White-box cryptographic keys

Abstract

The invention relates to a method (100) for generating a cryptographic key, which is executed by computer processing means and in which steps (20) of generating matrices in accordance with a McEliece cryptosystem are carried out, the computer processing means then further executing at least two of the following three combination steps (40): - combining one random encoding matrix with the merged permutation, coding and transformation matrix to form an encoded permutation, coding and transformation matrix; - combining another random encoding matrix with the permutation cancellation matrix to form an encoded permutation cancellation matrix; and - combining another random encoding matrix with the transformation cancellation matrix to form an encoded transformation cancellation matrix.

Description

White box cryptographic keys

[0001] The invention relates to white-box cryptography.

[0002] White-box cryptography is a subject of study based on the premise that an attacker, who seeks to identify secret, encrypted data that can be decrypted using an encryption algorithm, has full access to the algorithm's execution platform and to the software implementation of this algorithm in the platform: the binary code is thus entirely visible, it is modifiable, and the attacker can also act at will on the software execution through the various systems of the platform such as memory, calls to processors, etc. The most classic example is that of an attacker having access to a third-party smartphone, in which a software application on the smartphone encrypts or decrypts secret data using an encryption key and a cryptographic algorithm, for example of the "AES" type (for "Advanced Encryption Standard").The attacker has full power over the smartphone and the algorithm, and can thus seek to read the corresponding binary code, modify it, execute it in a specific manner, with the ultimate objective, knowing the type of algorithm used, of identifying the encryption key, decrypting the secret data, and / or modifying this data.

[0003] To prevent this attacker from accessing secret data and to protect the integrity of the encryption in this white box context, a method is known in the state of the art that consists of encoding elementary operations of the encryption (or decryption) algorithm. Indeed, an elementary operation, resulting from the combination between a known type of algorithm and a specific encryption key, is generally implemented in the form of a truth table indicating the possible results of the operation depending on the input data. An encoding operation therefore consists of applying a random transformation to an elementary operation in order to make this operation unreadable. To encode an operation, a substitution of the elements of the truth table can be carried out, by combining the initial table with a random substitution table, so as to obtain an "obfuscated" or "merged" table.Alternatively, a linear transformation can be applied to the operation by combining a vector representing the output data, or a matrix corresponding to the operation, with another matrix, called an encoding matrix, which is also random. An encoding can also be a combination of one or more substitutions and one or more encoding matrices. Other types of encoding are possible. In addition, each elementary operation following an encoded elementary operation is itself combined with a so-called "inverse" encoding, or decoding, corresponding inversely to the previous encoding. This is, for example, the inverse substitution table or the inverse matrix corresponding to the previous encoding, so that the initially planned algorithm is not modified by successive encodings.In all cases, only the truth tables resulting from these encoding operations merged with the elementary operations, i.e. the so-called "obfuscated" or "merged" tables, are stored in the software memory implementing the algorithm. In this way, the attacker, having access only to the obfuscated tables, cannot identify which elementary operation is associated with each table and therefore cannot determine the cryptographic key used and decrypt the secret data.

[0004] These encodings, which allow an encryption (and / or decryption) algorithm to be encoded within an unsecured execution platform, for example within a smartphone, are called "internal", since they make it possible to make the encryption key used within the white box formed by the implemented algorithm unreadable.

[0005] However, this white box generally communicates on the one hand with a server located remotely, and on the other hand with a third-party application located on the same platform. For example, it is common for a server to encrypt data and communicate the encrypted data to the smartphone, then for the white box, that is to say the decryption algorithm executed by the smartphone, to be used to decrypt the data before this decrypted data is communicated within the same smartphone to a third-party application, called "final", which is intended to use the decrypted data. However, the final applications are developed by third-party companies, independently of the white boxes.These companies therefore acquire white boxes marketed in the form of software libraries containing the encryption and decryption algorithm, and an API (for "Application Programming Interface") allowing the algorithm to be controlled and the data output from this algorithm to be used in the final application developed. In this context, the "internal" encodings within the white box do not prevent the decrypted data from circulating, in clear text, between the white box and the final application. Similarly, even if the cryptographic key used is now very difficult to identify within the white box thanks to the internal encodings installed in this white box, the attacker can attempt to port the code, that is to say, export the entire code from the white box to another device to exploit it there without having to identify the key.

[0006] This is why it is known in the state of the art to implement, in addition to these internal encodings, so-called "external" encodings, placed at the ends of the complete communication channel between the sending of the data and their use. For example, first of all within the remotely located server, a first "external" encoding is applied to the last truth table of the server's encryption algorithm, whether in the form of a substitution table, an encoding matrix or another form of random encoding, so that the data to be communicated to the smartphone is not only encrypted as intended, but also encoded before being communicated to the smartphone. Then, at the input of the white box, the inverse encoding of the outer encoding is applied to the first truth table of the decryption algorithm, before the data is processed through the white box decryption algorithm and its inner encodings.The inverse encoding, which is the decoding of the first external encoding, is therefore part of the white box. Then, a new random encoding is done at the output of the white box, by applying this new encoding to the last truth table of the white box. Here too, this second encoding is therefore part of the white box. At the output, the data is therefore decrypted, but again encoded this time using this new random encoding, before being communicated to the final third-party application intended to use it. Finally, within this third-party application, the external encoding corresponding to the inverse of the encoding applied at the end of the white box allows the data to be decoded within the application before it is used by the application.

[0007] Thanks to these external encodings placed outside the white box, even once decrypted, the data does not circulate "in clear" outside the white box, it remains encoded, therefore protected from manipulation by an attacker who would like to intercept it. In addition, the attack consisting of porting the entire white box code to another device does not work, since in this context the white box code includes within it an encoding at its input and an encoding at its output. Without the corresponding reverse encodings, which are located remotely (within the server and within the final application), it is not possible to find the data in clear. Moreover, added to the internal encodings, these external encodings associated with encodings at the output and input of the white box make it even more difficult to identify the encryption key of the white box.

[0008] It should be noted that all of these encodings, both internal and external, are random, that is to say they use transformations, substitutions or other manipulations unknown to all, so that no attacker can find them.

[0009] However, this system still has at least two drawbacks.

[0010] First of all, while the white box of the end user's terminal is encrypted, this is generally not the case for the cryptographic algorithm located on the remote server. Indeed, unlike the user's end terminal, which is mobile and easily accessible, the server is supposed to be a secure environment. In order not to increase its computing times, the server's encryption and decryption algorithm therefore generally does not include internal encoding, but only output encoding. Thus, if this algorithm were to leak, and particularly if the output encoding is not sufficiently protected, the elementary operations and therefore the encryption and decryption keys used would become identifiable by an attacker. However, in the context of symmetric encryption such as AES, the same key is used to decrypt and decrypt data.The user's key, encoded in the white box on their terminal, would therefore be identified because of the leak of the unencoded algorithm on the remote server.

[0011] Furthermore, current white-box algorithms are not considered robust enough against future quantum attacks.

[0012] The invention aims in particular to improve the integrity of cryptographic keys in white box cryptography processes.

