variable bit sequence N

[0066] Input format:

[0067] - Message M

[0068] composed of the plaintext PT to be encrypted and the associated data block AD of arbitrary length (“Associated Data”) P , i.e., M P = (PT, AD). The associated data block AD will not be encrypted, but it helps to form the input bit sequence N and thus helps to increase the probability of its novelty.

[0069] o If the use of the associated data block AD is abandoned, an empty bit sequence can be selected as AD.

[0070] - Implicit novelty bit sequence ImplAD of arbitrary length (“Implicit Associated Data”),

[0071] which also helps to form the input bit sequence N and thus helps to increase the probability of its novelty, and is known to both the transmitter and the receiver, and thus is not a component of the message M P such as a counter known at both ends or a hash value or encryption of such a counter.

[0072] o If the use of the novelty bit sequence ImplAD is abandoned, an empty bit sequence can be selected as ImplAD.

[0073] In the case of abandoning the associated data block AD and the novelty bit sequence ImplAD, the method schematically shown will be obtained. Otherwise, the description here similarly applies to this method: Figure 2

[0074] Encryption ENCR ZF ENCR1,ENCR2 M P :

[0075] - Input:

[0076] 1. M P=(PT, AD)

[0077] 2. ImplAD

[0078] - Determined output:

[0079] 1. (PT1, PT2): = ZF(PT)

[0080] 2. CT1: = ENCR1(PT2 || AD || ImplAD, PT1)

[0081] 3. CT2: = ENCR2(CT1, PT2)

[0082] - Output:

[0083] 1. CT1, CT2, where

[0084] M C : = (CT1, CT2, AD)

[0085] In summary, for the plaintext message M P = (PT, AD), the following is recommended to determine the encryption of the plaintext PT:

[0086] ENCR ZF ENCR1,ENCR2 M (PT, AD, ImplAD): = (CT1, ENCR2(CT1, PT2))

[0087] where (PT1, PT2): = ZF(PT) and

[0088] CT1: = ENCR1(PT2 || AD || ImplAD, PT1)

[0089] The proposed decryption method DECR ZF DECR1,DECR2 M obtains the ciphertext message M C consisting of multiple partially encrypted components, as well as other data as input content, and decrypts the encrypted parts of the message M C using two decryption functions DECR1 and DECR2. Then the description of the decryption method DECR ZF DECR1,DECR2 M includes a description of the components used in this method, a description of the input format, and a description of the actual method, which generates the plaintext part of the original message M C from the components of the partially encrypted ciphertext message M P of the method.

[0090] Decryption System DECR ZF DECR1,DECR2 M Components of:

[0091] - The inverse function ZF of the reversible decomposition function ZF used during encryption -1

[0092] - The decryption function DECR1 belonging to ENCR1 and implicitly equipped with appropriate fixed key material, which decrypts the ciphertext CT into DECR1

[0093] (N, CT) such that for all plaintext PTs that should be encrypted using ENCR1:

[0094] DECR1(N, ENCR1(N, PT)) = PT

[0095] - The decryption function DECR2 belonging to ENCR2 and implicitly equipped with appropriate fixed key material, which decrypts the ciphertext CT into DECR2

[0096] (N, CT) such that for all plaintext PTs that should be encrypted using ENCR2: DECR2(N, ENCR2(N, PT)) = PT

[0097] Input format:

[0098] - A message M consisting of two ciphertexts CT1 and CT2 and an unencrypted associated data block AD C , i.e., M C

[0099] = (CT1, CT2, AD).

[0100] - The same ImplAD as during encryption

[0101] Decryption DECR ZF DECR1,DECR2 M :

[0102] - Input:

[0103] 1. M C = (CT1, CT2, AD)

[0104] 2. ImplAD

[0105] - Determine the output:

[0106] 1. PT2 := DECR2(CT1, CT2)

[0107] 2. PT1 := DECR1(PT2 || AD || ImplAD, CT1)

[0108] 3. PT := ZF -1 (PT1, PT2)

[0109] - Output:

[0110] 1. PT, namely M P := (PT, AD)

[0111] In summary, for the ciphertext message M C = (CT1, CT2, AD), the following is recommended to determine the decryption of the encrypted ciphertext part (CT1, CT2):

[0112] DECR ZF DECR1,DECR2 M (CT1, CT2, AD, ImplAD) := ZF -1 (DECR1(PT2 || AD || ImplAD, CT1), PT2)

[0113] where PT2 := DECR2(CT1, CT2).

