Methods for encrypting plaintext

Abstract

Method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K, characterized in that a fingerprint function (FP u ) is used, which satisfies the two requirements that from two unequal bit sequences (BF1 ≠ BF2) with a sufficiently high probability for the application, it follows that the results of the application of the fingerprint function (FP u ) on these bit sequences are unequal (FP u (BF1) ≠ FP u (BF2)), and that to the fingerprint function (FP u ) a fingerprint reversal function (FP u -1 ) exists, so that the following always applies: FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u], where u and L Edo not necessarily have to be equal, and a general cipher EGen is used by applying the fingerprint function to the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext, and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP u (PB u 1 || FPInput), i.e. CB 1 := EGen(FP u (PB u 1 || FPlnput)), and the resulting encryption of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 for the encryption of parts of the or of the remaining plaintext with the block cipher E, using any operating mode requiring an initialization vector (IV).

Description

[0001] The invention relates to a method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K.

[0002] The high-frequency sending and receiving of short messages is of great importance for some applications within a vehicle ecosystem; examples of this can be found, for example, in DE 10 2021 001 095 A1. As described in this document, it is often essential to provide these messages with cryptographic integrity protection and / or cryptographic replay protection without excessively increasing the length of the messages. As shown in the aforementioned publication, only symmetric methods can be considered for this purpose for reasons of efficiency. In some cases, however, it may be important to encrypt the entire message or at least part of it, e.g., the payload data, in order to protect confidential payload data and / or to make it more difficult for a potential attacker to read, interpret, and thus reverse engineer the messages and the protocol used.

[0003] Similar considerations to those made for integrity and replay protection in DE 10 2021 001 095 A1 also apply to encryption. In principle, short messages in particular could be encrypted asymmetrically, e.g., using RSA-based methods. However, the RSA ciphertext of a plaintext is at least as long as the key used for encryption, i.e., 2048 bits when using RSA-2048. This means that an unencrypted message of, for example, 20 bytes (i.e., 160 bits) becomes an encrypted message of at least 2048 bits to be transmitted, which completely contradicts the need to use short messages. In addition, asymmetric decryption requires many times more time than symmetric encryption or decryption. Therefore, only symmetric methods can be used for efficient encryption of short, high-frequency messages.

[0004] Block ciphers such as AES are commonly used for symmetric encryption. The block size of a block cipher E is denoted by L E or L_E. In raw encryption with a block cipher E of block size L E will be exactly L E Bit long plaintext, a so-called plaintext block, with the help of a symmetric key to an exactly L E Bit-long ciphertext, a so-called ciphertext block, is encrypted. Accordingly, during raw decryption, a block cipher E of block size L E belonging to the decryption function D (exactly L E bit long) ciphertext block using a symmetric key to a (exactly L E Bit-long) plaintext block is decrypted. In both cases, exactly one complete block is processed; inputs with different lengths are not accepted. The E-Raw encryption or D-Raw decryption is denoted by ERAW or D RAW E-Raw encryption with a symmetric key K is denoted by E RAW K and the D-Raw decryption with a symmetric key K is denoted by D RAW K designated.

[0005] When encrypted with a block cipher E, a plaintext longer than L E Bit is, in the cipher block size L Ecorresponding blocks, which are then individually encrypted using a symmetric key. The completely independent encryption of the individual plaintext blocks is called ECB mode (of a block cipher). In contrast to raw encryption, a cipher operating in ECB mode can handle inputs of any length. If the last plaintext block is shorter than the block size of the block cipher, a so-called padding is applied, which fills this last plaintext block in a defined way. ECB is the simplest operating mode for a block cipher, but it has the disadvantage that when the same key is used, identical plaintext blocks are encrypted into identical ciphertext blocks, which could allow an attacker to draw conclusions about the corresponding plaintext blocks.

[0006] As a remedy for this ECB weakness, more complex operating modes (CBC, CFB, OFB, CTR, etc.) have been developed in which, instead of the independent direct encryption of the individual plaintext blocks, as in the ECB mode, the encryptions of the individual plaintext blocks are more or less closely interwoven with each other, so that in addition to the plaintext block itself and the key, further data, usually one block size long and generated during the encryption of its previous block, are included in the encryption of a next plaintext block. This data included in the encryption of the next plaintext block can depend on the previous plaintext block (CBC, CFB) or can be independent of it (OFB, CTR).

[0007] In this way, roughly speaking, identical plaintext blocks are usually encrypted into different ciphertext blocks. This does not apply to the first plaintext block, however, since this has no predecessor block from which it could obtain the additional input data. To remedy this, initialization vectors are usually one block size long and used as this additional data when encrypting the first block. An initialization vector may only be used once, i.e., only for one plaintext; otherwise, (given the same key), identical ciphertext blocks will be generated for identical plaintext blocks. Therefore, an initialization vector must be a nonce while using the same key. An initialization vector only needs to be novel, i.e., a nonce; it does not need to be kept secret.Rather, the initialization vector used for encryption is also required for decryption, so the initialization vector must be known to both the sender and the receiver. Since it does not need to be kept secret, it can also be transmitted as an explicit unencrypted part of the message, as is done with TLS, for example. If this is the case, it must not be transmitted encrypted, because without the initialization vector present as a plaintext block, the receiver cannot decrypt the encrypted message.

[0008] However, the explicit transmission of the initialization vector, especially as part of short messages, is resource-intensive because an initialization vector is usually one block long, e.g., 128 bits for AES. If the maximum number of messages that can be encrypted with the same key is known in advance, the sender can maintain a counter that is incremented by one for each new message. From this counter, the sender can then generate a new initialization vector, usually one block long, for each new message due to the previous incrementation of the counter and use it to encrypt the message, for example, using a suitable padding method agreed upon between the sender and receiver, with the help of which the counter bits are supplemented by further bits, or with the help of a cryptographic hash function followed by a length adjustment if necessary.Instead of sending the entire initialization vector with each message, only the counter—that is, the counter bits representing the counter, which represent the number of the respective message—is sent. This allows the space required in the message to be reduced from, for example, 128 bits to, for example, 32 bits, for a 32-bit counter.

[0009] A particularly space-efficient approach would be to use an implicit shared initialization vector, where the sender and receiver initially agree on a common starting initialization vector and a rule for generating a novel next initialization vector from the current initialization vector. This rule then generates this next novel initialization vector synchronously for each new message on both sides using the previously agreed rule. The problem with this approach is that messages can be lost or arrive out of order, thereby disrupting the synchronicity of the initialization vectors maintained by the sender and receiver.

[0010] Another equally space-efficient way to implicitly synchronize an initialization vector between sender and receiver would be to securely derive it from the message itself, which must be transmitted anyway. The problem here is that, on the one hand, the initialization vector must be known to the sender before the encryption process and thus derivable from the plaintext message. On the other hand, it must be known to the receiver before the decryption process and thus derivable from the encrypted message, which (at first glance) is a contradictory requirement.

[0011] So-called synthetic initialization vectors (SIVs), which are used in special AEAD procedures ("Authenticated Encryption with Associated Data"), i.e. procedures that enable both encryption and authentication, are characterized by the fact that they generate the initialization vector used for encryption from the message itself by generating a unique authentication stamp (tag) from the message, which is then used as an initialization vector when encrypting the message or parts thereof. AEAD variants based on synthetic initialization vectors have been developed for various AEAD operating modes, e.g., for a combination of CMAC and CTR (SIV-AES), for AES-GCM (AES-GCM-SIV), or for CCM (CCM-SIV) (see also DE 10 2019 113 026 A1).However, since the initialization vector, i.e. the authentication stamp generated from the unencrypted message, is also required for decrypting the message, but cannot be directly derived by the recipient from the encrypted message, it must be sent unencrypted to the recipient together with the encrypted message, which means that no space in the message is saved by using a synthetic initialization vector according to the methods mentioned above.

[0012] In this context, reference can in principle be made to US 2015 / 0349950 A1.