[0013] Another goal is to anticipate future quantum attacks.

[0014] To this end, the invention relates to a method for generating a cryptographic key, implemented by computer calculation means, in which the following steps are carried out:

[0015] - generation of a permutation matrix, a coding matrix and a linear transformation matrix, the three matrices being consistent with a McEliece cryptosystem;

[0016] - generating an inverse permutation cancellation matrix of the permutation matrix, an inverse coding cancellation matrix of the coding matrix, and an inverse transformation cancellation matrix of the linear transformation matrix, the three cancellation matrices being consistent with the McEliece cryptosystem;

[0017] - combination of the permutation matrix with the coding matrix and with the linear transformation matrix, to form a merged permutation, coding and transformation matrix conforming to the McEliece cryptosystem,

[0018] the computer computing means further implementing a step of generating at least two random encoding matrices, the computer computing means further implementing at least two of the following three combination steps:

[0019] - combining one of the random encoding matrices with the merged permutation, encoding and transformation matrix, to form an encoded permutation, encoding and transformation matrix,

[0020] - combining one of the other random encoding matrices with the permutation cancellation matrix to form an encoded permutation cancellation matrix,

[0021] - combining one of the other random encoding matrices with the transformation cancellation matrix to form an encoded transformation cancellation matrix.

[0022] Thus, the encoded permutation, encoding, and transformation matrix hides the public key consistent with the McEliece cryptosystem, which is initially formed from the merged permutation, encoding, and transformation matrix. The encoded permutation cancellation matrix and the encoded transformation cancellation matrix each hide a private key of the McEliece cryptosystem, the permutation cancellation matrix and the transformation cancellation matrix, respectively.

[0023] By generating at least two of these three encodings, the integrity of the data to be encrypted or decrypted is protected. Indeed, even if the merged permutation, coding, and transformation matrix is ​​not encoded and is made accessible to an attacker, and even if the attacker accesses the coding matrix, it is not possible for this attacker to deduce the permutation cancellation matrix or the transformation cancellation matrix because they are both encoded. Alternatively, if the merged permutation, coding, and transformation matrix is ​​indeed encoded, but one of the two cancellation matrices is not encoded and is made accessible to an attacker, it is not possible for the latter to deduce the other cancellation matrix.Thus, with at least two of the three encodings, and even if the encoding cancellation matrix is ​​accessible, it is not possible for an attacker to simultaneously have all three cancellation matrices, i.e., all the private keys. This protects cryptographic keys in particular in the event of a leak on the server, because the latter only includes the public key, i.e., the merged matrix of permutation, encoding, and transformation. The protection of white-box cryptographic keys is therefore improved.

[0024] Furthermore, these permutation, coding, and transformation operations consistent with the McEliece cryptosystem are known to be robust against future quantum attacks. This key generation method therefore provides a cryptosystem robust to future quantum attacks while protecting the integrity of cryptographic keys, even in the event of a leak on the server.

[0025] Advantageously, the computer calculation means implement the three combination steps.

[0026] Thus, the security of the encryption is enhanced by encoding all three matrices instead of just two of them. In other words, the public key of the McEliece cryptosystem, corresponding to the merged permutation, coding, and transformation matrix, is hidden since this matrix is ​​encoded, as are two of the private keys, i.e., the permutation cancellation matrix and the transformation cancellation matrix, which are encoded. Even if the attacker were able to decode one of these three encoded matrices, this would not allow him to obtain all the private keys. Therefore, an attacker would have to decode two of the three encoded matrices to obtain all the private keys.

[0027] Preferably, for each generated random encoding matrix, the calculation means implement a step of determining a corresponding inverse encoding matrix of said random encoding matrix, so that a sequence of data encoded by said random encoding matrix is ​​decoded by the corresponding inverse encoding matrix and vice versa.

[0028] Thus, the encryption algorithm is not disturbed by encodings, since inverse encodings are provided. Like encodings, inverse encodings allow operations or data sequences to be hidden. Interception of an encoded data sequence before its decoding by a corresponding inverse encoding matrix does not allow the attacker to identify the data sequence or the encoded operation concerning the data sequence.

[0029] Advantageously, the computer calculation means also implement at least two of the following three integration steps:

[0030] - integration, within an application for encryption server, of the encoded permutation, coding and transformation matrix;

[0031] - integration, within an application for decryption terminal, of the encoded permutation cancellation matrix;

[0032] - integration, within the terminal application, of the encoded transformation cancellation matrix.

[0033] Thus, once generated, the masked keys, formed by the encoded matrices, are integrated into their respective positions. This is the server for the masked public key formed by the encoded matrix of permutation, coding and transformation. This is the terminal white box for the masked private key formed by the encoded matrix of permutation cancellation and the terminal final application for the masked private key formed by the encoded matrix of transformation cancellation.

[0034] Advantageously, the means further implement at least two of the following three integration steps:

[0035] - integration, within a content server application, of the corresponding encoding matrix inverse to the encoding matrix having been combined with the merged permutation, coding and transformation matrix, so that a data sequence encoded by this inverse encoding matrix on a content server is decoded by the encoded permutation, coding and transformation matrix on an encryption server;

[0036] - integration, into the terminal application, of the corresponding encoding matrix inverse to the encoding matrix having been combined with the permutation cancellation matrix, so that a data sequence encoded by this inverse encoding matrix on the encryption server is decoded by the encoded permutation cancellation matrix on a decryption terminal;

[0037] - integration, within the terminal application, of the corresponding encoding matrix inverse to the encoding matrix having been combined with the transformation cancellation matrix, so that a data sequence encoded by the encoded transformation cancellation matrix is ​​decoded by the inverse encoding matrix.

[0038] Thus, the corresponding inverse encodings are set up "in front of" the integrated masked keys, allowing the decoding of the data encoded by the masking of these keys. In the case of the public key formed by the merged matrix of permutation, coding and transformation, the fact that it has been encoded and that an inverse encoding matrix is ​​placed upstream makes it possible to split the server, at least on the software level, between a content server, in which the data sequence is encoded by the inverse encoding matrix, and an encryption server, comprising the merged encoded matrix of permutation, coding and transformation. Thus, an attacker intercepting the content intended to be encrypted would come across a data sequence already encoded before it begins to be encrypted by the public key, which further strengthens security.In addition, the content server and the encryption server can now be separated and placed in different locations.

[0039] The invention also provides a method for encrypting data, in which, to encrypt a series of data, computer calculation means implement the following steps:

[0040] - after a merged transformation, coding, and permutation matrix, conforming to a McEliece cryptosystem, has been combined with an encoding matrix to form an encoded coding, permutation, and transformation matrix, applying the encoded coding, permutation, and transformation matrix to the data stream so as to form an encoded, permuted, and transformed data stream;

[0041] - voluntary addition of one or more errors, in accordance with the McEliece cryptosystem, to the sequence of coded, permuted and transformed data, so as to form a sequence of encrypted data.