Claims

1. A method for encrypting (ENCR P ) a plaintext (PT) to be encrypted included in a plaintext message (M ZF ENCR1,ENCR2 M ), wherein, The plaintext message (M P ) consists of the plaintext to be encrypted (PT) and an unencrypted associated data block (AD), and a method for decrypting (DECR C ) the ciphertext parts (CT1, CT2) included in the ciphertext message (M ZF DECR1,DECR2 M ), wherein the ciphertext message (M C ) consists of the ciphertext parts (CT1, CT2) and the unencrypted associated data block (AD). In each case, taking into account the implicit novelty bit sequence (ImplAD) used as an additional source of novelty, characterized in that, a reversible decomposition function (ZF) is provided, which assigns the plaintext to be encrypted (PT) to two decomposed plaintext parts (PT1, PT2), where at least one encryption function (ENCR1, ENCR2) is implicitly equipped with suitable fixed key material, which encrypts the plaintext (PT) to be encrypted with the encryption function (ENCR1, ENCR2) taking into account a variable input bit sequence (N), where, at least one decryption function (DECR1, DECR2) belonging to the at least one encryption function (ENCR1, ENCR2) is implicitly equipped with suitable fixed key material, which decrypts the ciphertext (CT) generated with the encryption function (ENCR1, ENCR2) taking into account the same variable input bit sequence (N), where, Considering the novelty bit sequence (ImplAD), encrypt the plaintext to be encrypted (PT) included in the plaintext message (M P ) by the encryption (ENCR ZF ENCR1,ENCR2 M ), and provide two ciphertext parts (CT1, CT2), where with the aid of the at least one encryption function (ENCR1, ENCR2), a first ciphertext part (CT1) is obtained from the second plaintext part (PT2), the associated data block (AD) and the novelty bit sequence (ImplAD) concatenated in any order as a first parameter and the first plaintext part (PT1) as a second parameter, where with the aid of the at least one encryption function (ENCR1, ENCR2), the second ciphertext part (CT2) is obtained from the first ciphertext part (CT1) as a first parameter and the second plaintext part (PT2) as a second parameter, where Considering the novelty bit sequence (ImplAD), perform the decryption (DECR ZF DECR1,DECR2 M ) belonging to the encryption (ENCR ZF ENCR1,ENCR2 M ) on the ciphertext parts (CT1, CT2) included in the ciphertext message (M C ), and return the plaintext (PT), where C ) of ZF ENCR1,ENCR2 M ) and ZF DECR1,DECR2 M ) The plaintext portions (PT1, PT2) are obtained from the first ciphertext portion (CT1), the second ciphertext portion (CT2), the associated data block (AD), and the novelty bit sequence (ImplAD) by means of the decryption (DECR ZF DECR1,DECR2 M ), wherein the second plaintext portion (PT2) is obtained from the ciphertext portions (CT1, CT2) as first and second parameters by means of the at least one decryption function (DECR1, DECR2), and the first plaintext portion (PT1) is obtained individually by means of the at least one decryption function (DECR1, DECR2) from the second plaintext portion (PT2), the associated data block (AD), and the novelty bit sequence (ImplAD) as first parameter and concatenated in the order used during encryption, and the first ciphertext portion (CT1) as second parameter, whereby Obtain the plaintext (PT) from the two plaintext parts (PT1, PT2) through the inverse function (ZF -1 ) of the decomposition function (ZF).