[0013] WO 2009 / 013420 A1 defines a block cipher-based CBC-MAC-like authentication method that calculates the Message Authentication Code (MAC) via the message extended by a prefix containing the hash value of the message, instead of just via the message itself, as is the case with CBC-MAC.

[0014] As mentioned above, the central weakness of ECB mode is the fact that when using the same key, the same plaintext is encrypted into the same ciphertext. Since the problem only exists in the context of using the same key, and a key change essentially resets the problem, a fixed shared symmetric key K is assumed for the remainder of this document.

[0015] The widely held requirement that a new initialization vector be used to encrypt each new plaintext is sufficient, but not absolutely necessary, to address the weakness described above. If it can be ensured that the first block of a plaintext is always new, then the requirement to use a new initialization vector can be dispensed with in operating modes that incorporate the previous block, in particular the previous ciphertext block, when concatenating the blocks (e.g., CBC, CFB). Thus, in certain cases, it is sufficient that the combination of the initialization vector and the first plaintext block is new for a fixed key. If the first plaintext blocks are always new, then in these specific cases the use of an initialization vector can even be dispensed with entirely.

[0016] If, for example, one wants or has to forego a guaranteed novel (explicit or implicit) initialization vector for each plaintext to be encrypted due to space constraints, it makes sense to design the format of the plaintexts in such a way that the probability that the first block of a plaintext is always novel is maximized.

[0017] Because the probability that the individual plaintexts are “novel”, i.e., different in pairs, is greater than the probability that the first blocks of the respective plaintexts are novel, i.e., different in pairs, it makes sense, in order to achieve novel first blocks with the greatest possible probability, to collect the “novelty” of the entire plaintext in the first block, i.e. to design the first blocks of the respective plaintexts in such a way that the first blocks of two different plaintexts are also always different.

[0018] Now, differences between two plaintexts can occur at different positions in the plaintexts depending on the plaintext pair, so the "novelty" can be distributed across all the plaintext bit positions. Thus, in the general case, no plaintext format can be found by simply reordering the respective plaintext bits that guarantees the most likely novel first plaintext blocks. However, the "novelty" contained in the plaintexts can be very well accumulated by applying a cryptographic hash function HASH to a sequence of certain selected bits for which there is a possibility that their combination is novel.If there is a difference in at least one of the bits in two bit sequences BF1 and BF2 belonging to two different plaintexts used to form the hash value, then with a very high probability the hash values ​​HashTag1 := HASH(BF1) and HashTag2 := HASH(BF2) of the two bit sequences containing this different bit will also differ.

[0019] The hash value calculated in this way, HashTag := HASH(BF), could now be used directly as an initialization vector, or an initialization vector could be derived from it, which would always be novel if the plaintext bit sequence BF used in the calculation of the hash value were novel. This is the approach used, for example, with the synthetic initialization vectors (SIV) described above. The problem, as explained above, is that the initialization vector must be known to the recipient in order to decrypt the fully or partially encrypted plaintext.If the initialization vector is not explicitly transmitted unencrypted as part of the plaintext, which is not desirable for reasons of space saving, this would mean that no part of the bit sequence BF, which is used to generate the hash value HashTag, may be encrypted, since otherwise the receiver cannot derive the initialization vector used by the sender during encryption from the received partially or fully encrypted plaintext.

[0020] The object of the present invention is to provide an improved method for encrypting a plaintext with a block cipher using a symmetric key K and to provide the mechanisms required for this purpose.

[0021] According to the invention, this object is achieved by the features of claim 1. Advantageous embodiments emerge from the dependent subclaims. The object is further achieved by the features of claim 12. Here, too, advantageous developments emerge from the dependent subclaims.

[0022] First, a way is needed to encode the entire novelty of a plaintext in the first block of the plaintext, so that any change in the entire plaintext, including the first block, results in a change in the first plaintext block. The inventive method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K according to claim 1 of the invention uses the result of the application of a fingerprint function (FP u) to the concatenation of the complete first u bits of the plaintext and selected or all bits of the remaining plaintext as a substitute for the combination of an initialization vector and the first u bits of the plaintext. The fingerprint function must only satisfy the two requirements that from two unequal bit sequences (BF1 ≠ BF2) it follows with a sufficiently high probability - in the sense defined above - that the fingerprints of the two bit sequences are also unequal (FP u (BF1) ≠ FP u (BF2)), and that the fingerprint function (FP u ) a fingerprint reversal function (FP u -1 ) exists such that FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u].

[0023] Here u and L E not necessarily be the same. For the encryption of the first u bits PB u 1of the plaintext, a general cipher EGen is used which does not require an initialization vector, by FP u , as described, to the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP u (PB u 1 || FPInput). The character || represents the concatenation of two bit sequences. This results in

[0024] CB 1 := EGen(FP (PB u 1 || FPInput)). In principle, it is not necessary that EGen is length-preserving, that CB 1 which is also u bits long, even though in practice it will probably be that way most of the time.

[0025] The encryption of the first u bits of the plaintext CB 1can thus be used as initialization vector IV := CB 1 for the encryption of parts or all of the remaining plaintext with the block cipher E, for which any operating mode requiring an initialization vector (IV) can be used.

[0026] By applying a fingerprint function FP u Before encryption with EGen, it can be advantageously ensured that novel plaintexts with a very high probability also lead to novel inputs for the cipher EGen, which in turn with a very high probability leads to a novel ciphertext CB 1 and thus leads to a novel initialization vector IV. For example, in the case of using the fingerprint function FP Tag,_u,scramble_u as FP u in the calculation of the pseudorandom CB 1 both the first u bits of the plaintext PB u 1 (via Scramble u) as well as the rest of the plaintext (over day u ) are included equally, thus ensuring with a very high probability that the result obtained from the results obtained by Fp Tag,_u, Scramble_u and EGen encrypted first u bits CB 1 derived initialization vector IV is novel if the entire original plaintext is also novel.

[0027] According to a very advantageous embodiment of the solution according to the invention, in order to generate a u-bit long fingerprint of a bit sequence BF whose length is greater than u, the fingerprint is generated as a result of the function FP u (BF) or FP Tag_u, scramble_u (BF), which is called Scramble u (BF[1..u]) ⊕ Day u (BF[u + 1..L(BF)]) is defined, where day uis a function that calculates a unique value of length u for bit sequences (BF) of any length with a sufficiently high probability for the application, e.g. a pseudorandom value of length u, where Scramble u is an invertible function that maps bit sequences (BF) of length u to bit sequences (BF) of length u, and where ⊕ represents a bitwise XOR operation of two bit sequences (BF) of equal length.

[0028] In order to encode the novelty of an entire plaintext in the first u bits of the plaintext and to use this fact for encryption, a function FP u (“Fingerprint”) which, for a bit sequence BF with L(BF) > u (L(BF) denotes in this document the bit length of a bit sequence BF), a bit sequence FP u (BF) of length u such that - from BF1 ≠ BF2 with a sufficiently high probability FP for the application u (BF1) ≠ FPu (BF2) follows, - to FP u an FP inverse function FPu -1 exists, so that FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u], where for a bit sequence BF and natural numbers i, j with 1 ≤ i ≤ j ≤ L(BF) BF[i..j] denotes the subsequence of BF consisting of the bits i to j, for example BF = BF[1..L(BF)], and || denotes the concatenation of two bit or byte sequences.

[0029] The term “with a sufficiently high probability for the application” is to be understood as a probability which, based among other things on the size of u for the given application case for two bit sequences BF1, BF2 with BF1 ≠ BF2, leads with sufficient certainty to the result FP u (BF1) ≠ FP u(BF2). Due to the nature of the function, an exact value cannot be specified here, since the Tag function is concerned with mapping a (u+x)-long bit sequence BF to a u-long bit sequence, so that for two different bit logs BF1, BF2 their tags are "as different as possible", i.e. "if possible" BF1 ≠ BF2 results in Tag(BF1) ≠ Tag(BF2).