[0042] Thus, the encryption method includes encryption using a public key, the McEliece cryptosystem, masked by an encoding matrix, and then adding errors according to the McEliece cryptosystem. The encryption method therefore takes advantage of McEliece and encodings to encrypt a data sequence intended to be subsequently decrypted in a white box. The public key corresponding to a combination of private keys, even if it were unmasked, an attacker could not find all the private keys, that is to say the individual encoding, permutation and transformation matrices, since they are merged in this encryption method.

[0043] Advantageously, beforehand, the computer calculation means apply to the data sequence a preliminary encoding matrix inverse to the encoding matrix to form an encoded data sequence, so that, subsequently, the encoded data sequence is decoded by the encoded coding, permutation and transformation matrix at the same time as it is coded, permuted and transformed by this encoded coding and permutation matrix.

[0044] This involves encoding the data, especially on a content server, before the data stream is encrypted using McEliece's cryptosystem on an encryption server. This increases the security of the encryption.

[0045] Advantageously, in addition, the computer calculation means also implement a step of applying a second encoding matrix to the encrypted data sequence, so as to form an encrypted and encoded data sequence.

[0046] Thus, at the output of encryption, the encrypted data sequence is, in addition, encoded. This encoding corresponds to the inverse encoding to which the data sequence will be subjected in the decryption process, inverse encoding allowing a private key to be hidden. Therefore, the encoding applied during this encryption process allows decryption to be prepared while further improving data integrity.

[0047] The invention also provides a method for decrypting data, characterized in that, to decrypt an encrypted data sequence, a permutation cancellation matrix, conforming to a McEliece cryptosystem, having been combined with an inverse encoding cancellation matrix of an encoding matrix, previously applied during an encryption operation, to form an encoded permutation cancellation matrix, the calculation means implement a step of applying the encoded permutation cancellation matrix to the encrypted data sequence so as to form a restructured data sequence and the encoding canceled.

[0048] Thus, one of the private keys of the McEliece cryptosystem, formed by the permutation cancellation matrix, is here masked thanks to the encoding, forming the encoded permutation cancellation matrix. The encoding used to mask this key is the inverse encoding of that used at the encryption output. In this way, the data is received in an encrypted but also encoded way, to be decoded at the white box input while being restructured. The masking of the private key therefore simultaneously participates in the decoding of this data.

[0049] Preferably, the means implement an error removal step, consistent with the McEliece cryptosystem, on the restructured data sequence and the canceled encoding, so as to form a restructured data sequence, the canceled encoding and corrected.

[0050] Thus, the rest of the decryption corresponds to a stage of McEliece's cryptosystem, that of error removal.

[0051] Advantageously, the means implement the following steps:

[0052] - application of a decoding matrix, compliant with the McEliece cryptosystem and aimed at decoding data previously encoded during an encryption operation, to the restructured data sequence, with the encoding cancelled and corrected, so as to form a restructured data sequence, with the encoding cancelled, corrected and decoded;

[0053] - a transformation cancellation matrix, conforming to a McEliece cryptosystem, having been combined with an encoding matrix to form an encoded transformation cancellation matrix, application to the restructured data sequence, to the canceled, corrected and decoded encoding, of the encoded transformation cancellation matrix, to form a decrypted and encoded data sequence.

[0054] Thus, two other private keys of the McEliece cryptosystem, formed here by the decoding matrix to decode the encoded data and by the transformation cancellation matrix, are also hidden, thanks to the encodings. The private keys of the McEliece cryptosystem, present in the white box to decrypt the data, are therefore protected. In addition, the encoding of the transformation cancellation matrix simultaneously allows the decrypted data to be encoded. Thus, the data is decrypted in the white box according to the McEliece cryptosystem and simultaneously encoded at the output of the white box, which improves its security.

[0055] Preferably, the means implement a step of applying, to the decrypted and encoded data sequence, an encoding cancellation matrix, inverse of the encoding matrix used to form the encoded transformation cancellation matrix, so as to form a decrypted data sequence.

[0056] So in the final application, the decrypted and encoded data is decoded so that it can be used.

[0057] The invention also provides a computer program comprising instructions which, when the program is executed by a computer, cause the latter to implement the steps of the method described above.

[0058] Also provided according to the invention is a computer-readable recording medium comprising instructions which, when executed by a computer, cause the latter to implement the steps of the method described above.

[0059] The invention also provides a cryptographic key generation server, comprising computer calculation means capable of implementing a method described above.

[0060] The invention also provides an encryption server, comprising computer computing means capable of implementing an encryption method described above to encrypt a data sequence.

[0061] The invention also provides a communication terminal, comprising computer calculation means capable of implementing a decryption method described above to decrypt a series of data.

[0062] The invention also provides a cryptosystem comprising at least one server described above and at least one terminal described above. Brief description of the figures

[0063] The invention will be better understood on reading the following description, given solely by way of example and with reference to the appended drawings in which:

[0064] is a diagram of the elements forming a cryptosystem according to one embodiment of the invention;

[0065] is a diagram of the operations carried out within the cryptosystem of the;

[0066] is a flowchart of a method for generating keys and encoding the invention;

[0067] is a flowchart of an encryption method of the invention;

[0068] This is a flowchart of a decryption method of the invention. Detailed description Definitions

[0069] Here, as throughout the description, reference will be made to a data sequence to be encrypted. This data sequence corresponds in particular to a vector or a segment of binary numbers whose content and order form a message. Thus, the data sequence 3 of the preferred embodiment described below corresponds to banking data, structured in a binary data sequence whose order produces a meaning for computer means. However, it may be any type of data, provided that it forms a message in the form of a data sequence whose meaning is defined by its structure, which makes it possible to encrypt the message by adding redundancies at specific locations in the sequence and / or by permuting the data sequence. Of course, the invention is applicable to data other than banking data.

[0070] By "coding" or "encoding" is meant an operation aimed at replacing one or more data in the data sequence with other data according to predetermined rules, for example a sequence of bits with another sequence of bits. The coding rules are specific to the type of coding used; they are, for example, those of so-called "Goppa" codes. For convenience, we will continue to refer to "coding" as a coding operation that has been combined with one or more other operations to form a merged operation, because even if this coding operation is then no longer distinguishable from the others in the executable code, the operation has been carried out.

[0071] By "encoding" or "encoding" is meant the application, to an operation, of another operation, called encoding, aimed at masking the intended operation. This involves in particular combining the intended operation with a matrix, called an encoding matrix, in such a way that it is not possible for an attacker to understand what the initially intended operation was. In particular, when a matrix corresponding to an intended operation is combined with an encoding matrix, only the resulting matrix, called "merged" or "obfuscated", of this encoding is stored in the memory concerned, so that it is impossible for an attacker to distinguish in the executable code the initial operation and the encoding, the two forming a single matrix.Instead of an encoding matrix, other types of encoding can be used, such as substitution tables to replace truth tables in software memory, thus masking the operation provided by the truth table. Unless otherwise specified, the remainder of the description will apply to any type of encoding that meets the need to mask an operation or a sequence of data. For convenience, we will continue to refer to an encoding operation that has been combined with one or more other operations to form a merged operation, or a "masked" operation, as even if this encoding operation is then no longer distinguishable from the others in the executable code, the operation is carried out. Although an encoding applies to an operation and not to data, we can speak of "encoded data" when a sequence of data is transformed by an operation that is itself encoded.

