White box cryptographic keys

Abstract

The invention is a method (100) for generating a cryptographic key, implemented by computer computing means, in which generation steps (20) of matrices conforming to a McEliece cryptosystem are performed, and then the computer computing means further implement at least two of the following three combination steps (40): - combining a random encoding matrix with the merged permutation, encoding, and transformation matrix to form a permutation, encoding, and transformation encoded matrix; - combining another random encoding matrix with the permutation cancellation matrix to form a permutation cancellation encoded matrix; - combining another random encoding matrix with the transformation cancellation matrix to form a transformation cancellation encoded matrix. Figure for the abstract: Figure 3

Description

Title of the invention: White box cryptographic keys

[0001] The invention relates to white box cryptography.

[0002] White box cryptography is a subject of study based on the postulate that an attacker, who seeks to identify secret, encrypted data that can be decrypted using an encryption algorithm, has complete access to the algorithm's execution platform and to the software implementation of this algorithm in the platform: the binary code is thus entirely visible, it is modifiable, and the attacker can also act at will on the software execution through the various systems of the platform such as memory, calls to processors, etc. The most classic example is that of an attacker having access to a third-party smartphone, in which a software application on the smartphone encrypts or decrypts secret data using an encryption key and a cryptographic algorithm, for example of the "AES" type (for "Advanced Encryption Standard").The attacker has full power over the smartphone and the algorithm, and can thus seek to read the corresponding binary code, modify it, execute it in a specific manner, with the ultimate objective, knowing the type of algorithm used, of identifying the encryption key, decrypting the secret data, and / or modifying this data.

[0003] To prevent this attacker from accessing the secret data and to protect the integrity of the encryption in this white box context, a method is known in the state of the art consisting of encoding elementary operations of the encryption (or decryption) algorithm. Indeed, an elementary operation, resulting from the combination between a known type of algorithm and a specific encryption key, is generally implemented in the form of a truth table indicating the possible results of the operation depending on the input data. An encoding operation therefore consists of applying a random transformation to an elementary operation so as to make this operation unreadable. To encode an operation, a substitution of the elements of the truth table can be carried out, by combining the initial table with a random substitution table, so as to obtain an “obfuscated” or “merged” table.Alternatively, a linear transformation can be applied to the operation by combining a vector representing the output data, or a matrix corresponding to the operation, with another matrix, called an encoding matrix, which is also random. An encoding can also be a combination of one or more substitutions and one or more encoding matrices. Other types of encoding are possible. In addition, each elementary operation following an encoded elementary operation is itself combined with a so-called "inverse" encoding, or . decoding, corresponding inversely to the previous encoding. This is for example the inverse substitution table or the inverse matrix corresponding to the previous encoding, so that the initially planned algorithm is not modified by successive encodings. In all cases, only the truth tables resulting from these encoding operations merged with the elementary operations, i.e. the so-called "obfuscated" or "merged" tables, are stored in the software memory implementing the algorithm. In this way, the attacker, having access only to the obfuscated tables, cannot identify which elementary operation is associated with each table and therefore cannot determine the cryptographic key used and decrypt the secret data.

[0004] These encodings, making it possible to encode an encryption (and / or decryption) algorithm within an unsecured execution platform, for example within a smartphone, are called “internal”, since they make it possible to make the encryption key used within the white box formed by the implemented algorithm unreadable.

[0005] However, this white box generally communicates on the one hand with a server located remotely, and on the other hand with a third-party application located on the same platform. For example, it is common for a server to encrypt data and communicate the encrypted data to the smartphone, then for the white box, i.e. the decryption algorithm executed by the smartphone, to be used to decrypt the data before this decrypted data is communicated within the same smartphone to a third-party application, called "final", which is intended to use the decrypted data. However, the final applications are developed by third-party companies, independently of the white boxes.These companies therefore acquire white boxes marketed in the form of software libraries containing the encryption and decryption algorithm, and an API (for "Application Programming Interface") allowing the algorithm to be controlled and the data coming out of this algorithm to be used in the final application developed. In this context, the "internal" encodings within the white box do not prevent the decrypted data from circulating, in clear, between the white box and the final application. Similarly, even if the cryptographic key used is now very difficult to identify within the white box thanks to the internal encodings installed in this white box, the attacker can attempt to port the code, that is to say, export the entire code from the white box to another device to exploit it there without having to identify the key.

[0006] This is why it is known in the prior art to implement, in addition to these internal encodings, so-called "external" encodings, placed at the ends of the complete communication channel between the sending of the data and its use. For example, firstly, within the remote server, a first "external" encoding is applied to the last truth table of the server's encryption algorithm, whether in the form of a substitution table, an encoding matrix, or some other form of random encoding, so that the data to be communicated to the smartphone is not only encrypted as intended, but also encoded before being communicated to the smartphone. Then, at the input of the white box, the inverse encoding of the outer encoding is applied to the first truth table of the decryption algorithm, before the data is processed through the white box's decryption algorithm and its internal encodings. The inverse encoding, which is the decoding of the first outer encoding, is therefore part of the white box. Then, a new random encoding is done at the output of the white box, by applying this new encoding to the last truth table of the white box. Here too, this second encoding is therefore part of the white box.At the output, the data is therefore decrypted, but this time still encoded using this new random encoding, before being communicated to the final third-party application intended to use it. Finally, within this third-party application, the external encoding corresponding to the inverse of the encoding applied at the end of the white box allows the data to be decoded within the application before it is used by the application.

[0007] Thanks to these external encodings placed outside the white box, even once decrypted, the data do not circulate "in clear" outside the white box, they remain encoded, therefore protected from manipulation by an attacker who would like to intercept them. In addition, the attack consisting of carrying the entire code of the white box on another device does not work, since in this context the code of the white box includes within it an encoding at its input and an encoding at its output. Without the corresponding inverse encodings, which are located remotely (within the server and within the final application), it is not possible to find the data in clear. In addition, added to the internal encodings, these external encodings associated with encodings at the output and input of the white box make it even more difficult to identify the encryption key of the white box.

[0008] It should be noted that all of these encodings, both internal and external, are random, that is to say that they use transformations, substitutions or other manipulations unknown to all, so that no attacker can find them.

[0009] However, this system still includes at least two drawbacks.

[0010] First of all, if the white box of the end user's terminal is encrypted, this is generally not the case for the cryptographic algorithm located on the remote server. Indeed, unlike the user's end terminal, which is mobile and easily accessible, the server is supposed to be a secure environment. In order not to increase its calculation times, the server's encryption and decryption algorithm does not generally include internal encoding, but only output encoding. Thus, if this algorithm were to leak, and in particular if the output encoding is not sufficiently protected, the elementary operations and therefore the encryption and decryption keys used would become identifiable by an attacker. However, in the context of symmetric encryption such as AES, the same key is used to decrypt and decrypt data. The user's key, encoded in the white box on their terminal, would therefore be identified because of the leak of the unencoded algorithm on the remote server.

[0011] Furthermore, current white-box algorithms are not considered sufficiently robust against future quantum attacks.

[0012] The invention aims in particular to improve the integrity of the cryptographic keys of white box cryptography methods.