[0030] In practice, however, there is no such function Tag that ensures this with 100% certainty for all BF1, BF2, since Tag(BF) is always u bits long and thus shorter than "most" bit sequences BF. For example, if u = 2 is chosen, there are only four different tags: 00, 01, 10, 11. This means that with just five different bit sequences BF1 .. BF5, we would have at least one collision with 100% probability, i.e., a duplication of at least two of the five tags Tag(BF1) ... Tag(BF5). Furthermore, with u = 2 and two randomly selected bit sequences BF1, BF2, the probability of a collision, i.e., for Tag(BF1) = Tag(BF2), would be at least 25%. Thus, the “goodness” (i.e. the quality or the probability for (BF1 ≠ BF2 ⇒ Day(BF1) ≠ Day(BF2)) of a function Day u at most as good as the size of u.

[0031] On the other hand, there are collision-resistant cryptographic hash functions that, as a tag uused and assuming a sufficiently large u, this desired property (BF1 ≠ BF2 ⇒ Tag(BF1) ≠ Tag(BF2)) can be ensured with "almost 100%". However, they cannot ensure it 100% either, see above considerations. However, the probability that (BF1 ≠ BF2 ⇒ Tag(BF1) ≠ Tag(BF2)) is considered to be a tag when collision-resistant cryptographic hash functions are used is considered so large that the security of many cryptographic mechanisms considered secure is based on it. The principle of the aforementioned probability also underlies legally binding digital signatures, etc.

[0032] Now, it may be that a hash function returns a value (hashtag) of, for example, 256 bits, as SHA-256 does. However, the tag function according to the invention wants to use a value of u=20. In this case, the first 20 bits of the hashtag returned by SHA-256 could be used as the tag. This would give us a quality level delivered by SHA-256 that is "almost 100%," but this is then greatly reduced by using u=20. A sensible choice of u and also of the tag function depends on the respective individual case and application. If, for example, one chooses u = 128 and the first 128 bits of the value returned by SHA-256 as the tag, then, according to current knowledge, one is considered "on the safe side" for all applications. However, there may be cases where, for example, u=80 bit is absolutely sufficient for a specific application in practice and thus, with BF1 ≠ BF2, a sufficiently high probability for FP u (BF1) ≠ FP u(BF2) is ensured. If one were to quantify the value of the probability, in practice one would surely choose a u >= 80 in almost all cases and thereby, with a suitable tag, achieve a probability far above (1 - 2 -20 ).

[0033] In this advantageous embodiment of the solution according to the invention, it is proposed for a function FP u that has the general form FPu(BF) or FPTag_,Scramble_u := Scrambleu(B[F1…u]) ⊕ Tagu(BF[u+1…L(BF)]) to be used, where - Tag u is a function that calculates for bit sequences of arbitrary lengths a value of length u that is unique, for example a pseudo-random value, with a probability that is sufficiently high for the application, for example a cryptographic hash function, whose hash value is adjusted to the length u in a secure manner if necessary, i.e., by, for example, in the case of a too long hash value, taking its last u bits as the tag u(BF) can be used or, in the case of a hash value that is too short, it can be stretched to the length u using a cryptographic key stretching procedure. ◯ By choosing the right day u the weak-weak and weak-strong FP collision resistances can be achieved, and the non-reversibility, the strong-weak FP collision resistance and the strong-strong FP collision resistance can be made possible, as will be explained later, - Scramble u is an invertible function that maps bit sequences of length u to bit sequences of length u, for example a length-preserving encryption (with the corresponding decryption as an inverse function), ◯ By choosing Scramble appropriately u can be selected appropriately, the day u-function which, as explained later, only achieves the attacker-related properties of non-reversibility, strong-weak FP collision resistance and strong-strong FP collision resistance. - ⊕ denotes the bitwise XOR operation of two bit sequences of equal length.

[0034] The FP inverse function of Fp Tag_u, Scramble_u is then given by (FP Tag_u, scramble_u ) -1 (BF) = Scramble u -1 (BF[1..u] ⊕ Day u (BF[u + 1..L(BF)]). Has a function FP u the general form described, it is defined by the two functions day u and Scramble u clearly determined.

[0035] Through this fingerprint function FP Tag_u, scramble_u This makes it possible to dispense with the use of an initialization vector in the symmetric encryption of novel plaintexts without any significant loss of security and to encrypt the plaintext completely.

[0036] According to a very advantageous further development, it can be provided that the function day u a cryptographic hash function is used, whose hash value is securely adjusted to the length u.

[0037] Furthermore, in a favorable development of the method according to the invention, it can also be provided that the function day u has the property of non-reversibility and / or is collision-resistant in at least one way.

[0038] The non-reversibility makes it practically impossible for an attacker to find a bit sequence BF2 for a given bit sequence BF1 such that BF1 = FP u (BF2) || BF1 [u+1..L(BF)]. In the sense of this description, an attacker is someone who, in contrast to a “non-attacker”, has the knowledge of the variables used in the definition or determination of FP u does not know the (secret) key that may be used.

[0039] Regarding collision resistance, four different types are conceivable, each of which is referred to here as a two-tuple of the form (r1, r2)∈{strong, weak}×{strong, weak}, where the first element r1 denotes the actual FP collision resistance and the meaning of the second element r2 is based on the collision resistance concepts known from cryptographic hash functions. - [Weak-weak FP collision resistance] It is practically impossible to find, for a given bit sequence BF1, a bit sequence BF2 such that BF1 [1..u] = BF2[1..u], BF1 [u+1..L(BF1)] ≠ BF2[u+1.. L(BF2)] and FP u (BF1) = FP u (BF2). - [strong-weak FP collision resistance] It is practically impossible for an attacker to find, for a given bit sequence BF1, a bit sequence BF2 such that BF1 ≠ BF2 and FP u (BF1) = FP u (BF2). - [Weak-strong FP collision resistance] It is practically impossible to find two bit sequences BF1 and BF2 such that BF1 [1..u] = BF2[1..u], BF1 [u+1..L(BF1)] ≠ BF2[u+1.. L(BF2)] and FP u (BF1) = FP u (BF2). - [strong-strong FP collision resistance] It is practically impossible for an attacker to find two bit sequences BF1 and BF2 such that BF1 ≠ BF2 and FP u (BF1) = FP u (BF2).

[0040] It is clear that non-reversibility and all kinds of collision resistance can only be achieved with a sufficiently large u.

[0041] A very advantageous further development of the procedure can now also provide that the function day u a keyless or key-dependent cryptographic hash function HASH (K_H)is used, where K_H denotes the key on which HASH may depend and the parentheses indicate that HASH may or may not depend on K_H.

[0042] In addition, a very favorable design of the procedure can also provide that the function Scramble u an identity function or a length-preserving encryption function is used, whereby in the case of encryption, the decryption function matching the encryption is used as the inverse function. According to an advantageous development of this, it can further be provided that for a block cipher E with block size L E = u and an L E Bit long symmetric key K_S as the function Scramble u the E-Raw encryption with K_S, i.e. E RAw K_S , is used.

[0043] In an advantageous embodiment, it is further proposed that the encryption thus generated of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 to be used for the encryption of parts or all of the remaining plaintext with the block cipher E, whereby any operating mode requiring an initialization vector can be used for this purpose, and possibly, depending on the length of CB 1 and depending on the selected operating mode, an adaptation of the initialization vector IV to the length of the initialization vector required by the respective operating mode in a safe manner, e.g. at L(CB 1 ) = L E a truncation is made in case of using the IV as nonce of the CTR operating mode.

[0044] According to a further advantageous embodiment of the invention, it is proposed that when encrypting a plaintext with a block cipher E of block size LE using a symmetric key K to use an FP function in the manner described above, i.e. FP Tag_u, scramble_u , where in the general case u ≠ L E can be, and to use a general cipher EGen that does not require an initialization vector, by FP Tag,_u, Scramble_u on the concatenation of the complete first u bits PB u 1 of the plaintext (“Plaintext block”) and selected or all bits FPInput of the remaining plaintext, and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP Tag_u, Scramble_u (PB u 1 || FPInput), i.e. CB 1 := EGen(FP Tag_u, Scramble_u (PB u 1 || FPInput)).