[0072] "Decoding" or the verb "to decode" thus have two possible meanings depending on what they refer to. One corresponds to the decoding of a sequence of data that has been previously coded by a coding operation. It is therefore a question of decoding "coded" data, that is to say, of finding the sequence of data as it was before its coding, by using the coding rules provided for this purpose. The other meaning concerns the decoding of "encoded" data or the decoding of an "encoded" operation. In particular, it involves using the inverse matrix of the encoding matrix used previously, to find the sequence of data or the operation initially planned. The choice of the meaning of the term "decoding" between these two meanings will be specified or will appear clearly in the rest of the description depending on the context.

[0073] A "key" or "key" refers to a cryptographic key that, combined with a predetermined type of algorithm, encrypts or decrypts data. In asymmetric cryptography, a public key can be accessible to the public, while a private key is intended to remain secret, possibly known only to its holder. For the same cryptosystem, a public key encrypts what a private key decrypts, and these keys are distinct from each other.

[0074] In the case where multiple private keys or multiple public keys are required, each of these keys is a public key or a private key respectively. However, for convenience, all public keys or private keys may be referred to as a single private key or public key.

[0075] Finally, we will understand that if a matrix is ​​accessible, that is to say can be read, its inverse matrix is ​​easily calculable, if it exists. In other words, knowing an invertible matrix A is also knowing the matrix A -1 , inverse matrix of matrix A.

[0076] We will now recall certain elements of a cryptosystem known from the state of the art, the McEliece cryptosystem. McEliece's Cryptosystem

[0077] The McEliece cryptosystem is an asymmetric encryption scheme, invented in 1978 by Robert McEliece and based in particular on code theory, with the use of "Goppa codes". Only the notions of this cryptosystem useful for the description of the present embodiment are briefly recalled below.

[0078] When generating keys in accordance with the McEliece cryptosystem, computer computing means generate matrices that are conventionally called G, P and S. The G matrix aims to encode a data sequence to be encrypted, using Goppa codes. The P matrix aims to permute the data in a data sequence, that is to say to modify the order of the data in the data sequence, for example the order of bits in a bit sequence. The structure of the data sequence to be encrypted is therefore modified by P. The S matrix is ​​a random matrix whose specifications are specific to the McEliece system and which corresponds to a linear application using neither Goppa codes nor specific permutations.

[0079] The calculation means also generate the inverse matrices of these matrices S, G and P, that is to say the matrices S -1 , G -1 and P -1. We can consider that the matrices, S, G, and P, and possibly also their inverse matrices, form three or six private keys (depending on whether we consider a matrix and its inverse as one or two keys) of the McEliece cryptosystem. We can alternatively consider that these matrices form a single private key including all these matrices independently of each other. We then call this private key (S, G, P) by convention. The two considerations are equivalent and valid. The computing means also generate the SGP matrix by multiplying the three matrices S, G and P together. We can consider the SGP matrix as a multiplication or a combination of the matrices S, G and P, forming a merged SGP matrix making the matrices S, G and P indistinguishable independently of each other. This SGP matrix forms the public key of the McEliece cryptosystem.This key is not necessarily intended to be revealed, but it can be made more easily accessible to a third-party server wishing to encrypt data, while the private keys S, G and P must remain secret.

[0080] To summarize, after generating the keys, we obtain a private key (S, G, P) (or equivalently private keys S, S -1 , G, G -1 , P, P -1 ) and an SGP public key. These keys are then combined with encryption and decryption algorithms described below.

[0081] We will now recall the encryption steps according to the McEliece cryptosystem.

[0082] To encrypt the data sequence, the public key is used. In other words, the computing means apply the SGP matrix to the data sequence, in the form of a multiplication. The rules of multiplication being adapted to the data type of the data sequence, it can be an operation in the binary Galois field for binary data, or in the field of real numbers or other types of application, the McEliece cryptosystem not being dependent on a type of multiplication. Multiplying this data sequence by the SGP matrix amounts to, simultaneously, encoding the sequence by the operations of the G matrix hidden in the SGP matrix and permuting the data of the sequence by the operations of the P matrix hidden in this merged SGP matrix, while applying the linear transformation operations of the S matrix also hidden in this SGP matrix.

[0083] Finally, the computing means voluntarily add one or more errors to the encoded and permuted data sequence. This encoded, permuted, and erroneous data sequence is thus the data sequence encrypted in accordance with the McEliece cryptosystem.

[0084] This encryption generally takes place on a server intended to encrypt data before communicating it to a remote device, for example a smartphone-type communication terminal. The computing resources mentioned are therefore those of this server.

[0085] We will now recall the decryption steps according to the McEliece cryptosystem, which are carried out on the device receiving the encrypted data.

[0086] To decrypt the encrypted data sequence received by the device, the latter's own computing resources use the private key (S, G, P). Concretely, the encrypted data sequence is multiplied by the matrix (or private key) P -1 , which allows the data in the sequence to be permuted in a way that is inverse to the permutation generated by the SGP key. The original permutation being reversed, the computing means recover the original structure of the data sequence. Since this original structure is recovered, the means can correct this data sequence, that is to say identify and remove the errors added voluntarily during encryption. This correction is carried out in accordance with any known fast error correction algorithm. The encrypted data sequence has now recovered its initial structure and has been "corrected". Then, the matrix matrix G is applied in turn -1 , then the matrix S -1, the matrix G -1 allowing to decode the sequence of data coded by means of the coding of the matrix G during encryption, the matrix S -1 allowing the linear transformation of the S matrix to be canceled during encryption. The data sequence, which arrived encrypted on the device, is therefore reversed, corrected, and now decoded. It is therefore decrypted and corresponds to the data sequence as it was, "in clear", before encryption. It should be noted that, here, the term "decoded" refers to the inverse of an "encoding" operation.

[0087] Of course, encryption operations can be performed on the terminal side and decryption operations on the server side if the SGP public key is located on the terminal side and the private key (S, G, P) on the server side.

[0088] It is recalled that one of the advantages of asymmetric encryption, as permitted by the McEliece cryptosystem, is that the public key, here the SGP matrix, can be accessible and known to all without compromising the security of the encryption. Thus, a third party wishing to send an encrypted message becomes aware of the SGP public key corresponding to the desired interlocutor, and encrypts its data sequence using this public key. Only the interlocutor having the private key (S, G, P), that is to say each of these three matrices independently of each other, can, using the inverse matrices of these matrices S, G and P, decrypt the message. In the case of use of the public key on the server side, a leak of the algorithm of this server is not detrimental, since this server does not have the matrices S, G and P but only the SGP matrix which does not allow to find the matrices S, G and P.

[0089] Finally, one of the interests now associated with the McEliece cryptosystem is its robustness against future so-called "quantum" attacks, as demonstrated by the candidate algorithm "Classic Mc Eliece", based on this cryptosystem, during the "Post-Quantum Cryptography" competition organized by the "National Institute of Standards and Technology" (NIST) from 2016 with a view to establishing "quantum-resistant" public key algorithms.