[0013] Another objective is to anticipate future quantum attacks.

[0014] To this end, the invention relates to a method for generating a cryptographic key, implemented by computer calculation means, in which the following steps are carried out:

[0015] - generation of a permutation matrix, a coding matrix and a matrix of linear transformation, the three matrices being consistent with a McEliece cryptosystem;

[0016] - generation of a permutation cancellation matrix inverse to the per matrix mutation, an inverse coding cancellation matrix of the coding matrix, and an inverse transformation cancellation matrix of the linear transformation matrix, all three cancellation matrices conforming to the McEliece cryptosystem;

[0017] - combination of the permutation matrix with the coding matrix and with the linear transformation matrix, to form a merged permutation, coding and transformation matrix conforming to the McEliece cryptosystem,

[0018] the computer calculation means further implementing a step of generating at least two random encoding matrices, the computer calculation means further implementing at least two of the following three combination steps:

[0019] - combination of one of the random encoding matrices with the merged matrix of permutation, coding and transformation, to form an encoded matrix of permutation, coding and transformation,

[0020] - combination of one of the other random encoding matrices with the matrix permutation cancellation to form an encoded permutation cancellation matrix,

[0021] - combination of one of the other random encoding matrices with the matrix transformation cancellation to form an encoded transformation cancellation matrix- training.

[0022] Thus, the encoded permutation, coding, and transformation matrix hides the public key conforming to the McEliece cryptosystem, which is initially formed from the merged permutation, coding, and transformation matrix. The encoded permutation cancellation matrix and the encoded transformation cancellation matrix each hide a private key of the McEliece cryptosystem, respectively the permutation cancellation matrix and the transformation cancellation matrix.

[0023] By generating at least two of these three encodings, the integrity of the data to be encrypted or decrypted is protected. Indeed, even if the merged permutation, coding and transformation matrix is ​​not encoded and is made accessible to an attacker, and even if the attacker accesses the coding matrix, it is not possible for this attacker to deduce the permutation cancellation matrix or the transformation cancellation matrix because the latter are both encoded. Alternatively, if the merged permutation, coding and transformation matrix is ​​indeed encoded, but one of the two cancellation matrices is not encoded and is made accessible to an attacker, it is not possible for the latter to deduce the other cancellation matrix.Thus, with at least two of the three encodings, and even if the encoding cancellation matrix is ​​accessible, it is not possible for an attacker to simultaneously have all three cancellation matrices, i.e., all the private keys. This protects cryptographic keys in particular in the event of a leak on the server, because the latter only includes the public key, i.e., the merged matrix of permutation, encoding and transformation. The protection of white-box cryptographic keys is therefore improved.

[0024] Furthermore, these permutation, coding and transformation operations conforming to the McEliece cryptosystem are known to be robust against future quantum attacks. This key generation method therefore makes it possible to have a cryptosystem robust to future quantum attacks while at the same time protecting the integrity of the cryptographic keys, even in the event of a leak on the server.

[0025] Advantageously, the computer calculation means implement the three combination steps.

[0026] Thus, the security of the encryption is enhanced by encoding all three matrices instead of just two of them. In other words, the public key of the McEliece cryptosystem, corresponding to the merged permutation, coding, and transformation matrix, is hidden since this matrix is ​​encoded, as are two of the private keys, i.e., the permutation cancellation matrix and the transformation cancellation matrix, which are encoded. Even if the attacker were able to decode one of these three encoded matrices, this would not allow him to obtain all the private keys. An attacker would therefore have to decode two of the three matrices encoded to obtain all private keys.

[0027] Preferably, for each generated random encoding matrix, the computing means implement a step of determining a corresponding inverse encoding matrix of said random encoding matrix, so that a sequence of data encoded by said random encoding matrix is ​​decoded by the corresponding inverse encoding matrix and vice versa.

[0028] Thus, the encryption algorithm is not disrupted by encodings, since inverse encodings are provided. Like encodings, inverse encodings allow operations or data sequences to be masked. Intercepting an encoded data sequence before its decoding by a corresponding inverse encoding matrix prevents the attacker from identifying the encoded data sequence or the operation performed on the data sequence.

[0029] Advantageously, the computer calculation means further implement at least two of the following three integration steps:

[0030] - integration, within an application for encryption server, of the matrix encoded permutation, coding and transformation;

[0031] - integration, within an application for decryption terminal, of the matrix encoded permutation cancellation;

[0032] - integration, within the terminal application, of the encoded matrix cancellation of transformation.

[0033] Thus, once generated, the masked keys, formed by the encoded matrices, are integrated in their respective positions. This is the server for the masked public key formed by the encoded matrix of permutation, coding and transformation. This is the white box of the terminal for the masked private key formed by the encoded matrix of permutation cancellation and the final application of the terminal for the masked private key formed by the encoded matrix of transformation cancellation.

[0034] Advantageously, the means further implement at least two of the following three integration steps:

[0035] - integration, within a content server application, of the matrix corresponding inverse encoding matrix of the encoding matrix having been combined with the merged permutation, coding and transformation matrix, such that a data stream encoded by this inverse encoding matrix on a content server is decoded by the encoded permutation, coding and transformation matrix on an encryption server, and vice versa;

[0036] - integration, into the terminal application, of the corresponding encoding matrix inverse of the encoding matrix having been combined with the permutation cancellation matrix, so that a sequence of data encoded by this matrix reverse encoding on the encryption server is decoded by the encoded permutation cancellation matrix on a decryption terminal, and vice versa;

[0037] - integration, within the terminal application, of the corresponding encoding matrix inverse of the encoding matrix having been combined with the transformation cancellation matrix, so that a data sequence encoded by the encoded transformation cancellation matrix is ​​decoded by the inverse encoding matrix, and vice versa.

[0038] Thus, the corresponding inverse encodings are set up "opposite" the integrated masked keys to decode the data encoded by masking these keys. In the case of the public key formed by the merged matrix of permutation, coding and transformation, the fact that it has been encoded and that an inverse encoding matrix is ​​placed upstream makes it possible to split the server, at least on the software level, between a content server, in which the data sequence is encoded by the inverse encoding matrix, and an encryption server, comprising the merged encoded matrix of permutation, coding and transformation. Thus, an attacker intercepting the content intended to be encrypted would come across a data sequence already encoded before it begins to be encrypted by the public key, which further strengthens security.In addition, the content server and the encryption server can now be separated and placed in different locations.

[0039] The invention also provides a method for encrypting data, in which, to encrypt a series of data, computer calculation means implement the following steps:

[0040] - after a merged transformation, coding and permutation matrix, conforming to a McEliece cryptosystem, was combined with an encoding matrix to form an encoded encoding, permutation, and transformation matrix, applying the encoded encoding, permutation, and transformation matrix to the data stream so as to form an encoded, permuted, and transformed data stream;

[0041] - voluntary addition of one or more errors, in accordance with the cryptosystem of McEliece, following encoded, permuted and transformed data, so as to form a sequence of encrypted data.

