Method of hashing input data into output data and associated electronic device.

Abstract

Hashing method with a cryptographic function (F) for encryption or decryption associating an output block with an input block by successive transformations of intermediate data initialized with the input block, the method comprising a series of at least one iteration of the following steps:- Obtaining a result (R1,j) by a first application of the cryptographic function to a first parameter (P1,j);- Obtaining another result (R2,j) by a second application of the cryptographic function to a second parameter (P2,j) equal to the combination by "exclusive or" of a constant (C1) and the first parameter;the method being characterized in that for an intermediate data item, during an application of the cryptographic function of an iteration, a state of the intermediate data item is obtained by the implementation, during the other application of the cryptographic function of said one iteration, of a determined transformation to the intermediate data. Figure for the abstract: fig. 7.;

Description

Title of the invention: Method for hashing input data into output data and associated electronic device.

[0001] The present invention relates to a method for hashing an input data into an output data with a block cipher or block decipher cryptographic function, and an associated electronic device.

[0002] Hash functions are very useful for building secure cryptosystems, especially because of their properties, such as collision resistance and preimage resistance.

[0003] Several hash-specific functions have been defined, for example the hash functions of the SHA-2 family (SHA being the acronym for “Secure Hash Algorithm” in English terminology) designed by the United States National Security Agency and described by the National Institute of Standards and Technology (NIST), for example in the document “Federal Information Processing Standards Publication 180-4” of August 2015.

[0004] Another possibility is to use a hashing method constructed from a block cipher cryptographic function.

[0005] Some constructions are based on a compression function introduced by S.Hirose in the paper “Some Plausible Constructions of Double-Block-Length Hash Functions”, FSE 2006, for example the MDPH construction (for Merkle-Damgârd with permutation domain extender by Hirose et al) as described in the paper S. Hirose,, JH Park, A. Yun, “A simple variant of the Merkle-Damgârd scheme with a permutation”, In: Kurosawa, K. (ed.), ASIACRYPT 2007 LNCS, vol 4833, pp 113-129, Springer, Heidelberg, Germany, Kuching, Malaysia (Dec 2-6, 2007).

[0006] Such methods can be implemented by an electronic device.

[0007] However, they are not entirely satisfactory insofar as such constructions place too much strain on the electronic device, particularly in terms of computational resources.

[0008] To overcome these drawbacks, the present invention proposes, according to a first aspect, a method for hashing an input data item into an output data item with a cryptographic function of block encryption or block decryption, the cryptographic function associating an output block with an input block by successive transformations of intermediate data initialized with the input block, at least one of the successive transformations depending on a cryptographic key, the method being implemented by an electronic device and the method comprising a ordered sequence of at least one iteration of the following two steps, the sequence beginning with a first iteration and ending with a last iteration: - obtaining a first result by a first application of the cryptographic function to a first parameter with an intermediate key; the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the first application of the cryptographic function; - obtaining a second result by a second application of the cryptographic function with the intermediate key, to a second parameter equal to the combination by "exclusive or" of a predetermined constant and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the second application of the cryptographic function; the method further comprising a step of determining the output data by an “exclusive or” operation between the first parameter and the first result of the last iteration of the sequence, and by an “exclusive or” operation between the second parameter and the second result of said last iteration; and the method being characterized in that for an intermediate data item selected from among the intermediate data, during an application of the cryptographic function, called reduced application, among the first application and the second application of an iteration of the sequence, a state of the selected intermediate data item, resulting from a transformation determined among the successive transformations, is obtained by the implementation during the other application, called complete application, among the first application and the second application of said one iteration of the sequence, of the transformation determined to the intermediate data.