[0090] Cryptosystem according to a preferred embodiment of the invention

[0091] The components of the cryptosystem according to a preferred embodiment of the invention will now be described. The elements forming this system are illustrated in, the operations carried out within this system in.

[0092] The cryptosystem 21 of figures 1 and 2 includes a server 1 and a communication terminal 2 which here takes the form of a smartphone.

[0093] In this example, the server 1 is a banking server capable of encrypting and communicating banking data such as the data sequence 3 of the, but it could be another type of server. The server 1 includes conventional computer computing means 23 such as processors and memories. These computer computing means 23 make it possible to automate calculation operations, in particular encryption. Thus, these means 23 are configured to automatically execute the steps of a computer program 24 recorded in the server 1 in the form of executable code. This program 24 allows the encryption of the data 3. The server 1 is itself divided, in software terms, between a content server 11 and an encryption server 12, which use the same computer computing means 23.Thus, part of the code 24 is executable on the server 11, another on the server 12, which makes it possible to encode data on the server 11, then to encrypt this data on the server 12. The server 1 also includes conventional means of communication, such as an Internet connection and communication programs, making it possible to communicate a series of encrypted data to the outside, in particular to the terminal 2.

[0094] In a variant not illustrated, the device 11 and the device 12 are two physically separate computers which communicate by conventional means and use their respective computing means.

[0095] As will be seen below, and as illustrated in, the code 24 allows the encryption of a data sequence 3 on the server 1, by the calculation means 23. These encryption steps, executed by the calculation means 23 in accordance with the instructions of the code 24, concern, on the content server 11, an encoding operation 4 of the data 3. On the server 12, the executable code 24 requires a plurality of simultaneous operations on the sequence 3: this is an encoding 5 in an inverse manner to the encoding 4 and, simultaneously, the performance of permutations, coding and transformation by means of a key 6. The means 23 are then invited by the code 24 to perform an error addition operation 7 and an encoding operation 8 on the sequence 3, before sending the encrypted data 3 to the smartphone 2. All of these operations, executed by the calculation means 23 in accordance with the instructions of the code 24, will be described in more detail below.

[0096] The communication terminal 2 includes conventional computer calculation means 26 such as processors and memories. These means 26 make it possible to automate calculation operations, in particular decryption. Thus, these means 26 are configured to automatically execute the steps of a computer program 25 recorded in the smartphone in the form of an executable code. On the software level, the executable code 25 is divided into two parts, between a code corresponding to a decryption algorithm 22 and a code corresponding to a final application 19. The smartphone 2 also includes conventional communication means, such as an Internet connection and communication programs, making it possible to communicate with the outside, for example to receive a series of data 3 encrypted by the server 1.

[0097] As will be seen below, and as illustrated in, the algorithm 22, implemented by the means 26 in accordance with the steps of the code 25, is the white box comprising cryptographic keys whose integrity is to be protected. Thus, when executed by the means 26, this algorithm 22 performs, on the data sequence 3 received in encrypted and encoded form, simultaneous encoding 9 and permutation operations by means of a private key 13. The encoding 9 corresponds to the inverse of the encoding 8, that is to say to its decoding. The permutations of key 13 correspond to the inverse of the permutations of key 6. It should be noted that encoding 8, on server side 1, is therefore an external encoding of white box 22, while encoding 9 is the corresponding inverse encoding located in the white box.The white box 22, when executed by the calculation means 26, also includes an error correction operation 14 for correcting errors added voluntarily to the data 3 by the error addition operation 7. The algorithm 22 also includes a decoding operation using a private key 15, the decoding by this key 15 here relating to the inverse of the coding by the key 6. This algorithm 22 also includes a final decryption operation using the private key 16, inverse to the transformation carried out by the key 6, and carried out simultaneously with an encoding 17. Here again, we will return below to these operations, carried out on the smartphone 2 by the means 26.

[0098] The computing means 25 are also invited by the executable code 24 to execute an application 19, which is a final payment application used by the holder of the smartphone 2. Thus, when the data 3 are decrypted and encoded by the computing means 26 in accordance with the white box 22, the code of the application 19 leads these means 26 to carry out an encoding operation 18, which consists of an inverse decoding operation of the encoding operation 17, which makes it possible to decode the data. The encoding 18 is therefore an encoding external to the white box 22, corresponding inversely to the encoding 17 of the white box.

[0099] Once these operations have been carried out, the data 3 are therefore in clear and decoded within the application 19 and can be used, in particular for the purpose of a bank payment, by the user of the smartphone 2.

[0100] It should be noted that the application 19 is not sold to a user independently of the white box 22, these two software parts forming the executed code 25. It is the developer, or development company, of the final application 19, which generally acquires the white box 22, sold in the form of software libraries. The source code of the application 19 therefore includes calls via an API (for "Application Interface Programming") to the algorithm 22 to control the execution of this algorithm. When the user downloads and installs his application, it therefore includes the final application 19 and the white box 22 attached to it, in the form of a single code 25.

[0101] We will now return to certain operations of this cryptosystem 21 illustrated in, regularly referring to the operations of the McEliece cryptosystem described above.

[0102] First of all, encoding 4 corresponds to an encoding matrix that we will call J. Thus, the data sequence 3 is encoded using the encoding matrix J in the encryption server 11.

[0103] At encoding 5, at the start of encryption server 12, corresponds the matrix J -1 , the inverse matrix of the matrix J.

[0104] Public key 6 is the SGP matrix as defined in the McEliece cryptosystem. However, in this cryptosystem 21, this SGP matrix is ​​combined with the J matrix -1 to form a merged matrix J -1 SGP. In other words, the data 3 encoded at the output of the content server 11 by the matrix J has the matrix J applied to it -1 SGP, which will therefore not only encode and permute this data according to the McEliece cryptosystem, but also decode the data according to the J matrix -1, simultaneously. It should be noted that, as a result, the public key 6 is hidden within the server 11 by the encoding J -1 . Indeed, the encoding of the SGP matrix by the J matrix -1 makes any distinction between these matrices impossible for an attacker with the executable code implemented in the server 12. In addition, the J-encoding hides the data between the content server 11 and the encryption server 12, while the J-encoding -1 is not accessible to an attacker because it is hidden within the J matrix -1 SGP.

[0105] To encoding 8, corresponds an encoding matrix which we will call F.

[0106] At encoding 9, at the input of white box 22 on terminal 2 side, corresponds the matrix F -1 , the inverse matrix of the matrix F.

[0107] The private key 13 corresponds to the matrix P -1as defined in the McEliece cryptosystem, allowing data to be permuted inversely to the permutations of P and therefore of SGP. However, in this cryptosystem 21, this matrix P -1 is combined with the matrix F -1 to form a merged matrix F -1 P -1 . Thus, the matrix P -1 , and therefore the matrix P and generally the private key 13, is masked by the encoding 9 thanks to the matrix F -1 .

[0108] The private key 15 corresponds to the matrix G -1 as defined in the McEliece cryptosystem.