[0042] Thus, the encryption method includes encryption using a public key, from the McEliece cryptosystem, masked by an encoding matrix, then adding errors in accordance with the McEliece cryptosystem. The encryption method therefore takes advantage of McEliece and encodings to encrypt a data sequence intended to be subsequently decrypted in a white box. The public key corresponding to a combination of private keys, even if it were unmasked, an attacker could not find all the private keys, that is to say the individual matrices of coding, permutation and transformation, since they are merged in this encryption process.

[0043] Advantageously, beforehand, the computer calculation means apply to the data sequence a preliminary encoding matrix inverse to the encoding matrix to form an encoded data sequence, so that, subsequently, the encoded data sequence is decoded by the encoded coding, permutation and transformation matrix at the same time as it is coded, permuted and transformed by this encoded coding and permutation matrix.

[0044] Thus, it is a matter of encoding the data, in particular on a content server, even before the data sequence is encrypted in accordance with the McEliece cryptosystem on an encryption server. The security of the encryption is thus reinforced.

[0045] Advantageously, in addition, the computer calculation means further implement a step of applying a second encoding matrix to the encrypted data sequence, so as to form an encrypted and encoded data sequence.

[0046] Thus, at the output of encryption, the encrypted data sequence is, in addition, encoded. This encoding corresponds to the inverse encoding to which the data sequence will be subjected in the decryption process, inverse encoding making it possible to hide a private key. Therefore, the encoding applied during this encryption process makes it possible to prepare the decryption while further improving the integrity of the data.

[0047] The invention also provides a method for decrypting data, characterized in that, to decrypt an encrypted data sequence, a permutation cancellation matrix, conforming to a McEliece cryptosystem, having been combined with an inverse encoding cancellation matrix of an encoding matrix, previously applied during an encryption operation, to form an encoded permutation cancellation matrix, the calculation means implement a step of applying the encoded permutation cancellation matrix to the encrypted data sequence so as to form a restructured data sequence and the encoding canceled.

[0048] Thus, one of the private keys of the McEliece cryptosystem, formed by the permutation cancellation matrix, is here masked by means of encoding, forming the encoded permutation cancellation matrix. The encoding used to mask this key is the inverse encoding of that used at the output of the encryption. In this way, the data is received in both encrypted and encoded form, to be decoded at the input of the white box while being restructured. The masking of the private key therefore simultaneously contributes to the decoding of this data.

[0049] Preferably, the means implement an error removal step, in accordance with the McEliece cryptosystem, to the restructured data sequence and to the canceled encoding, so as to form a restructured data sequence, to the canceled encoding and corrected.

[0050] Thus, the continuation of the decryption corresponds to a stage of the McEliece cryptosystem, that of error removal.

[0051] Advantageously, the means implement the following steps:

[0052] - application of a decoding matrix, conforming to the McEliece cryptosystem and aimed at decoding data previously encoded during an encryption operation, following restructured data, with cancelled and corrected encoding, so as to form a restructured data sequence, with cancelled, corrected and decoded encoding;

[0053] - a transformation cancellation matrix, conforming to a cryptosystem of McEliece, having been combined with an encoding matrix to form an encoded transformation cancellation matrix, application to the restructured data stream, to the canceled, corrected and decoded encoding of the encoded transformation cancellation matrix, to form a decrypted and encoded data stream.

[0054] Thus, two other private keys of the McEliece cryptosystem, formed here by the decoding matrix to decode the encoded data and by the transformation cancellation matrix, are also hidden, thanks to the encodings. The private keys of the McEliece cryptosystem, present in the white box to decrypt the data, are therefore protected. In addition, the encoding of the transformation cancellation matrix simultaneously allows the decrypted data to be encoded. Thus, the data are decrypted in the white box in accordance with the McEliece cryptosystem and simultaneously encoded at the output of the white box, which improves their security.

[0055] Preferably, the means implement a step of applying, to the deciphered and encoded data sequence, an encoding cancellation matrix, inverse of the encoding matrix used to form the encoded transformation cancellation matrix, so as to form a deciphered data sequence.

[0056] Thus, in the final application, the decrypted and encoded data are decoded so that they can be used.

[0057] The invention also provides a computer program comprising instructions which, when the program is executed by a computer, cause the latter to implement the steps of the method described above.

[0058] Also provided according to the invention is a computer-readable recording medium comprising instructions which, when executed by a computer, cause the latter to implement the steps of the method described above.

[0059] The invention also provides a cryptographic key generation server, comprising computer calculation means capable of implementing a method described above.

[0060] According to the invention, an encryption server is also provided, comprising: computer computing means capable of implementing an encryption method described above to encrypt a series of data.

[0061] The invention also provides a communication terminal, comprising computer calculation means capable of implementing a decryption method described above to decrypt a data sequence.

[0062] The invention also provides a cryptosystem comprising at least one server described above and at least one terminal described above. Brief description of the figures

[0063] The invention will be better understood on reading the following description given solely by way of example and with reference to the appended drawings in which:

[0064] [Fig-1] [Fig.l] is a diagram of the elements forming a cryptosystem according to a embodiment of the invention;

[0065] [Fig.2] [Fig.2] is a diagram of the operations carried out within the cryptosystem of [Fig.l];

[0066] [Fig.3] [Fig.3] is a flowchart of a method for generating keys and encoding the invention;

[0067] [Fig.4] [Fig.4] is a flowchart of an encryption method of the invention;

[0068] [Fig.5] [Fig.5] is a flowchart of a decryption method of the invention. Detailed Description Definitions

[0069] Here, as throughout the description, reference will be made to a data sequence to be encrypted. This data sequence corresponds in particular to a vector or a segment of binary numbers whose content and order form a message. Thus, the data sequence 3 of the preferred embodiment described below corresponds to banking data, structured in a binary data sequence whose order produces a meaning for computer means. However, it may be any type of data, provided that it forms a message in the form of a data sequence whose meaning is defined by its structure, which makes it possible to encrypt the message by adding redundancies at specific locations in the sequence and / or by permuting the data sequence. Of course, the invention is applicable to data other than banking data.

[0070] By "coding", or "encoding", we mean an operation aimed at replacing one or more data in the data sequence with other data according to predetermined rules, for example a sequence of bits with another sequence of bits. The coding rules are specific to the type of coding used; for example, they are those of so-called "Goppa" codes. For convenience, we will continue to refer to "coding" as a coding operation that has been combined with one or more other operations to form a merged operation, because even if this coding operation is then no longer distinguishable from others in the executable code, the operation is performed.

[0071] The term "encoding" refers to the application of another operation, called an encoding operation, to an operation in order to conceal the intended operation. In particular, it involves combining the intended operation with a matrix, called an encoding matrix, in such a way that it is impossible for an attacker to understand what the originally intended operation was. Specifically, when a matrix corresponding to an intended operation is combined with an encoding matrix, only the resulting matrix, called "fused" or "obfuscated," is stored in the relevant memory, so that it is impossible for an attacker to distinguish the initial operation and the encoding in the executable code, the two forming a single matrix.Instead of an encoding matrix, other types of encoding can be used, such as substitution tables to replace truth tables in software memory, thus masking the operation provided by the truth table. Unless otherwise specified, the remainder of the description will apply to any type of encoding that meets the need to mask an operation or a sequence of data. For convenience, we will continue to refer to an encoding operation that has been combined with one or more other operations to form a merged operation, or a "masked" operation, as even if this encoding operation is then no longer distinguishable from the others in the executable code, the operation is carried out. Although an encoding applies to an operation and not to data, we can speak of "encoded data" when a sequence of data is transformed by an operation that is itself encoded.