[0045] Since one of the aims of the method is to generate messages that are as short as possible, it is suggested to choose a length-preserving cipher as the general cipher EGen, so that, for example, L(CB 1 ) = u. The ciphertext CB 1 is then with CB u 1 designated.

[0046] When choosing the operating mode for encrypting the remaining plaintext, it is important to assess the extent to which the actual novelty of the calculated initialization vector is ensured. If the novelty of the initialization vector is ensured, e.g., by including a complete, non-repeating counter in the BF bit sequence, then any operating mode that requires a novel initialization vector can be used securely. However, if the novelty of the initialization vector is only ensured depending on the novelty of the plaintext itself, which is not guaranteed, and the novelty of the plaintext is, for example, likely but not certain, then the use of OFB or CTR, but also CFB, is associated with higher risks, and CBC, for example, should be used preferentially.

[0047] This means that in many cases, the use of an initialization vector for encrypting the first block can be dispensed with without any significant security loss. By using the encrypted first block, which is novel for novel plaintexts, as the initialization vector for encrypting the remaining blocks, an operating mode requiring an initialization vector, such as CBC, CFB, OFB, CTR, etc., can be used for encrypting the remaining blocks.

[0048] According to an advantageous development of the method according to the invention, the length of the initialization vector IV is dependent on the selected operating mode and / or dependent on the length of CB 1 adjusted.

[0049] An alternative solution of the method according to the invention according to claim 12 provides for the encryption of a plaintext of the minimum length of u+1 bits with a block cipher E of block size L Eusing a symmetric key K, where the fingerprint function (FP u ) a fingerprint function FPTAg_u,Scramble_u(BF):=Scrambleu(BF[1…u])⊕Tagu(BF[u+1…L(BF)]) is used. Day u a secure key-dependent hash function HASH K_H whose output length is adjusted to u, where Scramble u is an invertible function that maps bit sequences (BF) of length u to bit sequences (BF) of length u, and where ⊕ stands for a bitwise XOR of two bit sequences (BF) of equal length. Here, u and L E not necessarily be the same. Now the fingerprint function Fp Tag_u, Scramble_u on the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext. In the case of ensuring the novelty of the data entered in the tag u -Function of the fingerprint function FPTag_u, Scramble_u incoming bit sequence FPInput is ensured for each new message than the encryption of the first u bits CB u 1 directly to the FP u K_H -Fingerprint is used, and the resulting encryption of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 used to encrypt parts or all of the remaining plaintext with the block cipher E.

[0050] Further advantageous embodiments and various embodiments of the method according to the invention result from the further subclaims dependent on claims 1 and 12 and become clear from the exemplary embodiments which are explained in more detail below with reference to the figures.

[0051] Showing: Fig. 1 A schematic representation of the fingerprint (FP) function and its inverse; Fig.2 the functioning of encryption and decryption using the two general FP functions as a standalone component; Fig. 3 the functionality of encryption and decryption using the FP functions resolved into their components FP Tag,-u, Scramble_u and ( FP Tag,_u, scramble_u ) -1 ; Fig. 4 the functioning of the two FP functions Fp u HASH(K_H), ID (for u = L E ) and FP HASH ( K_H ), E-K_s in summarized form; Fig. 5 the functioning of the encryption and decryption (in the case of FP u HASH(K_H), ID for u = L E and FP HASH(K_H), E-K_S ) once using the two FP functions as a standalone component; Fig. 6 the functioning of the encryption and decryption (in the case of FP u HASH(K_H), ID for u = L E and FP HASH(K_H), E-K_S) once using the two FP functions as FP functions resolved into their components; Fig. 7 and Fig. 8 the operation of an alternative encryption and decryption method; and Fig. 9 a schematic representation of the method of DE 10 2021 001 095 A1 as a supplement to the methods according to the invention.

[0052] A first relevant aspect for the encryption method lies in the method for generating a u-bit long fingerprint (FP u ) of a bit sequence. This serves to encode the novelty of an entire plaintext in the first u bits of the plaintext and to be able to use this fact for encryption. For a natural number u > 0, a function FP u (“Fingerprint”) which, for a bit sequence BF with L(BF) > u (L(BF) denotes in this document the bit length of a bit sequence BF), a bit sequence FP u(BF) of length u such that - from BF1 ≠ BF2 with a very high probability FP u (BF1) ≠ FP u (BF2) follows, - to FP u an FP inverse function FP u -1 exists, so that FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u] applies, where for a bit sequence BF and natural numbers i, j with 1 ≤ i ≤ j ≤ L(BF) BF[i..j] denotes the subsequence of BF consisting of the bits i to j, e.g. BF = BF[1..L(BF)] holds, and || denotes the concatenation of two bit or byte sequences, - optionally the condition of non-reversibility is met, i.e. it is practically impossible for an attacker to find a bit sequence BF2 for a given bit sequence BF1 such that BF1 = FP u (BF2) || BF1 [u+1..L(BF)], - optional FP u is also collision-resistant.

[0053] It is proposed that for a function FP u the general form FPu(BF)=Scrambleu(BF[1…u])⊕TAgu(BF[u+1…L(BF)]) to use, whereby - Day u a function that calculates a unique, e.g. pseudorandom value of length u for bit sequences of any length with a high probability, for example a cryptographic hash function, whose hash value is adapted to the length u in a secure way if necessary, for example by using the last u bits as a tag in the case of a hash value that is too long u (BF) can be used or, in the case of a hash value that is too short, it can be stretched to the length u using a cryptographic key stretching procedure. ◯ By choosing the right day uweak-weak and weak-strong FP collision resistances can be achieved, and non-reversibility, strong-weak FP collision resistance, and strong-strong FP collision resistance can be made possible. - Scramble u is an invertible function that maps bit sequences of length u to bit sequences of length u, for example a length-preserving encryption (with the corresponding decryption as an inverse function), o By choosing Scramble appropriately u can be selected appropriately, the day u -function the attacker-only properties of non-reversibility, strong-weak FP collision resistance and strong-strong FP collision resistance are achieved. - ⊕ denotes the bitwise XOR operation of two bit sequences of equal length.

[0054] The FP inverse function of FP u is then given by FP u-1 (BF) = Scramble u -1 (BF[1..u] ⊕ Day u (BF[u + 1..L(BF)]). Has a function FP u the general form described, it is defined by the two functions day u and Scramble u uniquely determined. The FP function described by these two functions is denoted by FP Tag_u, Scramble_u These are shown in the illustration of the Fig. 1 can be seen in a flow chart.

[0055] For a general cipher EGen (Encryption), the corresponding decryption function DGen (Decryption) and a bit sequence BF, EGen(BF) denotes the result of the encryption of BF with EGen and DGen(BF) denotes the decryption of BF with DGen, so DGen(EGen(BF)) = BF always applies.

[0056] For a block cipher E (Encryption) with the corresponding decryption function D (Decryption) and an initialization vector requiring operating mode OM (“Operation Mode”), E OMK (IV, PT) the result of the E-encryption of the plaintext PT (“Plaintext”) of a OM appropriate length with the key K in operating mode OM using the initialization vector IV and D OM K (IV, CT) the result of the D-decryption of the ciphertext CT of a OM appropriate length with the key K in operating mode OM using the initialization vector IV.

[0057] The proposed encryption method receives several components of a message M P as input and encrypts parts of it with the key K. The following description of the encryption method consists of a description of the components that the method uses, a description of the input formats and a description of the actual method, which uses the components from the parts of the plaintext message M Pa fully or partially encrypted message M C generated.