[0109] Encoding 17 corresponds to an encoding matrix that we will call H.

[0110] The private key 16 corresponds to the matrix S -1 as defined in the McEliece cryptosystem. However, in cryptosystem 21, this matrix S -1 is combined with the matrix H to form a merged matrix S -1H. Thus, the matrix S - 1 , and therefore the matrix S and the private key 16, is hidden by the encoding H.

[0111] Finally, in the final application 19, at encoding 18, corresponds the matrix H -1 .

[0112] It can be deduced that an attacker with the executable code can only identify the operations of the matrix G -1 , since it is the only matrix that is not hidden. In other words, the private key 15 is identifiable. On the other hand, the operations of the matrices P -1 and S -1 , that's to say keys 13 and 16 are masked by respective encodings 9 and 17. In other words, among the three private keys, this embodiment masks two, while on the server side, an encoding 5 masks the public key 6.

[0113] In the following, we can speak indifferently of a key or its corresponding matrix. Similarly, we will speak indifferently of an encoding, a decoding, and their corresponding matrix.

[0114] We will now describe processes implementing the elements presented above.

[0115] Generating keys and combining them with encodings

[0116] The method 100, illustrated in, aims to install the cryptosystem 21 on the server 1 and the terminal 2. It is implemented by the computing means of the smartphone 2, of the server 1, or even by independent means, located on a separate server. The location and the initialization methods are not specific to the method described. We will therefore generally refer, to designate any computing means implementing this method, to “means” which carry out these operations automatically, wherever they are located.

[0117] In step 10, a user installs the payment application 19 on his smartphone 2. In order for the data 3 of the data suite to be protected, the following steps are then implemented automatically.

[0118] In step 20, the means generate the matrices S, G and P. They are determined according to the specifications of the McEliece cryptosystem. The means also calculate their inverses S -1 , G -1 and P -1 . In other words, private keys 13, 15 and 16 are generated.

[0119] In step 30, the means determine the matrix J and its inverse J -1 , the matrix F and its inverse F -1 , then the matrix H and its inverse H -1. To do this, the matrices J, F and H are determined so that any sequence of data passing through the cryptosystem 21 can be encoded and decoded accordingly. Their terms are random, the only requirement is that these matrices are invertible, so that the means generate the inverse matrices. In other words, the encodings 4, 5, 8, 9, 17 and 18 are generated.

[0120] In step 40, the means combine, i.e. multiply together, some of the generated matrices. Thus, the matrices J -1 , S, G and P are combined to form the merged matrix J -1 SGP. The F matrices -1 and P -1 are combined to form the merged matrix F -1 P -1. The S matrices -1 and H are combined to form the matrix S -1 H.

[0121] In step 50, the matrices are placed at the specific locations of the cryptosystem 21.

[0122] Thus, matrix J is placed on content server 11 to form encoding 4, matrix J -1 SGP is placed at the input of the encryption server 12 to form the simultaneous operation of encoding 5 and permutation-coding-transformation by the public key 6. The matrix F is placed at the output of the encryption server 12 to form the encoding 8. The matrix F -1 P -1 is placed at the input of white box 22, on terminal 2, to form the simultaneous operation of decoding 9 and inverse permutation using the private key 13. The matrix G -1 is placed at the heart of the white box 22, and forms the private key 15 used to decode the data. The matrix S -1 H, forming the private key 16 and the encoding 17, is placed at the output of the white box 22 to complete the decryption while encoding the data according to the encoding 17. Finally, the matrix H -1is placed at the final application input 19 to decode the data.

[0123] Cryptosystem 21 is then in place. As a reminder, two out of three private keys, keys 13 and 16, are hidden, and public key 6 is also hidden, thanks to the encodings.

[0124] In terms of resource usage, this key generation method is more expensive than McEliece's since more matrices are generated and combined. However, the four matrices J, FH, and S correspond to linear transformations, so it is sufficient to generate these four matrices randomly, provided that they are invertible. No other complex calculations are required. Encryption process

[0125] We will now describe a method 200 for encrypting the data sequence 3, carried out on the server 1, with reference to and to. It is implemented when the use of the final application 19 requires the sending of encrypted data from the server 1, in this case banking data to settle a payment.

[0126] In step 60, the first step of this encryption method, the data sequence 3 is encoded on the content server 11 by encoding 4, that is to say concretely by means of the encoding matrix J. The data sequence 3 is therefore now encoded. The presence of this encoding 4 makes it possible to divide the server 1 into two: a content server 11 and an encryption server 12. Thus, if an attacker tries to intercept the data before their encryption on the encryption server 12, he only obtains encoded data, which he cannot decode without having J or J -1 . Now, J is located on the content server side 11, and J -1is hidden in the matrix J -1 SGP.

[0127] At step 70, the encoded data sequence 3 has the matrix J applied to it -1 SGP, that is to say that this sequence, forming a vector, is multiplied by the matrix J - 1SGP. The operation results in a data sequence 3 decoded with respect to encoding 4, thanks to the operations of J -1 hidden in this matrix, but also and simultaneously transformed by S, coded by G and to the data permuted by P.

[0128] At step 80, the transformed, coded and permuted data sequence 3 has one or more errors added by the error addition module 7. The data sequence is therefore now transformed, coded, with permuted data, then “voluntarily erroneous”: it is therefore encrypted in accordance with the McEliece cryptosystem.

[0129] In step 90, this encrypted data sequence 3 is encoded by encoding 8 using the encoding matrix F. The data sequence 3 is therefore encrypted and encoded.

[0130] Server 1 then communicates this encrypted data sequence to terminal 2.

[0131] In terms of resource usage, this process is more expensive than McEliece's since the 8-encoding is added at the end of the server. However, the addition of the 5-encoding has no impact since it is combined with the 6-encoding. Furthermore, since this process takes place on the server, the latter can easily be sized to accommodate it. Decryption process

[0132] We will now describe a decryption method 300, with reference to figures 2 and 5. It is carried out on the smartphone 2, within the white box 22, and targets the data 3 received in encrypted and encoded form.

[0133] In step 110, decoding 9 and private key 13 simultaneously decode and permute the data of data sequence 3, the decoding operations being performed by the operations of matrix F -1 , those of permutation being derived from the matrix P -1 , all of these operations being carried out simultaneously via the matrix F -1 P - 1 applied to the data sequence 3. The data sequence 3 is therefore decoded and permuted so as to recover its original structure. It remains “intentionally erroneous”, encoded and transformed. An attacker who becomes aware of the executable code of this operation would not be able to distinguish F -1 and P -1 . Moreover, since the F encoding is located only on the server, there is no access to the white box 22 and it could not find P -1 from the matrix F -1 P -1 . He could therefore not identify the private key 13 formed by the matrix P- 1 . Private key 13 is therefore masked by encoding 9.

[0134] In step 120, the error correction module 14 identifies and removes errors from the data sequence 3. Any correction algorithm can be implemented for this purpose. This rapid correction is made possible by the fact that the original structure of the data sequence has been recovered after the inverse permutation operations of P -1 hidden in F -1 P -1 The data sequence therefore now remains only coded and transformed in accordance with the operations of the matrix G and S by J -1 SGP.