[0072] The terms "decoding" and "decoding" thus have two possible meanings depending on what they refer to. One corresponds to the decoding of a sequence of data that has been previously encoded by an encoding operation. This involves decoding "encoded" data, that is, recovering the data sequence as it was before encoding, using the encoding rules established for this purpose. The other meaning concerns the decoding of "encoded" data or the decoding of an "encoded" operation. This involves, in particular, using the inverse matrix of the encoding matrix used previously to recover the data sequence or the operation initially intended. The choice of the meaning of the term "decoding" between these two meanings will be specified or will become evident in the following description depending on the context.

[0073] By "key" or "key", we mean a cryptographic key allowing, combined with a predetermined type of algorithm, to encrypt or decrypt data. In the context of asymmetric cryptography, a public key can be accessible to the public, a private key is intended to remain secret, possibly known only to its holder. For the same cryptosystem, a public key encrypts what a private key decrypts, and these keys are distinct from each other.

[0074] In the case where several private keys or several public keys are required, each of these keys is a public key or respectively a private key. However, for convenience, the set of public keys or private keys may be designated as forming a single private key or public key.

[0075] Finally, it will be understood that if a matrix is ​​accessible, that is to say can be read, its inverse matrix is ​​easily calculable, if it exists. In other words, knowing an invertible matrix A also means knowing the matrix A4, the inverse matrix of the matrix A.

[0076] We will now recall certain elements of a cryptosystem known from the state of the art, the McEliece cryptosystem. McEliece's Cryptosystem

[0077] The McEliece cryptosystem is an asymmetric encryption scheme, invented in 1978 by Robert McEliece and based in particular on code theory, with the use of “Goppa codes”. Only the notions of this cryptosystem useful for the description of the present embodiment are briefly recalled below.

[0078] When generating keys in accordance with the McEliece cryptosystem, computer calculation means generate matrices which are conventionally called G, P and S. The matrix G aims to encode a sequence of data to be encrypted, using Goppa codes. The matrix P aims to permute the data of a data sequence, that is to say to modify the order of the data in the data sequence, for example the order of bits in a bit sequence. The structure of the data sequence to be encrypted is therefore modified by P. The matrix S is a random matrix whose specifications are specific to the McEliece system and which corresponds to a linear application using neither a Goppa code nor a specific permutation.

[0079] The computing means also generate the inverse matrices of these matrices S, G, and P, that is, the matrices S1, G1, and P*. The matrices S, G, and P, and possibly their inverse matrices, can be considered as forming three or six private keys (depending on whether a matrix and its inverse are considered as one or two keys) of the McEliece cryptosystem. Alternatively, these matrices can be considered as forming a single private key that includes all of them independently of each other. This private key is then conventionally named (S, G, P). Both considerations are equivalent and valid. The computing means also generate the matrix SGP by multiplying the three matrices S, G, and P together. The SGP matrix can be considered as a multiplication or combination of the S, G and P matrices, forming a merged SGP matrix making the S, G and P matrices indistinguishable independently of each other.This SGP matrix forms the public key of the . McEliece cryptosystem. This key is not necessarily intended to be revealed, but it can be made more easily accessible to a third-party server wishing to encrypt data, while the private keys S, G and P must remain secret.

[0080] To summarize, after generating the keys, we obtain a private key (S, G, P) (or equivalently private keys S, S1, G, G', P, P*) and a public key SGP. These keys are then combined with encryption and decryption algorithms described below.

[0081] We will now recall the encryption steps according to the McEliece cryptosystem.

[0082] To encrypt the data sequence, the public key is used. In other words, the computing means apply the SGP matrix to the data sequence, in the form of a multiplication. The multiplication rules being adapted to the data type of the data sequence, it can be an operation in the binary Galois body for binary data, or in the body of real numbers or other types of application, the McEliece cryptosystem not being dependent on a type of multiplication. Multiplying this data sequence by the SGP matrix amounts to, simultaneously, encoding the sequence by the operations of the G matrix masked in the SGP matrix and permuting the data of the sequence by the operations of the P matrix masked in this merged SGP matrix, while applying the linear transformation operations of the S matrix also masked in this SGP matrix.

[0083] Finally, the calculation means voluntarily add one or more errors to the encoded and permuted data sequence. This encoded, permuted, and erroneous data sequence is thus the data sequence encrypted in accordance with the McEliece cryptosystem.

[0084] This encryption generally takes place on a server intended to encrypt data before communicating it to a remotely located device, for example a smartphone-type communication terminal. The computing means mentioned are therefore those of this server.

[0085] We will now recall the decryption steps according to the McEliece cryptosystem, which are carried out on the device receiving the encrypted data.

[0086] To decrypt the encrypted data sequence received by the peripheral, the latter's own computing means use the private key (S, G, P). Concretely, the encrypted data sequence is multiplied by the matrix (or private key) P *, which makes it possible to permute the data of the sequence in a manner inverse to the permutation generated by the SGP key. The original permutation being inverted, the computing means recover the original structure of the data sequence. Since this original structure is recovered, the means can correct this data sequence, that is to say identify and remove the errors added voluntarily during encryption. This correction is carried out in accordance with any known fast correction algorithm errors. The encrypted data sequence that arrived has now regained its initial structure and has been "corrected". Then, the matrix Gr1 is applied in turn, then the matrix S1, the matrix G1 allowing the encoded data sequence to be decoded using the coding of the matrix G during encryption, the matrix S1 allowing the linear transformation of the matrix S to be canceled during encryption. The data sequence, which arrived encrypted on the device, is therefore reversed, corrected, and now decoded. It is therefore decrypted and corresponds to the data sequence as it was, "in clear", before encryption. It should be noted that, here, the term "decoded" refers to the inverse of an "encoding" operation.

[0087] Of course, encryption operations can be performed on the terminal side and decryption operations on the server side if the SGP public key is located on the terminal side and the private key (S, G, P) on the server side.

[0088] It is recalled that one of the advantages of asymmetric encryption, as permitted by the McEliece cryptosystem, is that the public key, here the SGP matrix, can be accessible and known to all without compromising the security of the encryption. Thus, a third party wishing to send an encrypted message becomes aware of the SGP public key corresponding to the desired interlocutor, and encrypts his data sequence using this public key. Only the interlocutor having the private key (S, G, P), that is to say each of these three matrices independently of each other, can, using the inverse matrices of these matrices S, G and P, decrypt the message. In the case of use of the public key on the server side, a leak of the algorithm of this server is not detrimental, since this server does not have the matrices S, G and P but only the SGP matrix which does not allow the matrices S, G and P to be found.