[0009] Other advantageous and non-limiting characteristics of the method according to the invention, taken individually or in all technically possible combinations, are the following: - the selected intermediate data and the state of the selected intermediate data are selected according to the predetermined constant; - for a first other intermediate data selected from among the intermediate data, during the reduced application of the cryptographic function, a state of the first other intermediate data selected, resulting from a second transformation among the successive transformations, is obtained by the implementation, during the complete application of the cryptographic function, of the second transformation to the intermediate data; - the first other selected intermediate data and the state of the first other selected intermediate data are selected according to the predetermined constant- finished; - during the reduced application of the cryptographic function, another state of the selected intermediate data, resulting from another transformation among the successive transformations, is obtained by the implementation, during the complete application of the cryptographic function, of the other transformation to the intermediate data, the other transformation being distinct from the determined transformation; - the selected intermediate data and the other state of the selected intermediate data are selected according to the predetermined constant; - the predetermined constant is a power of two; - the sequence comprises only one iteration of the step of obtaining a first result and obtaining a second result, the intermediate key comprises at least part of the input data, and the first parameter is a first part of a hash key or the result of the combination by "exclusive or" of another predetermined constant and the first part of the hash key; - the intermediate key is the result of the concatenation of at least one part of the input data and a second part of the hash key; - the hash key has a value other than 0; - the sequence comprises a plurality of iterations of the step of obtaining a first result and of the step of obtaining a second result, for each iteration of the sequence, the intermediate key comprises at least a part of the input data, the first parameter of the last iteration is equal to the combination by "exclusive or" of another predetermined constant, of the first result of the penultimate iteration and of the first parameter of said penultimate iteration, for each iteration other than the first iteration and the last iteration of said sequence, the first parameter of the iteration concerned is equal to the combination by "exclusive or" of the first result and of the first parameter of another iteration which immediately precedes the iteration concerned, and for each iteration other than the first iteration,the intermediate key of the iteration concerned includes a third parameter determined by an “exclusive or” operation between the second parameter and the second result of another iteration which immediately precedes the iteration concerned; , - the first parameter of the first iteration is a first part of a hash key and the intermediate key of the first iteration is the concatenation of at least one part of the input data and a second part of the hash key; - the hash key has a value other than 0; - for a second other intermediate data selected from among the intermediate data, during an application of the cryptographic function among the first application and the second application of another iteration, a state of the second other intermediate data selected, resulting from a third transformation among the successive transformations, is obtained by implementing, during the other application among the first application and the second application of said other iteration, the third transformation to the intermediate data; - the second other selected intermediate data and the state of the second other selected intermediate data are selected according to the predetermined constant.

[0010] At least a portion of the methods of the invention may be computer-implemented. Accordingly, the present invention may take the form of an entirely hardware-based embodiment or an embodiment combining software (including firmware, resident software, microcode, etc.) and hardware aspects, all of which may be collectively referred to herein as a "module."

[0011] According to a second aspect, the invention proposes an electronic device for chopping an input data item into an output data item, the device comprising: - a cryptographic block encryption or block decryption module, configured to associate an output block with an input block by successive transformations of intermediate data initialized with the input block, at least one of the successive transformations depending on a cryptographic key, - an iteration module configured to implement an ordered sequence of at least one iteration of the following two steps, the sequence starting with a first iteration and ending with a last iteration: 1) obtaining a first result by a first application of the cryptographic module to a first parameter with an intermediate key; the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic module during the first application of said cryptographic module; 2) obtaining a second result by a second application of the cryptographic module with the intermediate key, to a second parameter equal to the combination by "exclusive or" of a predetermined constant and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic module during the second application of said cryptographic module; - an output data determination module configured to determine the output data by an “exclusive or” operation between the first parameter and the first result of the last iteration of the sequence, and by an “exclusive or” operation between the second parameter and the second result of said last iteration; the device being characterized in that for an intermediate data item selected from the intermediate data items, during an application of the cryptographic module among the first application and the second application of an iteration of the sequence, a state of the selected intermediate data, resulting from a transformation determined among the successive transformations, is obtained by the implementation, during the other application among the first application and the second application of said iteration of the sequence, of the transformation determined to the intermediate data.

[0012] This device can be configured to implement each of the possibilities of implementations envisaged for the hashing process as defined previously.

[0013] Of course, the various features, variants and embodiments of the invention may be combined with each other in various combinations to the extent that they are not incompatible or mutually exclusive.

[0014] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended figures which illustrate exemplary embodiments thereof which are not in any limiting nature.

[0015] In the figures:

[0016] [Fig. 1] schematically represents a preferred embodiment of a device electronics according to the invention;

[0017] [Fig.2] illustrates in the form of a flowchart the main stages of a process of hashing according to a first embodiment of the invention;

[0018] [Fig.3] schematically represents the hashing implemented with the method illustrated [Fig.2];

[0019] [Fig.4] schematically represents an example of successive transformations of intermediate data by a cryptographic function;

[0020] [Fig.5] schematically represents a comparison of inter data states intermediaries between a first application and a second application of a cryptographic function in a method according to the invention;

[0021] [Fig.6] illustrates in the form of a flowchart the main stages of a process of hashing according to a second embodiment of the invention;

[0022] [Fig.7] schematically represents the hashing implemented with the method illustrated [Fig.6].