[0058] Components of the encryption system include: - A general length-preserving secure cipher EGen - A block cipher E of block size L E - E OM , in an initialization vector of length L OM-IV block cipher E operated in the required operating mode OM - A fingerprint function FP u , which is abbreviated as FP below. - An optional post-processing function OM-NB adapted to the OM operating mode, which generates a pseudo-random OM initialization vector from a bit sequence of length u in a secure manner, for example by first symmetrically encrypting the bit sequence and then adapting it to L using established methods. OM-IV is carried out.

[0059] Input formats: - A symmetric key K of length LE - A message M P consisting of a plaintext portion PT to be encrypted and a subsequent associated portion AD (“Associated Data”), i.e. M P = PT || AD, where L(PT) > u, i.e., PT is longer than u. The associated part AD is not encrypted, but it contributes to the formation of the OM initialization vector and thus to its novelty. ◯ The plaintext part PT consists of three parts PB u 1 , PT OM 1 and PT OM 2 , so PT = PB u 1 || PT OM 1 || PT OM 2 , where PB u 1 and PT OM 2 contribute to the formation of the initialization vector and PT OM 1 does not contribute to the formation of the OM initialization vector, with ▪ L(PB u 1 ) = u, PB u , is exactly u bits long and ▪ PTOM 1 || PT OM 2 has one to E OM suitable length so that PT Om 1 || PT OM 2 by E OM can be encrypted. - Two implicit bit sequences that can contribute to increasing the probability of the novelty of the OM initialization vector and are known to both the sender and the receiver and are therefore not part of the message M P are, for example, a counter known to both sides or the hash value or encryption of such a counter. ◯ Bit sequence ImplAD (“implicit additional data”) of any length, which serves as additional input for the fingerprint function FP. ▪ If the use of ImplAD is not desired, the empty bit sequence can be selected as ImplAD. ◯ Bit sequence Impl u the length u with which the FP fingerprint is XORed. ▪ Should the use of Implu be waived, then as Impl u the bit sequence consisting of u 0-bits is selected (the 0-bit is the neutral element with respect to XOR).

[0060] Encryption E FP,EGen, OM, OM-NB with a key K, so E FP,EGen, OM, OM-NB K : - Input: 1. PB u 1 , PT OM 1 , PT OM 2 , AD with M P = PB u 1 || PT OM 1 || PT OM 2 || AD 2. ImplAD, Impl u - Determination of the encrypted portions of M C : 1. FPB := FP(PB u 1 || PT OM 2 || AD || ImplAD) 2. CB u 1 := EGen(FPB ⊕ Impl u ) 3. OM-IV := OM-NB(CB u 1 ) 4. CT OM := E OM K (OM-IV, PT OM 1 || PT OM2 ) - Edition: 1. CB u 1 , CT OM , then M c := CB u 1 || CT OM || AD - In summary, it is proposed to use the encryption M C one from PB u 1 , PT OM 1 PT OM 2 , AD existing plaintext message M P = PB u 1 || PT OM , || PT OM 2 || AD is to be determined as follows: E FP, EGen, OM, OM-NB K (PB u 1 , PT OM 1 PT OM 2 AD, ImplAD, Impl u ) := CB u 1 || E OM K (OM-NB(CB u 1 ), PT OM 1 || PT OM 2 ) with CB u 1 := EGen(FP(PB u 1 || PT OM 2 || AD || ImplAD) ⊕ Impl u)

[0061] Components of the final encryption system include: - The decryption function DGen belonging to the general secure length-preserving cipher EGen - The decryption function D belonging to the block cipher E - The to E OM associated decryption function D OM - FP, OM-NB as in encryption, FP -1 the inverse function to FP

[0062] Input formats: - A symmetric key K as in encryption - A message M C ' consisting of a ciphertext CT' and a subsequent unencrypted associated part AD', i.e. M C ' = CT' || AD', where L(CT') > u. o The ciphertext portion CT' consists of two parts, an encrypted first block CB u 1 ' and a subsequent ciphertext CT OM ', so CT' = CB u 1'|| CT OM ' and M C '= CB u 1 '|| CT OM '|| AD', with ▪ L(CB u 1 ') = u, CB u 1 ' is exactly u bits long and ▪ CT OM ' has one to D OM suitable length so that CT OM ' by D OM can be decrypted. - ImpIAD', Impl u ' as with encryption

[0063] Decryption D FP, DGen, OM, OM-NB with a key K, so D FP, DGen, OM, OM-NB K : - Input: 1. CB u 1 ', CT OM ', AD' with M C ' = CB u 1 ' || CT OM ' || AD' 2. L PT1 Length of the plaintext portion PT OM 1 3. ImplAD', Impl u ' - Determination of the decoded portions of M P ': 1. OM-IV' := OM-NB(CB u 1 ') 2. PT OM ' := D OM K (OM-IV', CT OM ') 3. PT OM 1' := PT OM '[1..L PT1 und PT OM 2 ' := PT OM '[L PT1 +1..L(PT OM ')] 4. PB u 1 ' := FP -1 ((DGen(CB u 1 ') ⊕ Impl u ') || PT OM 2 ' || AD || ImplAD') - Output: 1. PB u 1 ', PT OM ', then it holds that M P ' := PB u 1 ' || PT OM ' || AD'

[0064] In summary, it is proposed to define the decryption M P ' of a ciphertext message consisting of CB u 1 ', CT OM ', AD' as follows: M C ' = CB u 4 ' || CT OM ' || AD' as follows: DFp,DGen,OM,OM−NBK(CBu1',CTOM',AD,LPT1,ImpIAD',IMPIu'):=FP−1((DGen(CBu1')⊕ImpIu')‖PTOM'[LPT1+1…L(PTOM')]‖AD‖ImpIAD')‖PTOM'mit PTOM':=DOMK(OM−NB(CBu1'),CTOM')

[0065] The two Fig. 2 and Fig. 3 show the functionality of the encryption and decryption once using the two general FP functions as independent components and once with the FP functions resolved into their components FP Tag,_u, Scramble_u and (FP Tag,_u, Scramble_u)-1 .

[0066] For the FP subfunction Day uA keyless cryptographic hash function such as SHA-256 or SHA-512 or a key-dependent cryptographic hash function such as HMAC, CBC-MAC, or CMAC can be used as a basis. The use of a keyless cryptographic hash function has the advantage that the one-way property and, if applicable, the weak or strong collision resistance of the cryptographic hash function apply regardless of knowledge of a key, whereas in the case of a key-dependent cryptographic hash function, these properties are not always present when the key is known. The use of a key-dependent cryptographic hash function has the advantage that a potential attacker cannot calculate a hash value from a known bit sequence without knowledge of the key. HMAC or key derivation functions (KDF) combine the two approaches and thus unite the advantages of both classes of hash functions.A keyless cryptographic hash function is denoted here by HASH, a key-dependent cryptographic hash function using the key K_H is denoted by HASH. K_H either a keyless cryptographic hash function or a key-dependent cryptographic hash function using the key K_H is denoted by HASH (K_H) The term day u K_H is used when day u a hash function HASH dependent on a key K_H K_H used as a basis, FP u K_H indicates that the corresponding tag u -function a hash function HASH dependent on a key K_H K_H used as a base. Uses FP u a cryptographic hash function that satisfies the condition of weak (strong) hash collision resistance, as a basis for tag u , so FP uthe property of weak-weak (weak-strong) FP collision resistance. Furthermore, by using a cryptographic hash function as the basis for Tag u the prerequisite for the non-reversibility, the strong-weak or the strong-strong FP collision resistance of FP u created.

[0067] Generates HASH (K_H) a hash value of a length different from u, it is suggested to use the length given by HASH (K_H) generated hash value using a length adjustment function LA u to adapt to u and the resulting composition LA u o HASH (K_H) as day u to be used, where LA u is a function that generates a pseudorandom bit sequence of length u from a pseudorandom bit sequence PZBF of any length using methods known from cryptography, for example, in the case of an output bit sequence PZBF that is too long, the last u bits of PZBF are used as LA u(PZBF) can be used or, in the case of a PZBF bit sequence that is too short, it can be stretched to the length u using a key stretching method, for example.