[0089] Finally, one of the interests now associated with the McEliece cryptosystem is its robustness with respect to future so-called "quantum" attacks, as demonstrated by the candidate algorithm "Classic Mc Eliece", based on this cryptosystem, during the "Post-Quantum Cryptography" competition organized by the "National Institute of Standards and Technology" (NIST) from 2016 with a view to establishing "quantum-resistant" public key algorithms.

[0090] Cryptosystem according to a preferred embodiment of the invention

[0091] The components of the cryptosystem according to a preferred embodiment of the invention will now be described. The elements forming this system are illustrated in [Fig.l], the operations carried out within this system in [Fig.2].

[0092] The cryptosystem 21 of figures 1 and 2 includes a server 1 and a communication terminal 2 which here takes the form of a smartphone.

[0093] In this example, server 1 is a banking server capable of encrypting and communicating banking data such as data sequence 3 in [Fig. 2], but it could be another type of server. Server 1 includes computing means in conventional computing means 23 such as processors and memories. These computer computing means 23 make it possible to automate computing operations, in particular encryption. Thus, these means 23 are configured to automatically execute the steps of a computer program 24 recorded in the server 1 in the form of an executable code. This program 24 allows the encryption of the data 3. The server 1 is itself divided, in software terms, between a content server 11 and an encryption server 12, which use the same computer computing means 23. Thus, part of the code 24 is executable on the server 11, another part on the server 12, which makes it possible to encode data on the server 11, then to encrypt this data on the server 12.Server 1 also includes conventional means of communication, such as an Internet connection and communication programs, enabling the communication of a series of encrypted data to the outside, in particular to terminal 2.

[0094] In an unillustrated variant, device 11 and device 12 are two physically separate computers which communicate by conventional means and use their respective computing means.

[0095] As will be seen below, and as illustrated in [Fig. 2], the code 24 allows the encryption of a data sequence 3 on the server 1, by the calculation means 23. These encryption steps, executed by the calculation means 23 in accordance with the instructions of the code 24, concern, on the content server 11, an encoding operation 4 of the data 3. On the server 12, the executable code 24 requires a plurality of simultaneous operations on the sequence 3: this is an encoding 5 in a manner inverse to the encoding 4 and, simultaneously, the carrying out of permutations, coding and transformation by means of a key 6. The means 23 are then invited by the code 24 to carry out an operation 7 of adding an error and an encoding operation 8 on the sequence 3, before sending the encrypted data 3 to the server 12. smartphone 2. All of these operations, executed by the computing means 23 in accordance with the instructions of the code 24, will be described in more detail below.

[0096] The communication terminal 2 includes conventional computer calculation means 26 such as processors and memories. These means 26 make it possible to automate calculation operations, in particular decryption. Thus, these means 26 are configured to automatically execute the steps of a computer program 25 recorded in the smartphone in the form of an executable code. On the software level, the executable code 25 is divided into two parts, between a code corresponding to a decryption algorithm 22 and a code corresponding to a final application 19. The smartphone 2 also includes conventional communication means, such as an Internet connection and communication programs, making it possible to communicate with the outside world, for example to receive a series 3 data encrypted by server 1.

[0097] As will be seen below, and as illustrated in [Fig. 2], the algorithm 22, implemented by the means 26 in accordance with the steps of the code 25, is the white box containing cryptographic keys whose integrity must be protected. Thus, when executed by the means 26, this algorithm 22 performs, on the data sequence 3 received in encrypted and encoded form, simultaneous operations of encoding 9 and permutation using a private key 13. The encoding 9 corresponds to the inverse of the encoding 8, that is to say, to its decoding. The permutations of key 13 correspond to the inverse of the permutations of key 6. It should be noted that encoding 8, on server side 1, is therefore an external encoding of white box 22, while encoding 9 is the corresponding inverse encoding located in the white box.The white box 22, when executed by the computing means 26, also includes an error correction operation 14 to correct errors intentionally added to the data 3 by the error insertion operation 7. Algorithm 22 also includes a decoding operation using a private key 15; decoding by this key 15 is the inverse of encoding by key 6. This algorithm 22 also includes a final decryption operation using the private key 16, the inverse of the transformation performed by key 6, and carried out simultaneously with an encoding 17. We will return to these operations, performed on the smartphone 2 by the means 26, later.

[0098] The calculation means 25 are also invited by the executable code 24 to execute an application 19, which is a final payment application used by the holder of the smartphone 2. Thus, when the data 3 are decrypted and encoded by the calculation means 26 in accordance with the white box 22, the code of the application 19 leads these means 26 to carry out an encoding operation 18, which consists of a decoding operation inverse to the encoding operation 17, which makes it possible to decode the data. The encoding 18 is therefore an encoding external to the white box 22, corresponding inversely to the encoding 17 of the white box.

[0099] Once these operations have been carried out, the data 3 are therefore in clear and decoded within the application 19 and can be used, in particular for the purpose of a bank payment, by the user of the smartphone 2.

[0100] It should be noted that the application 19 is not sold to a user independently of the white box 22; these two software components together form the executed code 25. It is the developer, or development company, of the final application 19 who generally acquires the white box 22, which is sold in the form of software libraries. The source code of the application 19 therefore includes calls via an API (for "Application Interface Programming") to the algorithm 22 to control the execution of this algorithm. When the user downloads and installs their application plication, this therefore includes the final application 19 and the white box 22 attached to it, in the form of a single code 25.

[0101] We will now return to certain operations of this cryptosystem 21 illustrated in [Fig.2], making regular reference to the operations of the McEliece cryptosystem described above.

[0102] First of all, encoding 4 corresponds to an encoding matrix which will be called J. Thus, the data sequence 3 is encoded by means of the encoding matrix J in the encryption server 11.

[0103] At encoding 5, at the start of encryption server 12, corresponds matrix J, the inverse matrix of matrix J.

[0104] Public key 6 is the SGP matrix as defined in the McEliece cryptosystem. However, in this cryptosystem 21, this SGP matrix is ​​combined with the J 1 matrix to form a merged J 'SGP matrix. In other words, the data 3 encoded at the output of the content server 11 by the J matrix have the J 'SGP matrix applied to it, which will therefore not only encode and permute this data in accordance with the McEliece cryptosystem, but also decode the data in accordance with the J ' matrix, simultaneously. It should be noted that, as a result, public key 6 is masked within the server 11 by the J ' encoding. Indeed, the encoding of the SGP matrix by the J 1 matrix makes any distinction between these matrices impossible for an attacker having the executable code implemented in the server 12.Furthermore, the J-encoding hides the data between the content server 11 and the encryption server 12, while the J-encoding 1 is not accessible to an attacker because it is hidden within the J-matrix SGP.

[0105] To encoding 8, corresponds an encoding matrix which we will call F.

[0106] At encoding 9, at the input of white box 22 on terminal 2 side, corresponds the matrix F ', the inverse matrix of the matrix F.

[0107] The private key 13 corresponds to the matrix P 1 as defined in the McEliece cryptosystem, allowing the data to be permuted inversely with respect to the permutations of P and therefore of SGP. However, in this cryptosystem 21, this matrix P 1 is combined with the matrix F 1 to form a merged matrix F 'P '. Thus, the matrix P ', and therefore the matrix P and generally the private key 13, is masked by the encoding 9 thanks to the matrix F '.