[0023] Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0024] In the context of the present description, the qualifiers “first”, “second”, “third” are only indicative to distinguish elements that they qualify, but do not imply an order between them.

[0025] [Fig.l] schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage block 6, a 8 RAM and a 10 communication block.

[0026] The RAM 8 and the storage block 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage block 6 and / or the RAM 8.

[0027] The storage block 6 stores computer program instructions, some of which are designed to implement a hashing method as described with reference to [Fig.2] or [Fig.6], when these instructions are executed by the processor 4.

[0028] The storage block 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used English term).

[0029] The RAM 8 can for its part store at least some of the elements (in particular a first parameter, a second parameter, intermediate data, a first result, a second result and output data, as described with reference to at least one figure among figures 2 to 7) manipulated during the various processing operations carried out during one of the methods described below.

[0030] In the remainder of the description, any one of the storage block 6 and the RAM 8 is called memory.

[0031] The electronic device 2 also comprises several modules (not shown).

[0032] Typically, the electronic device 2 comprises a cryptographic block encryption or block decryption module, an iteration module and a module for determining the output data.

[0033] These modules can in practice be implemented by a combination of hardware elements and software elements.

[0034] Each module has a functionality described in one of the methods according to the invention and described below with reference to [Fig. 2] or [Fig. 6]. Thus, for each module, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example a communication interface or a memory) and thus implement the functionality offered by the module.

[0035] According to one possible embodiment, the computer program instructions stored in the storage block 6 have for example been received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the method described with reference to [Fig.2] or [Fig.6].

[0036] The communication block 10 is connected to the processor 4 so as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device. electronics (not shown). In certain embodiments, the processor 4 can thus receive data m from the other electronic device, for example computer program instructions and / or input data as described with reference to a figure among Figures 2 to 7, and / or transmit other data, for example output data as described with reference to a figure among Figures 2 to 7.

[0037] The electronic device 2 can take many forms (not shown).

[0038] According to a first example, the electronic device is a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for “Universal Integrated Circuit Card” in English terminology).

[0039] According to a second example, the electronic device is a secure element, such as a secure microcontroller, which is integrated into another electronic device, typically a communication terminal or a car.

[0040] According to other examples, the electronic device is a USB key, a mobile phone, a personal computer, a server or an identity document, such as an electronic passport.

[0041] [Fig.2] illustrates in the form of a flowchart the main steps of a method of hashing according to a first embodiment of the invention and [Fig.3] schematically represents the hashing implemented with the illustrated method [Fig.2]

[0042] The method of [Fig.2] aims to implement a hash of an input data into an output data with a cryptographic function F of block encryption or block decryption, the cryptographic function associating an output block with an input block by successive transformations of intermediate data initialized with the input block, at least one of the successive transformations depending on a cryptographic key.

[0043] A block cipher cryptographic function is an encryption function according to a symmetric cryptographic algorithm in which the input block and the output block are fixed-size data.

[0044] Respectively, a block decryption cryptographic function is a decryption function according to a symmetric cryptographic algorithm in which the input block and the output block are fixed-size data.

[0045] The size of the input block, respectively the size of the output block, is generally between 32 and 512 bits, i.e. between 4 and 64 bytes.

[0046] The size of the cryptographic key may be the same as the size of the input block and the size of the output block.

[0047] The cryptographic function is for example an encryption function or a decryption function according to the DES algorithm (for “Data Encryption Standard”). according to the commonly used Anglo-Saxon term), according to the AES algorithm (for "Advanced Encryption Standard" according to the commonly used Anglo-Saxon term), or according to the Skinny algorithm.

[0048] Typically, when the cryptographic function is according to the DES algorithm, the size of the input block and the size of the output block are 64 bits, the size of the cryptographic key can be 56 bits, and the cryptographic function applies successive transformations to 2 intermediate data, each intermediate data having a size of 32 bits or 48 bits. At least one transformation among the successive transformations extends the size of each of the two intermediate data, from 32 to 48 bits. At least one other transformation among the successive transformations reduces the size of each of the two intermediate data, from 48 to 32 bits.