[0068] It is further proposed that the Scramble function u the identity function ID, which leaves the bit sequence unchanged, which means that a scramble u -function. The inverse function of the identity function is the identity function ID itself. This particularly simple variant of Scramble u leads in turn to a simple FP u -function that can be used advantageously if, for example, the non-reversibility of the FP u -function and the strong-weak or strong-strong FP collision resistances are not required.

[0069] For a keyless or key-dependent cryptographic hash function HASH (K_H) denotes FP u HASH(K_H), ID the HASH (K_H) as day u-function and the identity function ID as scramble u -function using FP u -function, whereby the application of a corresponding length adjustment function LA u is accepted. FP u HASH(K_H), ID thus forms the HASH (K_H) -Hash value of the bits of the plaintext lying outside the first plaintext block and adds this after a length adjustment by LA u via ⊕ to the unchanged first u bits of the plaintext block. FP u HASH(K_H), ID is weak-weak or weak-strong FP collision resistant if HASH (K_H) which in turn is weakly or strongly resistant to collisions.

[0070] However, there may be situations in which the non-reversibility of the FP u -function and / or its strong-weak and / or strong-strong FP collision resistance are advantageous. For example, in such a case, it is proposed to use the Scramble function uto use a length-preserving encryption. Note that this encryption does not necessarily have to be strong, since the result of scramble u not disclosed but further encrypted with EGen, the strengths of the attacker-related properties of the corresponding FP u - Function but directly depends on the strength of the scramble used u -Encryption depend.

[0071] In case of u = L E for a block cipher E, the E RAW -Encryption can be advantageously used as a length-preserving encryption that cannot be computed or reversed by the attacker and does not require an initialization vector. If u is equal to the block size of a symmetric cipher E, then u = L E , it is suggested to use the function Scramble u to use E-Raw encryption, i.e. Scramble u := E RAW K_Sfor a symmetric key K_S. The inverse function to E RAW K_S is the corresponding decryption function D RAW K_S By using E-Raw encryption as scramble u while simultaneously using a cryptographic hash function HASH (K_H) as day u the properties of the non-reversibility of the FP, which are only related to the attacker, are also u -function, the strong-weak FP collision resistance or the strong-strong FP collision resistance.

[0072] For a keyless or key-dependent cryptographic hash function HASH (K_H) and a block cipher E with a matching symmetric key K_S denotes FP HASH(K_H), E-K_S the HASH (K_H) as day u -Function and E RAW K_S as a scramble u -function using FP u -function, where u = L Eand the application of a corresponding length adjustment function LA L_E is accepted. FP HASH(K_H), E-K_S thus forms the HASH (K_H) -Hash value of the bits of the plaintext lying outside the first plaintext block and adds this after a length adjustment by LA L_E via ⊕ to the E-Raw encryption of the first plaintext block. FP HASH(K_H), E-K_S has the property of non-reversibility and is strong-weak or strong-strong FP collision resistant if HASH (K_H) is weakly or strongly collision-resistant.

[0073] The Fig. 4 shows in summary form the functionality of the two FP functions FP u HASH(K_H), ID (for u = L E ) and FP HASH(K_H), E-K_S , where FP HASH(K_H), (E-K_S) stands for both of these FP functions, (E RAW K_S ) the identity function ID or the E-Raw encryption E RAW K_S and (D RAW K_S) the identity function ID or the E-Raw decryption D RAW K_S designated.

[0074] In the encryption method described above, e.g. E FP, EGen, OM, OM-NB K , as FP functions FP u HASH(K_H), ID or FP HASH(K_H), E-K_S be used.

[0075] The two Fig. 5 and Fig. 6 show the functionality of the encryption and decryption (for u = L E ) once using the two FP functions as independent components and once with the FP functions resolved into their components.

[0076] A further advantageous embodiment of the encryption method according to the invention described above, for example the method E FP,EGen, OM, OM-NB , consists in using as a general cipher EGen the E-Raw encryption of a block cipher E of block size L E = u using a symmetric L E Bit long key K, i.e. ERAw K , to use.

[0077] By using E RAW K as EGen, the encryption M C one from PB 1 , PT OM 1 , PT OM 2 , AD existing plaintext message M P = PB 1 || PT OM 1 || PT OM 2 || AD with L(PB 1 ) = L E depending on the two implicit bit sequences ImplAD and Impl that do not belong to the message u be defined as follows: EFp,E−Raw,OM,OM−NBK(PB1,PTOM1,PTOM2,AD,ImpIAD,IMPIu):=CB1‖EOMK(OM−NB(CB1),PTOM1‖PTOM2)with CB1:=ERAWK(FP(PB1‖PTOM2‖AD‖ImpIAD)⊕ImpIu) and the decryption M P ' one from CB 1' , CT OM' 'AD' existing ciphertext message M C ' = CB 1 ' || CT OM' || AD' with L(CB 1 ') = L E depending on L PT1and the two implicit bit sequences ImplAD' and Impl that do not belong to the message u ' can be defined as follows: DFp,D−Raw,OM,OM−NBK(CB1',CTOM',AD',LPT1,ImpIAD',IMPIu'):=FP−1((DRAWK(CB1')⊕ImpIu')‖PTOM'[LPT1+1…L(PTOM')]‖AD‖ImpIAD')‖PTOM'with PTOM':=DOMK(OM−NB(CBu1'),CTOM')

[0078] If a secure key-dependent hash function HASH is used for any sufficiently large u K_H . e.g. a secure key derivation function using the key K_H as the basis for the tag u K_H -function of an FP function FP u K_H used, it is not possible for an attacker to determine the value Tag for a given bit sequence BF without knowing the key K_H u K_H (BF). In addition, it is ensured that the data used to calculate the value u K_H(BF) incoming bit sequence BF is new for each new message, then the one with the help of tag u K_H calculated value day u K_H (BF) is also new for each new message. If these two conditions are met, the u-bit fingerprint, which is obtained by XORing the u-bit result of applying a scramble u -function on the first u bits of the plaintext with the also u bit long (novel and secret) value Tag u K_H (BF) results when encrypting the first u bits of the plaintext with the u bit long novel key Tag u K_H (BF) can be viewed.

[0079] It is therefore proposed that, in the case of ensuring the novelty of the data entered into the u -Function of the fingerprint function FP u incoming bit sequence for each new message a secure key-dependent hash function HASH K_Has a basis for the day u K_H -function of an FP function FP u K_H to use, to dispense with the additional encryption of the first u bits of the plaintext using EGen and instead to use as the encryption of the first u bits CB u 1 directly the FP u K_H -Fingerprint, for example in the case of the encryption method E described above FP, EGen, OM, OM-NB as CB u 1 the value FP u K_H (PB u 1 || PT OM 2 || AD || ImplAD), i.e. CB u 1 := FP u K_H (PB u 1 || PT OM 2 || AD || ImplAD). The one from E FP, EGen, OM, OM-NB The encryption method derived in this way is called E FP-K_H, OM, OM-NB The following two Fig. 7 and Fig.8 show the operation of such a procedure. The use of the implicit value Impl u be dispensed with, since the novelty of CB u 1 already due to the novelty of (PT OM 2 || AD || ImplAD) is ensured. Please note that when using E FP-K_H, OM, OM-NB for the encryption of the first u bits only the key K_H is used and in particular the key K is not used. Note also that the method does not have any special requirements for the scramble u -Function of FP u K_H presents.