[0108] The private key 15 corresponds to the matrix G 1 as defined in the McEliece cryptosystem.

[0109] To encoding 17, corresponds an encoding matrix which we will call H.

[0110] The private key 16 corresponds to the matrix S 1 as defined in the McEliece cryptosystem. However, in the cryptosystem 21, this matrix S 1 is combined with the matrix H to form a merged matrix S 'H. Thus, the matrix S ', and therefore the matrix S and the private key 16, is hidden by the encoding H.

[0111] Finally, in the final application 19, the matrix H1 corresponds to the encoding 18.

[0112] It can be deduced that an attacker having the executable code can only identify the operations of the matrix G', since it is the only matrix not to be masked. In other words, the private key 15 is identifiable. On the other hand, the operations of the matrices P1 and S1, that is to say the keys 13 and 16, are masked by respective encodings 9 and 17. In other words, among the three private keys, this embodiment masks two, while on the server side, an encoding 5 masks the public key 6.

[0113] In the following, we can speak indifferently of a key or its corresponding matrix. Similarly, we will speak indifferently of an encoding, a decoding, and their corresponding matrix.

[0114] We will now describe processes implementing the elements presented above.

[0115] Key generation and combination with encodings

[0116] The method 100, illustrated in [Fig. 3], aims to install the cryptosystem 21 on server 1 and terminal 2. It is implemented by the computing resources of smartphone 2, server 1, or even by independent resources located on a separate server. The location and methods of initialization are not specific to the described method. Therefore, any computing resource implementing this method will generally be referred to as a "resource" that performs these operations automatically, regardless of its location.

[0117] In step 10, a user installs the payment application 19 on his smartphone 2. So that the data 3 of the data series can be protected, the following steps are then implemented automatically.

[0118] In step 20, the means generate the matrices S, G and P. They are determined in accordance with the specifications of the McEliece cryptosystem. The means also calculate their inverses S1, G 1 and P *. In other words, the private keys 13, 15 and 16 are generated.

[0119] In step 30, the means determine the matrix J and its inverse J1, the matrix F and its inverse F*, and then the matrix H and its inverse H1. To do this, the matrices J, F, and H are determined in such a way as to be able to encode and decode correspondingly any sequence of data passing through the cryptosystem 21. Their terms are random; the only requirement is that these matrices be invertible, so that the means generate the inverse matrices. In other words, encodings 4, 5, 8, 9, 17, and 18 are generated.

[0120] In step 40, the means combine, i.e. multiply together, some of the generated matrices. Thus, the matrices J *, S, G and P are combined to form the merged matrix J 'SGP. The matrices F 1 and P 1 are combined to form the merged matrix F 'P 1. The matrices S 1 and H are combined to form the matrix S 'H.

[0121] In step 50, the matrices are placed at specific locations in the cryptosystem 21.

[0122] Thus, the matrix J is placed on the content server 11 to form the encoding 4, The matrix J'SGP is placed at the input of the encryption server 12 to form the simultaneous operation of encoding 5 and permutation-encoding-transformation by the public key 6. The matrix F is placed at the output of the encryption server 12 to form the encoding 8. The matrix F'P 1 is placed at the input of the white box 22, on the terminal 2, to form the simultaneous operation of decoding 9 and inverse permutation by means of the private key 13. The matrix G 1 is placed at the heart of the white box 22, and forms the private key 15 used to decode the data. The matrix S 1 H, forming the private key 16 and the encoding 17, is placed at the output of the white box 22 to complete the decryption while encoding the data according to the encoding 17. Finally, the matrix H 1 is placed at the input of the final application 19 to decode the data.

[0123] Cryptosystem 21 is now in place. As a reminder, two out of three private keys, keys 13 and 16, are masked and the public key 6 is also masked, thanks to the encodings.

[0124] In terms of resource usage, this key generation method is more expensive than McEliece's since more matrices are generated and combined. However, the four matrices J, FH and S correspond to linear transformations, so it is sufficient to generate these four matrices randomly, provided that they are invertible. No other complex calculations are necessary. Encryption process

[0125] We will now describe a method 200 for encrypting the data sequence 3, carried out on the server 1, with reference to [Fig.2] and [Fig.4]. It is implemented when the use of the final application 19 requires the sending of encrypted data from the server 1, in this case banking data to settle a payment.

[0126] In step 60, the first step of this encryption method, the data sequence 3 is encoded on the content server 11 by encoding 4, that is to say concretely by means of the encoding matrix J. The data sequence 3 is therefore now encoded. The presence of this encoding 4 makes it possible to divide the server 1 into two: a content server 11 and an encryption server 12. Thus, if an attacker tries to intercept the data before their encryption on the encryption server 12, he only obtains encoded data, which he cannot decode without having J or J '. However, J is located on the content server 11 side, and J 1 is hidden in the J 'SGP matrix.

[0127] In step 70, the encoded data sequence 3 has the matrix J 'SGP applied to it, that is to say that this sequence, forming a vector, is multiplied by the matrix J 1SGP. The operation results in a sequence of data 3 decoded with respect to the encoding 4, thanks to the operations of J 1 hidden in this matrix, but also and simultaneously transformed by S, coded by G and to the data permuted by P.

[0128] In step 80, the transformed, coded and permuted data sequence 3 has one or more errors added by the error addition module 7. The data sequence is therefore now transformed, coded, with permuted data, then “voluntarily erroneous”: it is therefore encrypted in accordance with the McEliece cryptosystem.

[0129] In step 90, this encrypted data sequence 3 is encoded by encoding 8 using the encoding matrix F. The data sequence 3 is therefore encrypted and encoded.

[0130] Server 1 then communicates this encrypted data sequence to terminal 2.

[0131] In terms of resource usage, this method is more expensive than McEliece's since encoding 8 is added at the end of the server. However, adding encoding 5 has no impact since it is combined with public key 6. Furthermore, since this method takes place on the server, the latter can easily be sized to be adapted to it. Decryption process

[0132] We will now describe a decryption method 300, with reference to figures 2 and 5. It is carried out on the smartphone 2, within the white box 22, and targets the data 3 received in encrypted and encoded form.

[0133] At step 110, the decoding operation 9 and the private key 13 simultaneously decode and permute the data in the dataset 3. The decoding operations are performed by the operations of the matrix F*, and the permutation operations are performed by the matrix P*. All of these operations are performed simultaneously via the matrix F'P1 applied to the dataset 3. The dataset 3 is thus decoded and permuted to recover its original structure. It remains "intentionally erroneous," encoded, and transformed. An attacker who gained knowledge of the executable code of this operation would not be able to distinguish F1 from P*. Furthermore, since the encoding F is located solely on the server, there is no access to the white box 22, and the attacker would not be able to recover P1 from the matrix F*P*. Consequently, the attacker would not be able to identify the private key 13 formed by the matrix P*. Private key 13 is therefore masked by encoding 9.