[0049] When the cryptographic function is according to the AES algorithm, the size of the input block and the size of the output block are 128 bits, the size of the cryptographic key can be 128, 192 or 256 bits, and the cryptographic function applies successive transformations to 16 intermediate data, each intermediate data having a size of 8 bits.

[0050] When the cryptographic function is according to the Skinny algorithm, the size of the input block and the size of the output block are 64 bits or 128 bits. The size of the cryptographic key is preferably greater than or equal to 124 bits. The cryptographic function applies successive transformations to 16 intermediate data, each intermediate data having a size of 4 bits if the size of the input block and the size of the output block are 64 bits, or 8 bits if the size of the input block and the size of the output block are 64 bits.

[0051] [Fig.4] schematically represents an example of successive transformations of intermediate data by a cryptographic function.

[0052] More precisely, [Fig.4] illustrates the first 8 transformations Ti,...,T8 applied successively to 16 intermediate data during an application of a cryptographic block cipher function which is an encryption function according to the AES algorithm.

[0053] The 16 intermediate data are represented here in the form of a matrix D of dimension 4x4, each element of the matrix being an intermediate data whose size is one byte.

[0054] The matrix Do represents the intermediate data initialized with the input block.

[0055] Each matrix D;, i being between 1 and 8, represents the 16 intermediate data after application of the transformation T; to said intermediate data, the state of the 16 intermediate data which precedes the application of the transformation T; is represented by the matrix D, h

[0056] For example, the matrix Di represents the state of the intermediate data after ap plication of the transformation T i to said intermediate data initialized with the input block Do, the transformation Ti being the combination by “exclusive or” of the intermediate data with a key named Round key 1. The key Round key 1 is calculated from the cryptographic key.

[0057] The T2 transformation, respectively the!^ transformation, is a non-linear transformation, also called SubBytes, applied independently to each of the intermediate data using a substitution table.

[0058] Transformation T3, respectively transformation T7, is a cyclic permutation of the bytes on the lines of the intermediate data matrix in state D 2, respectively D6.

[0059] The transformation T4, respectively the transformation!^, is a matrix product applied column after column of the matrix of intermediate data in the state D3, respectively D7, and using the 4 bytes of a column.

[0060] Finally, the transformation T5 is the combination by "exclusive or" of the intermediate data (in state D4) with a key named Round key 2. The Round key 2 is calculated from the cryptographic key.

[0061] The method of [Fig.2] is here implemented by the electronic device 2 due to the execution of the computer program instructions stored in the storage block 6 as indicated above.

[0062] According to a step of obtaining a first result (step S2), the processor 4 obtains a first result Ri by a first application of the cryptographic function F to a first parameter Pi with an intermediate key K.

[0063] The intermediate key K may comprise at least part of the input data.

[0064] The first parameter Pb, the first result Ri and the intermediate key K are respectively the input block, the output block and the cryptographic key of the cryptographic function F during the first application of the cryptographic function.

[0065] According to a step of obtaining a second result (step S4), the processor 4 obtains a second result R2 by a second application of the cryptographic function F with the intermediate key K, to a second parameter P2 equal to the combination by “exclusive or” of a predetermined constant Ci and the first parameter Pi.

[0066] During this step, the processor 4 can obtain the second parameter P2 by an “exclusive or” type combination of the predetermined constant Ci and the first parameter Pp

[0067] The second parameter P2, the second result R2 and the intermediate key K are respectively the input block, the output block and the cryptographic key of the cryptographic function F during the second application of the cryptographic function.

[0068] The method then comprises a step (step S6) of determining the data of output during which the processor 4 determines the output data by an “exclusive or” operation between the first parameter and the first result and by an “exclusive or” operation between the second parameter and the second result.

[0069] Typically, the processor 4 determines: - a first part Si of the output data by a combination of the “exclusive or” type of the first parameter Pi and the first result Rb and - a second part S2 of the output data by a combination of the “exclusive or” type of the second parameter P2 and the second result R2.

[0070] The output data is thus made up of the first part S1 and the second part S2.

[0071] According to one possibility, the first parameter Pi is a first part Hi of a hash key.

[0072] Alternatively, the first parameter Pi is the result of the combination by "exclusive or" of another predetermined constant and the first part of the hash key.

[0073] This other possibility makes it possible to improve the security of the method by preventing an attacker from continuing the hashing process and applying the cryptographic function to the first part of the output data and / or to the second part of the output data.

[0074] The intermediate key K is for example the result of the concatenation of at least one part of the input data and a second part H2 of the hash key.