[0080] The proposed method allows for a certain weak integrity check of the received message. This is because the cryptographic hash function HASH (K_H) generated hash value in the encryption of the first plaintext block PB 1and is "subtracted" from it during decryption. Thus, every change to the encrypted message M C ', i.e. the ciphertext CT' or the additional data AD', especially regardless of the block in which this change took place, leads to a deviation of the first plaintext block PB obtained during decryption 1 ' from the original plaintext block PB 1 (which does not apply to the other parts of the message, especially to other blocks of the ciphertext CT', in this generality). Therefore, it is proposed to design the format of the plaintext PT in such a way that the first plaintext block PB 1Contains information that is as predictable as possible, i.e., contains little entropy, especially obeys strong consistency rules, and thus has the maximum possible redundancy, thus increasing the chance that the recipient can detect a change in the first plaintext block with a high degree of probability through consistency checks, e.g., during parsing. If the recipient determines after decryption that one of the consistency rules has been violated, he can recognize that the message M C ' has been tampered with and, if necessary, initiate exception handling. Examples of such redundant information could be the receiver ID, the sender ID, the protocol version used, etc.

[0081] In some operating modes, e.g., CBC, only complete plaintext blocks can be encrypted. If the last plaintext block is incomplete, a padding method is used to fill it in. If padding is used and the plaintext is of a fixed length known to both the sender and the receiver, which is often the case with short datagram-like messages, it is suggested that the unused padding bits, the number of which is L pad in this case is the same for each plaintext, to a fixed position of the first plaintext block PB 1 , e.g. at the end of it, and extend the rest of the plaintext accordingly by L pad Bits towards the end of the plaintext. In this way, the last plaintext lock becomes complete, no padding is necessary, but the length of the encrypted plaintext CT does not change. It is further proposed to add the resulting block to the first plaintext block PB 1added bits to strengthen the authentication of the message by using this L pad Bits are assigned a value PAD that can be verified by the receiver, e.g. a fixed value, e.g. a sequence of 0 bits, or with a value that can be derived from the plaintext message, e.g. the last L pad Bits of the using HASH K_H The hash value of the original complete plaintext message, i.e., the complete plaintext message without the inserted PAD bits. After decryption, it can then be determined whether the PAD' value of the bit sequence at the known position in the decrypted message corresponds to the expected PAD value, which is known to the recipient or is derived from the decrypted message after the PAD' bits have been removed. If this is not the case, it can be assumed that the message has been tampered with.

[0082] A disadvantage of the proposed encryption method is that the first plaintext block is only decrypted at the end of the decryption process, and thus the information contained in it can only be used after the end of the complete decryption process. On the other hand, this block must be transmitted first, because without it, the decryption of the rest of the ciphertext is not possible. Thus, the PB in the first transmitted plaintext block 1The information contained in the plaintext block can only be used after the decryption process has been completed. This can be a disadvantage, but one that should not be significant given the short messages involved. To further mitigate this disadvantage, the first block should, if possible, contain information that is not needed during the decryption process. Thus, the selection of the information belonging to the first plaintext block is determined by two potentially conflicting requirements: the requirement of "minimal entropy" and the requirement of "non-urgent use."

[0083] As indicated several times above, when using a possibly non-novel initialization vector, the CBC operating mode is in many situations more secure than, for example, the length-preserving CFB, OFB, and CTR operating modes. This is because an initialization vector repeatedly used in the CBC operating mode generally does not lead to the disclosure of the ciphertext, which is the case, for example, with CTR in common, frequently occurring constellations. Therefore, it is advisable to use the OM of the block cipher E CBC as the operating mode for the proposed method, which can increase the probability of the novelty of an initialization vector but does not generally guarantee it. The major disadvantage of the classic CBC operating mode, however, is that it can only encrypt entire blocks. Incomplete blocks must be completed with padding, which has an adverse effect on the length of the generated ciphertext and thus the length of the message to be transmitted.

[0084] However, the CBC mode can be combined with the CTS mode (“Ciphertext Stealing”) in a known manner, whereby a ciphertext length equal to the plaintext length is achieved even when using the CBC mode. The CTS mode can only be used for plaintexts that are longer than the block size of the block cipher E used, i.e., longer than L. E , are, apply. If the length of the plaintext to be encrypted PT is greater than L E , the described encryption method can be combined with the CBC-CTS mode. The use of CBC makes the described method robust against potentially non-novel initialization vectors, while the use of CTS ensures that the length of the ciphertext does not exceed the length of the plaintext. Therefore, it is proposed to use the CBC-CTS operating mode as the operating mode OM in the described method.

[0085] In some situations, it is useful to encrypt the transmitted initialization vector, for example, to make it more difficult for an attacker to analyze the intercepted messages. It is suggested to encrypt the M message before sending it. C the first block CB 1 to encrypt it again, so instead of e.g. the message M C = CB 1 || CT OM || AD the message M CC = CCB 1 || CT OM || AD to be sent, where CCB 1 := E RAX K_IV (CB 1 ) for a secret symmetric key K_IV of bit length L, known to both the sender and the receiver E . After receiving the message M CC ' = CCB 1 ' || CT OM ' || AD' is the first block CCB 1 ' decrypted with K_IV, so CB 1 ':= D RAW K_IV (CCB 1 ') and then the message M C ':= CB 1' || CT OM ' || AD' is decrypted using the procedure described above.

[0086] DE 10 2021 001 095 A1 proposes a counter-based method for detecting failed and replayed short messages and for protecting against replay attacks. In particular, it is proposed that the sender (S) and the receiver (E) maintain a synchronous counter of fixed bit length S.TotalCounter and E.TotalCounter, respectively, which is incremented by one upon sending or receiving each new message M, and that this counter be divided into two parts of fixed bit lengths: a body counter BodyCounter and a subsequent transmission counter TransmitCounter, such that S.TotalCounter = S.BodyCounter || S.TransmitCounter and E.TotalCounter = E.BodyCounter || E.TransmitCounter, where the bit length of the TransmitCounter is denoted by TransmitCounterLength. Furthermore, it is proposed to transmit only the transfer counter part with each message M as M.TransferCounter and to calculate the total counter E.TotalCounter on the receiver side from E according to the method described in DE 10 2021 001 095 A1.BodyCounter and M'.TransferCounter to be reconstructed. (cf. . Fig. 9)

[0087] If a certain portion of the message M containing the M.TransferCounter is to be encrypted, it is obvious that in order to obtain a new initialization vector for each message but still save space in the message, the total counter S.TotalCounter can be used to form the initialization vector, e.g., to derive a pseudorandom initialization vector from S.TotalCounter in a secure way, e.g., by using the one block size long value S.IV := LA(HASH (K_H) (S.TotalCounter)) is used by the sender as the initialization vector for encryption. If the sender sends the S.TransmissionCounter as part of the message M, i.e. as M.TransmissionCounter, the receiver can, after receiving the message, use the initialization vector used in encryption as E.IV := LA(HASH (K_H)(E.BodyCounter || M'.TransmissionCounter)) can be reconstructed, since S.BodyCounter = E.BodyCounter is implicitly present on both sides. However, this approach only works if M.TransmissionCounter is transmitted in plaintext. However, if M.TransmissionCounter is to be transmitted encrypted, the conventional approach no longer works, since in this case the recipient cannot immediately obtain the value of the transmission counter from the message, especially not before M' has been decrypted.

[0088] In this case, the method proposed in this document can be used advantageously because it ensures that the combination of the initialization vector with the first block of the plaintext to be encrypted is highly likely to be novel, M.TransmissionCounter is transmitted as part of the encrypted portion of the message M, and yet the sender can still decrypt the ciphertext CT. For this purpose, S.TransmissionCounter is included in the first plaintext block PB 1 of the message M, which is due to the fact that in practice the transfer counter length is always < L E should always be possible, and from the counter part S.RumpfZähler = E.RumpfZähler known to both sides, in a safe way, e.g. with S.Impl u := LA(HASH K_H (S.BodyCounter)), a pseudorandom value for S.Impl u which, in combination with the first plaintext block PB containing the S.ÜbertrZähler1 forms a unique, especially novel, combination. Finally, the message M is encrypted according to the proposed method with a symmetric key K using S.Impl u encrypted. The novelty of the total counter S.TotalCounter = S.BodyCounter || S.TransactionCounter guarantees that the combination of the value S.Impl derived from S.BodyCounter u and the first plaintext block PB containing the counter part S.ÜbertrZähler 1 is very likely to be unique, i.e. novel.