2. The method according to claim 1, characterized in that, in each case two encryption functions and decryption functions (ENCR1, ENCR2, DECR1, DECR2) are used, where, the first encryption function and the second encryption function (ENCR1, ENCR2) are each implicitly equipped with suitable fixed key material, which encrypts the plaintext (PT) to be encrypted with the corresponding encryption function (ENCR1, ENCR2) taking into account the variable input bit sequence (N), where, the first decryption function and the second decryption function (DECR1, DECR2) respectively belonging to the first encryption function and the second encryption function (ENCR1, ENCR2) are implicitly equipped with suitable fixed key material, which decrypts the ciphertext (CT) generated with the corresponding encryption function (ENCR1, ENCR2) taking into account the variable input bit sequence (N), and where, Considering the novelty bit sequence (ImplAD), the plaintext to be encrypted (PT) included in the plaintext message (M P ) is encrypted (ENCR ZF ENCR1,ENCR2 M ), and two ciphertext parts (CT1, CT2) are provided, where with the aid of the first encryption function (ENCR1), the first ciphertext part (CT1) is obtained from the second plaintext part (PT2), the associated data block (AD) and the novelty bit sequence (ImplAD) concatenated in any order as a first parameter and the first plaintext part (PT1) as a second parameter, where The second ciphertext part (CT2) is obtained from the first ciphertext part (CT1) as the first parameter and the second plaintext part (PT2) as the second parameter by means of the second encryption function (ENCR2), where Considering the novelty bit sequence (ImplAD), perform the decryption (DECR ZF DECR1,DECR2 M ) belonging to the encryption (ENCR ZF ENCR1,ENCR2 M ) on the ciphertext parts (CT1, CT2) included in the ciphertext message (M C ), and return the plaintext (PT), where C ) of the ZF ENCR1,ENCR2 M ), and ZF DECR1,DECR2 M ) The plaintext parts (PT1, PT2) are obtained from the first ciphertext part (CT1), the second ciphertext part (CT2), the associated data block (AD), and the novelty bit sequence (ImplAD) by means of the decryption (DECR ZF DECR1,DECR2 M ), where the second plaintext part (PT2) is obtained from the ciphertext parts (CT1, CT2) as the first and second parameters by means of the second decryption function (DECR2), and the first plaintext part (PT1) is obtained from the second plaintext part (PT2), the associated data block (AD), and the novelty bit sequence (ImplAD) concatenated in the order used during encryption as the first parameter, and the first ciphertext part (CT1) as the second parameter, by means of the first decryption function (DECR1).

3. The method according to claim 1 or 2, characterized in that the associated data block (AD) and / or the novelty bit sequence (ImplAD) are specified as empty.

4. The method according to claim 1, 2 or 3, characterized in that a non-conventional decomposition function (ZF) is used as the decomposition function (ZF).

5. The method according to any one of claims 1 to 4, characterized in that an encryption function that maintains novelty is used as the at least one encryption function (ENCR1, ENCR2).

6. The method according to any one of claims 1 to 5, characterized in that Determine the decomposition function (ZF) once and for all and implement it in the encryption (ENCR ZF ENCR1,ENCR2 M ) and the decryption (DECR ZF DECR1,DECR2 M ).

7. The method according to any one of claims 1 to 5, characterized in that For one or more consecutive sessions of the two communication partners using the encryption (ENCR ZF ENCR1,ENCR2 M ) and the decryption (DECR ZF DECR1,DECR2 M ), the decomposition function (ZF) is agreed upon between the communication partners.

8. The method according to any one of claims 1 to 5, characterized in that Determine the decomposition function (ZF) as a set of the decomposition functions (ZF) and implement it in the encryption (ENCR ZF ENCR1,ENCR2 M ) and the decryption (DECR ZF DECR1,DECR2 M ).

9. The method according to claim 8, characterized in that for identification purposes, the individual decomposition functions in the set of decomposition functions (ZF) are consecutively numbered.

10. The method according to claim 9, characterized in that the number of the decomposition function (ZF) used for encryption and required for decryption is integrated into the plaintext to be encrypted (PT).

11. The method according to claim 10, characterized in that the number is arranged at a predetermined position within the plaintext (PT) or within one or both of the plaintext parts (PT1, PT2).

12. The method according to claim 9, 10 or 11, characterized in that the plaintext (PT) is extended with an indication bit that shows whether the number of the decomposition function (ZF) is included in the plaintext (PT) or in one of the plaintext parts (PT1, PT2).

13. The method according to claim 12, characterized in that the indication bit is arranged at a predetermined position within the plaintext (PT) or within one or both of the plaintext parts (PT1, PT2).

14. The method according to any one of claims 9 to 13, characterized in that a standard decomposition function (ZF) is used in the absence of a number.

Images