[0075] The hash key can have a null value.

[0076] Preferably, the hash key has a value other than 0. A non-zero hash key may have a secret, i.e. non-public, value, which makes it possible to use the hashing method to secure exchanges, for example to authenticate data or the origin of the data, or even to derive a key.

[0077] The method of [Fig.2] therefore comprises an ordered sequence of at least one iteration of the following two steps, the sequence beginning with a first iteration and ending with a last iteration: - Obtaining (step S2) a first result by a first application of the cryptographic function F to a first parameter with an intermediate key; the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the first application of the cryptographic function; - Obtaining (step S4) a second result by a second application of the cryptographic function F with the intermediate key, to a second parameter equal to the combination by “exclusive or” of a predetermined constant and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the second application of the cryptographic function. More precisely, the sequence only includes one iteration of the step of obtaining (step S2) a first result and the step of obtaining (step S4) a second result. The first iteration of the sequence is the last iteration of the sequence.

[0078] Furthermore, the method of [Fig.2] comprises a step of determining (step S6) the output data by an “exclusive or” operation between the first parameter and the first result of the last iteration of the sequence, and by an “exclusive or” operation between the second parameter and the second result of said last iteration of the sequence.

[0079] Advantageously, during the second application of the cryptographic function, which we will call here reduced application, the processor 4 selects an intermediate data item from among the intermediate data and determines a state of the selected intermediate data item, said state resulting from a transformation determined from among the successive transformations, by the implementation of said transformation determined to the intermediate data, during the first application of the cryptographic function, which we will call here complete application.

[0080] Typically, during the first application of the cryptographic function, i.e. during the complete application, the processor 4 calculates the state of the selected intermediate data by applying the determined transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the selected intermediate data. During the second application of the cryptographic function, i.e. during the reduced application, the processor 4 recovers the state of the selected intermediate data which was stored during the first application of the cryptographic function and does not recalculate the state of the intermediate data by applying the determined transformation to the intermediate data.

[0081] The method thus makes it possible to limit the calculation time required to hash the input data by sharing the calculation of a state of an intermediate data item, the selected intermediate data item, between the first application and the second application of the cryptographic function.

[0082] The selected intermediate data and the state of the selected intermediate data can be selected based on the value of the predetermined constant.

[0083] The value of the predetermined constant may be represented in the form of bits. Typically, the predetermined constant has as many bits as the first parameter, and as many bits as the second parameter.

[0084] The more bits the predetermined constant has at 0, the greater the number of identical intermediate data states between the first application and the second application of the cryptographic function.

[0085] Thus, also advantageously, during the second application of the cryptographic function, i.e. during the reduced application mentioned above, the processor 4 can select a first other intermediate data item from among the intermediate data and determine a state of the first other selected intermediate data item, said state resulting from a second transformation from among the successive transformations, by implementing said second transformation to the intermediate data, during the first application of the cryptographic function, i.e. during the complete application mentioned above.

[0086] The first other selected intermediate data is an intermediate data different from the selected intermediate data.

[0087] The second transformation among the successive transformations may be the determined transformation or a transformation different from the determined transformation.

[0088] Typically, during the first application of the cryptographic function, i.e. during the complete application, the processor 4 calculates the state of the first other selected intermediate data, by applying the second transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the first other selected intermediate data. During the second application of the cryptographic function, i.e. during the reduced application, the processor 4 recovers the state of the first other selected intermediate data which was stored during the first application of the cryptographic function, and does not recalculate said state of the first other intermediate data by applying the second transformation to the intermediate data.

[0089] The method thus makes it possible to further limit the calculation time required to hash the input data by sharing the calculation of a state of another intermediate data item, the first other intermediate data item selected, between the first application and the second application of the cryptographic function.

[0090] Preferably, the first other selected intermediate data and the state of the first other selected intermediate data are selected based on the predetermined constant.

[0091] According to another advantageous manner, during the reduced application, the processor 4 can determine another state of the selected intermediate data, said other state resulting from another transformation among the successive transformations, by the implementation, during the complete application, of said other transformation to the data intermediates, the other transformation being distinct from the determined transformation.

[0092] Typically during the complete application, the processor 4 calculates the other state of the selected intermediate data, by applying the other transformation to the intermediate data, then the electronic device 2 stores in a memory the other calculated state of the selected intermediate data. During the reduced application, the processor 4 then recovers the other state of the selected intermediate data, which was stored during the first application of the cryptographic function, and does not recalculate said other state of the intermediate data by applying the other transformation to the intermediate data.