Claims

[1] Method for encrypting a plaintext with a block cipher E of block size L E using a symmetric key K, characterized by , that a fingerprint function (FP u ) is used, which satisfies the two requirements that from two unequal bit sequences (BF1 ≠ BF2) with a sufficiently high probability for the application, it follows that the results of the application of the fingerprint function (FP u ) on these bit sequences are unequal (FP u (BF1) ≠ FP u (BF2)), and that to the fingerprint function (FP u ) a fingerprint reversal function (FP u -1 ) exists, so that the following always applies: FP u -1 (FP u (BF) || BF[u+1..L(BF)]) = BF[1..u], where u and L Edo not necessarily have to be equal, and a general cipher EGen is used by applying the fingerprint function to the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPlnput of the remaining plaintext, and then the first block of the ciphertext CB 1 by EGen encryption of the u-bit long result FP u (PB u 1 || FPInput), i.e. CB 1 := EGen(FP u (PB u 1 || FPlnput)), and the resulting encryption of the first u bits of the plaintext CB 1 as initialization vector IV := CB 1 for the encryption of parts of the or of the remaining plaintext with the block cipher E, using any operating mode requiring an initialization vector (IV). [2] Method according to claim 1, characterized by , that as fingerprint function FP u a fingerprint function FP Tag_u, Scramble_u (BF) := Scramble u (BF[1..u]) ⊕ Day u (BF[u + 1..L(BF)]) is used, where day u is a function that calculates a unique value of length u for bit sequences BF of any length with a probability sufficiently high for the intended application, where Scramble u is an invertible function that maps bit sequences (BF) of length u to bit sequences (BF) of length u, and where ⊕ stands for a bitwise XOR operation of two bit sequences (BF) of equal length. [3] Method according to claim 2, characterized by that as the function day u a cryptographic hash function is used, whose hash value is securely adjusted to the length u. [4] Method according to claim 2 or 3, characterized by that the function Tag uhas the property of non-reversibility and / or is collision-resistant in at least one way. [5] Method according to one of claims 2 to 4, characterized by that as the function day u a keyless or key-dependent cryptographic hash function HASH (K_H) is used. [6] Method according to one of claims 1 to 5, characterized by , that the encryption M C one from PB u 1 , PT OM 1 , PT OM 2 , AD existing plaintext message M P = PB u 1 || PT OM 1 || PT OM 2 || AD depending on the two implicit bit sequences ImplAD and Impl that do not belong to the message u using a general length-preserving cipher EGen and a block cipher E is defined as follows: EFp,EGen,OM,OM−NBK(PBu1,PTOM2,AD,ImpIAD,IMPIu):=CBu1‖EOMK(OM−NB(CBu1),PTOM2‖PTOM2)with CBu1:=EGen(FP(PBu1‖PTOM2‖AD‖ImpIAD)⊕ImpIu) and the decryption M P ' one from CB u 1 ', CT OM ', AD' existing ciphertext message M C ' = CB u 1 ' || CT OM ' || AD' depending on the two implicit bit sequences not belonging to the message ImpIAD' and Impl u ' is defined as follows: DFp,DGen,OM−NBK(CBu1',CTOM',AD',LPT1',IMPIu'):=FP−1((DGen(CBu1')⊕ImpIu')‖PTOM'[LPT1+1…(PTOM')]‖AD‖IMPIAD')‖PTOM'with PTOM':=DOMK(OM−Nb(CBu1'),CTOM') [7] Method according to one of claims 1 to 6, characterized by that the encryption procedure uses the fingerprint function FP u one of the fingerprint functions FP u HASH(K_H), ID or FP HASH(K_H), E-K_S is used. [8] Method according to one of claims 1 to 7 characterized bythat in the encryption method, the general cipher EGen is the E-Raw encryption of a block cipher E of block size L E = u using a symmetric L E Bit long key K, i.e. E RAW K , is used. [9] Method according to one of claims 6 to 8, characterized by , that the encryption M C one from PB 1 , PT OM 1 , PT OM 2 , AD existing plaintext message M P = PB 1 || PT OM 1 || PT OM 2 || AD with L(PB 1 ) = L E depending on the two implicit bit sequences ImplAD and Impl that do not belong to the message u using a block cipher E with block size L E = u is defined as follows: EFp,E−Raw,OM,OM−NBK(PB1,PTOM1,PTOM2AD,ImpIAD,IMPIu):=CBu1‖EOMK(OM−NB(CBu1),PTOM1‖PTOM2)with CB1:=ERAWK(FP(FB1‖PTOM2‖AD‖ImpIAD)⊕ImpIu) and the decryption M P ' one from CB 1 ', CT OM ', AD' existing ciphertext message M C ' = CB 1 ' || CT OM ' || AD' with L(CB 1 ') = L E depending on L PT1 and the two implicit bit sequences ImplAD' and Impl that do not belong to the message u ' using a block cipher E with block size L E = u is defined as follows: DFp,D−Raw,OM,OM−NBK(CB1',CTOM',AD,LPT1,ImpIAD',IMPIu'):=FP−1((DRAWK)(CB1')⊕ImpIu')‖PTOM'[LPT1+1…L(PTOM')]‖AD‖ImpIAD')‖PTOM'mit PTOM':=DOMK(OM−NB(CBu1'),CTOM'). [10] Method according to claim 8 or 9, characterized bythat the CBC operating mode is used as the operating mode OM, the padding of the blocks outside the first block is omitted and instead the CTS operating mode is used in combination with the CBC operating mode. [11] Method according to one of claims 1 to 10, characterized by that if L(CB 1 ) = L E , before sending the message M C the first block CB 1 is encrypted again. [12] Method for encrypting a plaintext of at least u+1 bits with a block cipher E of block size L E using a symmetric key K, characterized by that as a fingerprint function (FP u ) a fingerprint function FP Tag_u, Scramble_u (BF) := Scramble u (BF[1..u]) ⊕ Day u (BF[u + 1..L(BF)]) is used, where day u through a secure key-dependent hash function HASH K_Hwhose output length is adapted to u, where Scramble u is an invertible function that maps bit sequences (BF) of length u to bit sequences (BF) of length u, and where ⊕ stands for a bitwise XOR of two bit sequences (BF) of equal length, where u and L E do not necessarily have to be the same, by using the fingerprint function FP Tag_u, Scramble_u on the concatenation of the complete first u bits PB u 1 of the plaintext and selected or all bits FPInput of the remaining plaintext, in case of ensuring the novelty of the data entered in the tag u -Function of the fingerprint function FP Tag_u, Scrambie_u incoming bit sequence FPInput is ensured for each new message than the encryption of the first u bits CB u 1 directly to the FP u K_H -Fingerprint is used, and the resulting encryption of the first u bits of the plaintext CB 1as initialization vector IV := CB 1 used to encrypt parts or all of the remaining plaintext with the block cipher E. [13] Method according to one of claims 1 to 12 characterized by that the format of the plaintext PT is designed so that the first plaintext block PB 1 contains information that is as predictable as possible, in particular obeying strong consistency rules and having the maximum possible redundancy, compliance with these consistency rules is checked by the recipient after the message has been decrypted, and if a violation of one of the consistency rules is detected, exception handling is initiated. [14] Method according to one of claims 1 to 13, characterized by that as the function Scramble uan identity function or a length-preserving encryption function is used, whereby in the case of encryption the decryption function matching the encryption is used as the inverse function. [15] Method according to claim 14, characterized by that for a block cipher E with block size L E = u and an L E Bit long symmetric key K_S as the function Scramble u the E-Raw encryption with K_S, i.e. E RAW K_S, is used. [16] Method according to one of claims 14 or 15, characterized by that the length of the initialization vector IV depends on the selected operating mode and / or on the length of CB 1 is adjusted.

Images