[0135] In step 130, the private key 15 is used in the form of the matrix G -1 , to decode the data sequence so that the coding operations of G hidden within the matrix J -1SGP are reversed. The data sequence therefore now remains only transformed by the operations of S within J -1 SGP.

[0136] Finally, at step 140, this data sequence is simultaneously transformed by S - 1 , forming the private key 16, and encoded by H, forming the encoding 17, within the matrix S -1 H. S's operations -1 masked operations thus finish decrypting the data sequence according to the McEliece cryptosystem, while H encodes this data. The encoding H has two functions. It allows the operations of S to be hidden -1 , so that an attacker accessing this matrix S -1 H cannot identify S -1. The private key 16 is therefore masked by the encoding 17. In addition, this encoding H prevents the data sequence 3 from circulating in clear text between the white box 22 and the final payment application 19. Thus, an attacker trying to intercept the data at the exit of the white box could not identify the data, nor the key 16.

[0137] At step 150, implemented on the final application 19, the inverse encoding 18 makes it possible to decode the data.

[0138] The final application 19 can then use them to make the requested bank settlement, for example.

[0139] In terms of resource usage, this decryption method is no more expensive than McEliece's, which is very advantageous since it is implemented on a mobile terminal. Indeed, encodings 9 and 17 are used at the same time as keys 13 and 16.

[0140] Of course, the encryption and decryption processes can be reversed, with decryption taking place on the server and encryption on terminal 2, provided that the encodings initially placed on the server are now placed on terminal 2, and those of terminal 2 are placed on the server. The process then remains the same. Other technical effects

[0141] The invention therefore takes advantage of the combination between the operations defined in the McEliece cryptosystem and the encodings of these operations to protect the integrity of the encryption of the white box 22.

[0142] In particular, the user's private keys, stored on the white box 22, are protected even in the event of a leak of the algorithm located on the server 11. Indeed, even if the matrix J -1SGP is identified by an attacker, he cannot deduce the matrices S, G and P and therefore their inverse matrices allowing the data on smartphone 2 to be decrypted. This is always the case even if J -1 is identified.

[0143] Furthermore, on the white box 22, the private keys 13 and 16, formed by the matrices P -1 and S -1 are masked respectively by the matrices F -1 and H of encodings 9 and 13. An attacker with the executable code of white box 22 cannot therefore identify keys 13 and 16.

[0144] Cryptosystem 21 therefore specifically protects the integrity of white-box encryption.

[0145] Furthermore, it should also be remembered that the external encodings 8 (F matrix) and 18 (H matrix -1), located respectively on the server 11 and the final application 19, make any porting of code from the white box 22 ineffective, since it is necessary to have these encodings to identify the encoding 9 (matrix F -1 ) hiding key 13 (matrix P -1 ) and encoding 17 (matrix H) masking key 16 (matrix S).

[0146] Finally, as mentioned above, encodings 4 and 5, associated with the J matrix, make it possible to divide server 1 into two separate servers: a content server 11 and an encryption server 12, to encode the data before it is encrypted. This also makes it possible to hide SGP operations, thanks to the J matrix -1 SGP. Thus, if the algorithm of the encryption server 12 leaks, the encoding 5 continues to hide the key 6, while if the content server 11 is attacked, the data and the encoding 4 remain unidentifiable.

[0147] Furthermore, the operations of the matrices G and P conform to the McEliece cryptosystem, within the matrix SGP and therefore here of the matrix J -1 SGP, offer robustness against future quantum attacks which is preserved here, the encodings do not modify these operations but aim to hide them. Cryptosystem 21 therefore makes it possible to protect the integrity of the white box encryption while making this white box robust against future quantum attacks.

[0148] Finally, in general, cryptosystem 21 associates three encoding pairs with the McEliece cryptosystem: encodings 4 and 5, encodings 8 and 9, and encodings 17 and 18. The placement of these encodings in cryptosystem 21 makes it robust even in the event of one of these pairs being leaked, for any attacker with all the executable code. Indeed, in the event of the encoding pair 4 and 5 being leaked, that is to say if an attacker manages to identify the operations of matrix J and therefore of matrix J -1 on the server, the attacker can deduce from the matrix J -1SGP the operations of an SGP matrix. Thus, the public key conforming to the McEliece cryptosystem is unmasked. However, even with access to this SGP matrix and to the plaintext matrix G in the white box 22, this attacker cannot identify the operations of matrices S and P. Private keys 13 and 16 therefore remain secret. Alternatively, in the event of leakage of the pair of encodings 8 and 9, i.e. if the attacker manages to identify the operations of matrix F (and its inverse), he can deduce the operations of matrix P thanks to access to matrix F -1 P -1 on the white box 22. He therefore deduces the key 13. But he cannot deduce the operations of the matrix S, therefore of the key 16. Finally, alternatively, in the event of leakage of the encodings 17 or 18, therefore of the matrix H, the key 16 is identified through the matrix S -1H. But key 13, i.e. matrix P, remains unidentifiable. Thus, in these three cases, a leak of one of the three pairs of encodings does not allow the attacker to access all the secret keys formed by matrices S, G and P and their inverses.

[0149] Therefore, the following three variants are possible.

[0150] Thus, in a variant not shown, encodings 4 and 5 are non-existent. Server 1 is unified. Since matrix J does not exist, the data to be encrypted is directly SGP multiplied. The advantages described above all remain valid, except those associated with encodings 4 and 5. Public key 6 is therefore not hidden here, but secret keys 13 and 16 remain preserved.

[0151] In another variant, encodings 8 and 9 are non-existent. This time, public key 6 remains hidden by encoding 5, but key 13 can be identified by an attacker with white box 22. However, key 16 remains secret.

[0152] Finally, in the third variant, encodings 17 and 18 are non-existent, so that it is key 16 that can be identified, but the public key and private key 13 remain secret.

[0153] In a fourth variant not illustrated, instead of removing an encoding pair and thus making one of the keys identifiable by an attacker, an encoding pair is added to hide the secret key 15 in the white box 22. In particular, we can combine with the matrix G -1 an encoding matrix K to form a matrix G -1 K, then combine with the matrix S -1 H the matrix K -1 to form a matrix S -1 HK -1. With this variant, each key is hidden, and an attacker needs to identify not two but three pairs of encodings to identify each of the secret keys. The security of the encryption is therefore further reinforced, at the cost of additional resources during the generation of the keys and the associated encodings.

[0154] The invention is not limited to the embodiments presented and other embodiments will become clear to those skilled in the art. In particular, it is possible to replace the encoding matrices with any other form of encoding, for example substitution tables taking the place of truth tables in the executable code.