[0093] The method thus makes it possible to further limit the calculation time required to hash the input data by sharing the calculation of another state of the selected intermediate data, between the first application and the second application of the cryptographic function.

[0094] Preferably, the selected intermediate data and the other state of the selected intermediate data are selected based on the predetermined constant.

[0095] A person skilled in the art will understand that the steps of this method can be executed in other orders provided that each step has the elements necessary for its execution.

[0096] According to one example, the step (step S6) of determining the output data can begin after the step of obtaining a first result (step S2) and before the end of the step of obtaining a second result (step S4), and ends after the step of obtaining a second result (step S4).

[0097] In this example, processor 4 determines: - the first part If of the output data after the step of obtaining a first result (step S2) and before the end of the step of obtaining a second result (step S4), and - the second part S2 of the output data after the end of the step of obtaining a second result (step S4).

[0098] According to another example, the step of obtaining a second result (step S4) is implemented before the step of obtaining a first result (step S2).

[0099] In this example, advantageously, during the first application of the cryptographic function, which we will call here reduced application, the processor 4 selects an intermediate data item from among the intermediate data and determines a state of the selected intermediate data item, said state resulting from a transformation determined from among the successive transformations, by the implementation, during the second application of the cryptographic function, which we will call here complete application, of said transformation determined to the intermediate data.

[0100] Typically, during the second application of the cryptographic function, that is to say during the complete application, the processor 4 calculates the state of the selected intermediate data by applying the determined transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the selected intermediate data. During the first application of the cryptographic function, that is to say during the reduced application, the processor 4 then recovers the state of the selected intermediate data which was stored during the second application of the cryptographic function and does not recalculate said state of the intermediate data by applying the determined transformation to the intermediate data.

[0101] The method thus makes it possible to limit the calculation time required to hash the input data.

[0102] Still in this example, also advantageously, during the first application of the cryptographic function, i.e. during the reduced application, the processor 4 can select a first other intermediate data item from among the intermediate data and determine a state of the first other selected intermediate data item, said state resulting from a second transformation from among the successive transformations, by the implementation during the second application of the cryptographic function, i.e. during the complete application, of said second transformation to the intermediate data.

[0103] Typically, during the second application of the cryptographic function, i.e. during the complete application, the processor 4 calculates the state of the first other selected intermediate data, by applying the second transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the first other selected intermediate data. During the first application of the cryptographic function, i.e. during the reduced application, the processor 4 then recovers the state of the first other selected intermediate data which was stored during the second application of the cryptographic function, and does not recalculate said state of the first other intermediate data by applying the second transformation to the intermediate data.

[0104] The method thus makes it possible to further limit the calculation time required to hash the input data.

[0105] As already described, the first other selected intermediate data is an intermediate data different from the selected intermediate data, and the second transformation among the successive transformations can be the determined transformation or a transformation different from the determined transformation.

[0106] Further, the first other selected intermediate data and the state of the first other selected intermediate data are preferably selected based on the predetermined constant.

[0107] According to another advantageous manner, during the first application of the cryptographic function in this example, that is to say during the reduced application, the processor 4 can determine another state of the selected intermediate data, said other state resulting from another transformation among the successive transformations, by the implementation of said other transformation to the intermediate data, during the complete application of the cryptographic function, the other transformation being distinct from the determined transformation.

[0108] Typically, during the second application of the cryptographic function, i.e. during the complete application, the processor 4 calculates the other state of the selected intermediate data, by applying the other transformation to the intermediate data, then the electronic device 2 stores in a memory the other calculated state of the selected intermediate data. During the reduced application, the processor 4 then recovers the other state of the selected intermediate data, which was stored during the second application of the cryptographic function, and does not recalculate said other state of the intermediate data by applying the other transformation to the intermediate data.

[0109] The method thus makes it possible to further limit the calculation time required to hash the input data.

[0110] As already described, the selected intermediate data and the other state of the selected intermediate data can be selected according to the predetermined constant.

[0111] Whatever the order of the steps, particularly advantageously, the predetermined constant is a power of two.

[0112] The method thus allows optimal limitation of calculation times by maximizing the number of intermediate data states, i.e. the number of states of the same intermediate data and / or the number of distinct intermediate data states, the calculation of which can be shared between the first application and the second application of the cryptographic function.