[0134] In step 120, the error correction module 14 identifies and removes errors from the data sequence 3. Any correction algorithm can be implemented for this purpose. This rapid correction is made possible by the fact that the original structure of the data sequence has been found after the inverse permutation operations of P 1 masked in F *P *. The data sequence therefore now remains only coded and transformed in accordance with the operations of the matrix G and S by J 'SGP.

[0135] In step 130, the private key 15 is used in the form of the matrix GA for decode the data sequence in such a way that the coding operations of G hidden within the matrix J 'SGP are reversed. The data sequence therefore now remains only transformed by the operations of S within J 'SGP.

[0136] Finally, in step 140, this data sequence is simultaneously transformed by S1, forming the private key 16, and encoded by H, forming the encoding 17, within the matrix S 'H. The masked operations of S 1 therefore finish decrypting the data sequence in accordance with the McEliece cryptosystem, while H encodes this data. The encoding H has two functions. It makes it possible to mask the operations of S1, so that an attacker accessing this matrix S 'H cannot identify S1. The private key 16 is therefore masked by the encoding 17. In addition, this H encoding prevents the data sequence 3 from circulating in plain text between the white box 22 and the final payment application 19. Thus, an attacker trying to intercept the data at the exit of the white box would not be able to identify the data, nor the key 16.

[0137] At step 150, implemented on the final application 19, the inverse encoding 18 makes it possible to decode the data.

[0138] The final application 19 can then use them to carry out the requested bank settlement, for example.

[0139] In terms of resource usage, this decryption method is no more expensive than McEliece's, which is very advantageous since it is implemented on a mobile terminal. Indeed, encodings 9 and 17 are used at the same time as keys 13 and 16.

[0140] Of course, the encryption and decryption processes can be reversed, with decryption taking place on the server and encryption on terminal 2, provided that the encodings initially placed on the server are then placed on terminal 2, and those of terminal 2 are placed on the server. The process then remains the same. Other technical effects

[0141] The invention therefore takes advantage of the combination between the operations defined in the McEliece cryptosystem and the encodings of these operations to protect the integrity of the encryption of the white box 22.

[0142] In particular, the user's private keys, stored on the white box 22, are protected even in the event of a leak of the algorithm located on the server 11. Indeed, even if the matrix J'SGP is identified by an attacker, he cannot deduce the matrices S, G and P and therefore their inverse matrices allowing the decryption of the data on the smartphone 2. This is still the case even if J 1 is identified.

[0143] Furthermore, on the white box 22, the private keys 13 and 16, formed by the matrices P 1 and S 1 are masked respectively by the matrices F 1 and H of the encodings 9 and 13. An attacker having the executable code of the white box 22 cannot therefore identify keys 13 and 16.

[0144] The cryptosystem 21 therefore specifically protects the integrity of the white box encryption.

[0145] Furthermore, it should also be recalled that the external encodings 8 (matrix F) and 18 (matrix H1), located respectively on the server 11 and the final application 19, make any porting of code from the white box 22 ineffective, since it is necessary to have these encodings to identify the encoding 9 (matrix F1) masking the key 13 (matrix P') and the encoding 17 (matrix H) masking the key 16 (matrix S).

[0146] Finally, as mentioned above, encodings 4 and 5, associated with matrix J, make it possible to divide server 1 into two separate servers: a content server 11 and an encryption server 12, to thus encode the data before they are encrypted. This also makes it possible to mask the SGP operations, thanks to matrix J 'SGP. In this way, if the algorithm of encryption server 12 leaks, encoding 5 continues to mask key 6, while if content server 11 is attacked, the data and encoding 4 remain unidentifiable.

[0147] Furthermore, the operations of the matrices G and P conforming to the McEliece cryptosystem, within the SGP matrix and therefore here of the J 'SGP matrix, offer robustness against future quantum attacks which is preserved here, the encodings do not modify these operations but aim to mask them. The cryptosystem 21 therefore makes it possible to protect the integrity of the white box encryption while making this white box robust against future quantum attacks.

[0148] Finally, in general, cryptosystem 21 associates three encoding pairs with the McEliece cryptosystem: encodings 4 and 5, encodings 8 and 9, and encodings 17 and 18. The position of these encodings in cryptosystem 21 makes it robust even in the event of a leak of one of these pairs, for any attacker having all of the executable code. Indeed, in the event of a leak of the encoding pair 4 and 5, that is to say if an attacker manages to identify the operations of the matrix J and therefore of the matrix J 1 on the server, the attacker can deduce from the matrix J 'SGP the operations of an SGP matrix. Thus, the public key conforming to the McEliece cryptosystem is unmasked. However, even with access to this SGP matrix and the plaintext G matrix in white box 22, this attacker cannot identify the operations of matrices S and P. Private keys 13 and 16 therefore remain secret.Alternatively, in the event of leakage of the pair of encodings 8 and 9, that is to say if the attacker manages to identify the operations of the matrix F (and its inverse), he can deduce the operations of the matrix P thanks to access to the matrix F 'P1 on the white box 22. He therefore deduces the key 13. But he cannot deduce the operations of the matrix S, therefore of the key 16. Finally, alternatively, in the event of leakage of the encodings 17 or 18, therefore of the matrix H, the key 16 is identified through the matrix S 'H. But the key 13, . that is, the matrix P, remains unidentifiable. Thus, in these three cases, a leak of one of the three pairs of encodings does not allow the attacker to access all the secret keys formed by the matrices S, G and P and their inverses.

[0149] This is why the following three variants are possible.

[0150] Thus, in a variant not illustrated, encodings 4 and 5 are non-existent. Server 1 is unified. Since matrix J does not exist, the data to be encrypted are directly SGP multiplied. The advantages described above all remain valid, except those associated with encodings 4 and 5. Public key 6 is therefore not masked here, but secret keys 13 and 16 remain preserved.

[0151] In another variant, encodings 8 and 9 are absent. This time, the public key 6 therefore remains masked by encoding 5, but the key 13 can be identified by an attacker with the white box 22. However, the key 16 remains secret.

[0152] Finally, in the third variant, encodings 17 and 18 are non-existent, so that it is key 16 which can be identified, but the public key and private key 13 remain secret.

[0153] In a fourth variant not illustrated, instead of removing an encoding pair and therefore making one of the keys identifiable by an attacker, an encoding pair is added to mask the secret key 15 in the white box 22. In particular, an encoding matrix K can be combined with the matrix G 1 to form a matrix G 1 K, then the matrix K1 can be combined with the matrix S 'H to form a matrix S *HK *. Thanks to this variant, each key is masked, and an attacker needs to identify not two but three encoding pairs to identify each of the secret keys. The security of the encryption is therefore further reinforced, at the cost of additional resources during the generation of the keys and the associated encodings.

[0154] The invention is not limited to the embodiments presented and other embodiments will become clear to those skilled in the art. It is in particular possible to replace the encoding matrices with any other form of encoding, for example substitution tables taking the place of truth tables in the executable code.