Claims

Method (100) for generating a cryptographic key, implemented by computer computing means (23, 26), in which the following steps are carried out:- generation (20) of a permutation matrix (P), a coding matrix (G) and a linear transformation matrix (S), the three matrices being in accordance with a McEliece cryptosystem;- generation (20) of an inverse permutation cancellation matrix (P -1 ) of the permutation matrix (P), of an inverse coding cancellation matrix (G -1 ) of the coding matrix (G), and of an inverse transformation cancellation matrix (S -1 ) of the linear transformation matrix (S), the three cancellation matrices (S -1 , G -1 , P -1) being compliant with the McEliece cryptosystem;- combination (40) of the permutation matrix (P) with the coding matrix (G) and with the linear transformation matrix (S), to form a merged permutation, coding and transformation matrix (SGP) compliant with the McEliece cryptosystem,characterized in that the computer calculation means (23, 26) implement a generation step (30) of at least two random encoding matrices (J -1 , F -1 , H), the computer calculation means (23, 26) further implementing at least two of the following three combination steps:- combination of one of the random encoding matrices (J -1 ) with the merged permutation, coding, and transformation (SGP) matrix, to form an encoded permutation, coding, and transformation matrix (J -1 SGP), - combination of one of the other random encoding matrices (F -1 ) with the permutation cancellation matrix (P-1 ) to form an encoded permutation cancellation matrix (F -1 P -1 ),- combination of one of the other random encoding matrices (H) with the transformation cancellation matrix (S -1 ) to form an encoded transformation cancellation matrix (S -1 H). Method (100) according to the preceding claim, in which the computer calculation means (23, 26) implement the three combination steps (50). Method (100) according to the preceding claim, in which, for each generated random encoding matrix (J -1 , F -1 , H), the calculation means (23, 26) implement a step of determining (30) a corresponding inverse encoding matrix (J, F, H -1 ) of said random encoding matrix, so that a sequence of data encoded by said random encoding matrix (J -1 , F -1, H) is decoded by the corresponding inverse encoding matrix (J, F, H -1 ), and vice versa. Method (100) according to any one of the preceding claims, in which the computer calculation means (23, 26) further implement at least two of the following three integration steps (50): - integration, within an application for encryption server (12), of the encoded permutation, coding and transformation matrix (J -1 SGP);- integration, within an application for decryption terminal (2), of the encoded permutation cancellation matrix (F -1 P -1 ) ;- integration, within the terminal application (2), of the encoded transformation cancellation matrix (S -1 H). Method (100) according to at least claims 3 and 4, wherein the means (23, 26) further implement at least two of the following three integration steps (50):- integration, within a content server application (11), of the corresponding inverse encoding matrix (J) of the encoding matrix (J -1 ) having been combined with the merged permutation, coding and transformation (SGP) matrix, so that a data stream encoded by this inverse encoding matrix (J) on a content server (11) is decoded by the encoded permutation, coding and transformation matrix (J -1 SGP) on an encryption server (12); - integration, into the terminal application (2), of the corresponding inverse encoding matrix (F) of the encoding matrix (F -1 ) having been combined with the permutation cancellation matrix (P -1), so that a data sequence encoded by this inverse encoding matrix (F) on the encryption server (12) is decoded by the encoded permutation cancellation matrix (F -1 P -1 ) on a decryption terminal (2); - integration, within the terminal application (2), of the corresponding inverse encoding matrix (H -1 ) of the encoding matrix having (H) been combined the transformation cancellation matrix (S -1 ), so that a data sequence encoded by the encoded transformation cancellation matrix (S -1 H) is decoded by the inverse encoding matrix (H -1 ). Method (200) for encrypting data, characterized in that, to encrypt a sequence of data, computer calculation means (23) implement the following steps: - after a merged transformation, coding and permutation matrix (SGP), conforming to a McEliece cryptosystem, has been combined with an encoding matrix (J -1 ) to form an encoded matrix of coding, permutation and transformation (J -1 SGP), application (70) of the encoded matrix of coding, permutation and transformation (J -1 SGP) to the data sequence so as to form a coded, permuted and transformed data sequence; - voluntary addition of one or more errors (80), in accordance with the McEliece cryptosystem, to the coded, permuted and transformed data sequence, so as to form an encrypted data sequence. Method (200) according to the preceding claim, in which, beforehand, the computer calculation means (23) apply to the data sequence a preliminary encoding matrix (J) inverse to the encoding matrix (J -1 ) to form an encoded data sequence, so that, subsequently, the encoded data sequence is decoded by the encoded coding, permutation and transformation matrix (J -1 SGP), at the same time as it is coded, permuted and transformed by this encoded matrix coding and permutation. Method (200) according to any one of claims 6 and 7, in which, in addition, the computer calculation means (23, 26) further implement a step of applying (90) a second encoding matrix (F) to the encrypted data sequence, so as to form an encrypted and encoded data sequence. Method for decrypting (300) data, characterized in that, to decrypt an encrypted data sequence, a permutation cancellation matrix (P -1 ), conforming to a McEliece cryptosystem, having been combined with an inverse encoding cancellation matrix (F -1 ) of an encoding matrix (F), previously applied during an encryption operation (90), to form an encoded permutation cancellation matrix (F -1 P -1 ), the calculation means (26) implement a step of applying to the encrypted data sequence the encoded permutation cancellation matrix (F -1 P -1 ) so as to form a restructured data sequence and the encoding canceled. Method (300) according to the preceding claim, in which the means implement an error removal step (120), in accordance with the McEliece cryptosystem, in the restructured data sequence and in the canceled encoding, so as to form a restructured data sequence, in the canceled and corrected encoding. Method (300) according to any one of claims 9 and 10, in which the means (26) implement the following steps:- application (130) of a decoding matrix (G -1 ), conforming to the McEliece cryptosystem and aiming to decode data previously encoded during an encryption operation, following a restructured data sequence, with the encoding canceled and corrected, so as to form a restructured data sequence, with the encoding canceled, corrected and decoded; - a transformation cancellation matrix (S -1), conforming to a McEliece cryptosystem, having been combined with an encoding matrix (H) to form an encoded transformation cancellation matrix (S -1 H), application (140) to the restructured data sequence, to the canceled, corrected and decoded encoding, of the encoded transformation cancellation matrix, to form a decrypted and encoded data sequence. Method (300) according to the preceding claim, in which the means (26) implement a step of applying (150), following decrypted and encoded data, an encoding cancellation matrix (H -1 ), inverse of the encoding matrix (H) used to form the encoded transformation cancellation matrix (S -1 H), so as to form a decrypted data sequence. A computer program (24, 25) comprising instructions which, when the program is executed by a computer, cause the computer to implement the steps of the method (100, 200, 300) according to any one of claims 1 to 12. A computer-readable recording medium (23, 26) comprising instructions which, when executed by a computer, cause the computer to carry out the steps of the method (100, 200, 300) according to any one of claims 1 to 12. Cryptographic key generation server, comprising computer computing means (23, 26) capable of implementing a method (100) according to at least one of claims 1 to 5. Encryption server (12), comprising computer calculation means (23) capable of implementing a method (200) according to at least one of claims 6 to 8 for encrypting a data sequence. Communication terminal (2), comprising computer calculation means (26) capable of implementing a method (300) according to at least one of claims 9 to 12 for decrypting a data sequence. Cryptosystem (21) comprising at least one server (12) according to claim 15 or 16 and at least one terminal (2) according to claim 17.

Images