[0113] Indeed, in this case the first parameter differs from the second parameter by only one bit.

[0114] [Fig.5] schematically represents a comparison of data states in intermediaries between a first application and a second application of a cryptographic function in a method according to the invention, the first application and the second application being during the same iteration within the method, and the predetermined constant being a power of 2 whose value is greater than or equal to 1, and less than or equal to 128.

[0115] [Fig.5] shows the successive transformations of intermediate data by a cryptographic block cipher function according to the AES algorithm as described with reference to [Fig.4].

[0116] The 16 intermediate data are represented in the form of the matrix D of dimension 4x4, each element of the matrix being an intermediate data having a size of 1 byte.

[0117] An element is blank when the state of the associated intermediate data during the first application of the cryptographic function is identical to that of said intermediate data during the second application of the cryptographic function.

[0118] An element of the matrix is gray when the state of the associated intermediate data during the first application of the cryptographic function is different from the state of said intermediate data during the second application of the cryptographic function.

[0119] Thus, in the example illustrated [Fig.5], following the initialization of the intermediate data with the input block, the state of a single intermediate data differs between the first application and the second application of the cryptographic function.

[0120] After the transformation Tb only the state of this intermediate data differs between the two applications of the cryptographic function.

[0121] The same applies after transformation T2, then after transformation T3.

[0122] After the transformation T;, i being between 4 and 7, the states of four data in intermediaries differ between the first application and the second application of the cryptographic function.

[0123] Finally, from the transformation T8, the states of all intermediate data differ between the two applications of the cryptographic function.

[0124] The calculation of each matrix element which is blank, that is to say of each associated intermediate data state, can be shared between the first application and the second application of the cryptographic function of the same iteration during a method according to the invention, in particular during the method described above.

[0125] Thus each matrix element which is white, that is to say each associated intermediate data state, can be a state of the selected intermediate data, a state of the first other selected intermediate data, or another state of the selected intermediate data.

[0126] By way of example only, in [Fig.5], d0 di and d2 respectively represent a state of the selected intermediate data, a state of the first other selected intermediate data and another state of the selected intermediate data during the method described with reference to [Fig.2].

[0127] [Fig.6] illustrates in the form of a flowchart the main steps of a hashing method according to a second embodiment of the invention and [Fig.7] represents schematically the hashing implemented with the illustrated process [Fig.6].

[0128] The method of [Fig.6] also aims to implement a hash of an input data into an output data with a cryptographic function F of block encryption or block decryption, the cryptographic function associating an output block with an input block by successive transformations of intermediate data initialized with the input block, at least one of the successive transformations depending on a cryptographic key.

[0129] This method is implemented by the electronic device 2 due to the execution of the computer program instructions stored in the storage block 6 as indicated above.

[0130] According to an index initialization step (step S12), the processor 4 initializes an integer] to the value 1.

[0131] The method then comprises a step (step S14) of obtaining a first result, during which the processor 4 obtains a first result Rij by a first application of the cryptographic function F to a first parameter Pi j with an intermediate key K'j.

[0132] The first parameter Pij, the first result Rij and the intermediate key K'j are respectively the input block, the output block and the cryptographic key of the cryptographic function F during the first application of the cryptographic function.

[0133] According to a step of obtaining a second result (step S16), the processor 4 obtains a second result R2j by a second application of the cryptographic function F with the intermediate key K'j, to a second parameter P2j equal to the combination by "exclusive or" of a predetermined constant Ci and the first parameter Pij-

[0134] During this step, the processor 4 can obtain the second parameter P2j by an “exclusive or” type combination of the predetermined constant Ci and the first parameter Pij.

[0135] The second parameter P2j, the second result R2j and the intermediate key K'j are respectively the input block, the output block and the cryptographic key of the cryptographic function F during the second application of the cryptographic function F.

[0136] The processor 4 then determines, in a test step (step S18), whether the integer ja reaches a value n where n is a natural integer strictly greater than 1.

[0137] If not, the integer j is incremented by 1 in an incrementation step (step S20) and the method loops to the step of obtaining a first result (step S14) to perform a next round, i.e. a new iteration.

[0138] During the method, the step of obtaining a first result (step S14) and the step of obtaining a second result (step S16) are thus executed for all j ranging from 1 to n.