Claims

Claims

1. Method (100) for generating a cryptographic key, implemented by computer computing means (23, 26), in which the following steps are carried out: - generation (20) of a permutation matrix (P), a coding matrix (G) and a linear transformation matrix (S), the three matrices being in accordance with a McEliece cryptosystem; - generation (20) of an inverse permutation cancellation matrix (P 1 ) of the permutation matrix (P), an inverse coding cancellation matrix (G ') of the coding matrix (G), and an inverse transformation cancellation matrix (S1) of the linear transformation matrix (S), the three cancellation matrices (S1, G1, P1) being in accordance with the McEliece cryptosystem; - combination (40) of the permutation matrix (P) with the coding matrix (G) and with the linear transformation matrix (S), to form a merged permutation matrix,coding and transformation (SGP) matrix according to the McEliece cryptosystem, characterized in that the computer computing means (23, 26) implement a generation step (30) of at least two random encoding matrices (J1, F *, H), the computer computing means (23, 26) further implementing at least two of the following three combination steps: - combination of one of the random encoding matrices (J ') with the merged permutation, coding and transformation (SGP) matrix, to form an encoded permutation, coding and transformation matrix (J 'SGP), - combination of one of the other random encoding matrices (F ') with the permutation cancellation matrix (P ') to form an encoded permutation cancellation matrix (F 'P '), - combination of one of the other random encoding matrices (H) with the transformation cancellation matrix (S') to form an encoded transformation cancellation matrix (S'H).,

2. Method (100) according to the preceding claim, in which the computer calculation means (23, 26) implement the three combination steps (50).

3. Method (100) according to the preceding claim, in which, for each generated random encoding matrix (J ', F ', H), the means of calculation (23, 26) implement a step of determining (30) a corresponding inverse encoding matrix (J, F, H1) of said random encoding matrix, so that a sequence of data encoded by said random encoding matrix (F1, F *, H) is decoded by the corresponding inverse encoding matrix (J, F, H1), and vice versa.

4. Method (100) according to any one of the preceding claims, in which the computer calculation means (23, 26) further implement at least two of the following three integration steps (50): - integration, within an application for an encryption server (12), of the encoded permutation, coding and transformation matrix (J * SGP); - integration, within an application for a decryption terminal (2), of the encoded permutation cancellation matrix (F * P '); - integration, within the terminal application (2), of the encoded transformation cancellation matrix (S 'H).

5. Method (100) according to at least claims 3 and 4, wherein the means (23, 26) further implement at least two of the following three integration steps (50): - integration, within a content server application (11), of the inverse corresponding encoding matrix (J) of the encoding matrix (J ') having been combined with the merged permutation, coding and transformation (SGP) matrix, so that a data sequence encoded by this inverse encoding matrix (J) on a content server (11) is decoded by the encoded permutation, coding and transformation (J 'SGP) matrix on an encryption server (12);- integration, into the terminal application (2), of the corresponding inverse encoding matrix (F) of the encoding matrix (F ') having been combined with the permutation cancellation matrix (P1), so that a data sequence encoded by this inverse encoding matrix (F) on the encryption server (12) is decoded by the encoded permutation cancellation matrix (F 'P ') on a decryption terminal (2); - integration, within the terminal application (2), of the corresponding inverse encoding matrix (H ') of the encoding matrix having (H) been combined with the transformation cancellation matrix (S '), so that a data sequence encoded by the encoded transformation cancellation matrix (S 'H) is decoded by the matrix; reverse encoding (H1).

6. Method for encrypting (200) data, characterized in that, to encrypt a data sequence, computer calculation means (23) implement the following steps: - after a merged transformation, coding and permutation matrix (SGP), in accordance with a McEliece cryptosystem, has been combined with an encoding matrix (J1) to form an encoded coding, permutation and transformation matrix (J *SGP), applying (70) the encoded coding, permutation and transformation matrix (J 1 SGP) to the data sequence so as to form a coded, permuted and transformed data sequence; - intentionally adding one or more errors (80), in accordance with the McEliece cryptosystem, to the coded, permuted and transformed data sequence, so as to form an encrypted data sequence.

7. Method (200) according to the preceding claim, in which, beforehand, the computer calculation means (23) apply to the data sequence a preliminary encoding matrix (J) inverse to the encoding matrix (J1) to form an encoded data sequence, so that, subsequently, the encoded data sequence is decoded by the encoded coding, permutation and transformation matrix (J *SGP), at the same time as it is coded, permuted and transformed by this encoded coding and permutation matrix.

8. Method (200) according to any one of claims 6 and 7, wherein, in addition, the computer calculation means (23, 26) further implement a step of applying (90) a second encoding matrix (F) to the encrypted data sequence, so as to form an encrypted and encoded data sequence.

9. Method for decrypting (300) data, characterized in that, to decrypt an encrypted data sequence, a permutation cancellation matrix (P *), conforming to a McEliece cryptosystem, having been combined with an inverse encoding cancellation matrix (F1) of an encoding matrix (F), previously applied during an encryption operation (90), to form an encoded permutation cancellation matrix (F *P *), the calculation means (26) implement a step of applying to the encrypted data sequence the encoded permutation cancellation matrix (F *P *) so as to form a restructured data sequence and the encoding canceled.

10. Method (300) according to the preceding claim, in which the means implement an error removal step (120), consistent with the McEliece cryptosystem, on the restructured data sequence and the canceled encoding, so as to form a restructured data sequence, with the canceled encoding and corrected.

11. Method (300) according to any one of claims 9 and 10, in which the means (26) implement the following steps: - application (130) of a decoding matrix (G '), conforming to the McEliece cryptosystem and aiming to decode data previously coded during an encryption operation, to the sequence of restructured data, with the encoding canceled and corrected, so as to form a sequence of restructured data, with the encoding canceled, corrected and decoded; - a transformation cancellation matrix (S1), conforming to a McEliece cryptosystem, having been combined with an encoding matrix (H) to form an encoded transformation cancellation matrix (S * H), application (140) to the restructured data sequence, to the canceled, corrected and decoded encoding, of the encoded transformation cancellation matrix, to form a decrypted and encoded data sequence.

12. Method (300) according to the preceding claim, in which the means (26) implement a step of applying (150), to the sequence of decrypted and encoded data, an encoding cancellation matrix (H '), inverse of the encoding matrix (H) used to form the encoded transformation cancellation matrix (S * H), so as to form a sequence of decrypted data.

13. A computer program (24, 25) comprising instructions which, when the program is executed by a computer, cause the computer to implement the steps of the method (100, 200, 300) according to any one of claims 1 to 12.

14. A computer-readable recording medium (23, 26) comprising instructions which, when executed by a computer, cause the computer to carry out the steps of the method (100, 200, 300) according to any one of claims 1 to 12.

15. Cryptographic key generation server, comprising computer computing means (23, 26) capable of implementing a method (100) according to at least one of claims 1 to 5.

16. Encryption server (12), comprising computer calculation means (23) capable of implementing a method (200) according to at least one of claims 6 to 8 for encrypting a data sequence.

17. Communication terminal (2), comprising computer calculation means (26) capable of implementing a method (300) according to at least one of claims 9 to 12 for decrypting a data sequence.

18. Cryptosystem (21) comprising at least one server (12) according to claim 15 or 16 and at least one terminal (2) according to claim 17.

Images