[0139] The method of [Fig.6] therefore comprises an ordered sequence of at least one iteration of the following two steps, the sequence beginning with a first iteration and ending with a last iteration: - Obtaining (step S14) a first result by a first application of the cryptographic function F to a first parameter with an intermediate key; the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the first application of the cryptographic function; - Obtaining (step S16) a second result by a second application of the cryptographic function F with the intermediate key, to a second parameter equal to the combination by “exclusive or” of a predetermined constant and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the second application of the cryptographic function.

[0140] More specifically, the sequence comprises a plurality of iterations of the step of obtaining (step S14) a first result and the step of obtaining (step S16) a second result.

[0141] The first iteration is the one during which j is 1. The last iteration is the one during which j is n.

[0142] The method therefore obtains n first results R14, ... , Ri n and n second results R21 -, ■■■ -, R2,n-

[0143] For example, during the first iteration of the step of obtaining a first result (step S14), the processor 4 obtains a first result R14 by a first application of the cryptographic function F to a first parameter Pu with an intermediate key K'b and during the last iteration of the step of obtaining a first result (step S14), the processor 4 obtains a first result Ri n by a first application of the cryptographic function F to a first parameter Pi n with an intermediate key K'n.

[0144] According to other examples, during the first iteration of the step of obtaining a second result (step S16), the processor 4 obtains a second result R21 by a second application of the cryptographic function F with the intermediate key K'b to a second parameter P2ji equal to the combination by "exclusive or" of a predetermined constant Ci and the first parameter Pu, and during the last iteration of the step of obtaining a second result (step S16), the processor 4 obtains a second result R2 n by a second application of the cryptographic function F with the intermediate key K'n, to a second parameter P2>n equal to the combination by " or exclusive” of the predetermined constant Ci and the first parameter Pi n.

[0145] The first parameter of the first iteration Pu is a first part Hi of a hash key and the intermediate key of the first iteration K' i is the concatenation of at least one part Ei of the input data and a second part H2 of the hash key.

[0146] Preferably, the hash key has a value other than 0. A non-zero hash key may have a secret, i.e. non-public, value, which makes it possible to use the hashing method to secure exchanges, for example to authenticate data or the origin of the data, or even to derive a key.

[0147] For each iteration other than the first iteration and the last iteration of the sequence, the first parameter of the iteration concerned is equal to the combination by "exclusive or" of the first result and the first parameter of another iteration of the sequence, which immediately precedes the iteration concerned.

[0148] Thus, for any j ranging from 2 to n-1, when the integer n is strictly greater than 2, the first parameter Pij is equal to the combination by "exclusive or" of the first result Ri ji and the first parameter Pi ji: Pf j = R^i ® ?Vi-

[0149] For any j ranging from 1 to n, the second parameter P2jj has a value defined as follows: P2j- = Pv ® Cr

[0150] Furthermore, for each iteration other than the first iteration of the sequence, the intermediate key of the iteration concerned comprises a third parameter determined by an “exclusive or” operation between the second parameter and the second result of another iteration of the sequence, which immediately precedes the iteration concerned.

[0151] Thus, for any j ranging from 2 to n, K'j includes a third parameter P3j determined by an “exclusive or” operation between the second parameter P2j_i and the second result R2>jp P3J = P^ G R2 / 21.

[0152] For each iteration of the sequence, the intermediate key of the iteration concerned may comprise at least part of the input data.

[0153] For example, as illustrated in Figure 7, for each iteration other than the first iteration of the sequence, the intermediate key of the iteration concerned can be the result of a concatenation of the third parameter P3j and a distinct part Ej of the input data: K'y - P3J |E; - (P^q © •

[0154] Typically, the input data is the concatenation of the distinct parts Ej of the input data, for all j ranging from 1 to n.

[0155] The method thus makes it possible to hash large input data.

[0156] According to one possibility, the first parameter Pi n of the last iteration is equal to the combination by “exclusive or” of the first result and the first parameter of the penultimate iteration of the sequence.

[0157] Thus the first parameter Pi n is equal to the combination by "exclusive or" of the first result R| „ । and the first parameter P, ,, । : P, Jf = R]„_i ®

[0158] According to another possibility, the first parameter Pi n of the last iteration is equal to the combination by "exclusive or" of another predetermined constant C2, of the first result Ri n4 of the penultimate iteration and of the first parameter Pi n [ of said penultimate iteration: = Ri^-i ® Pm-r® C2

[0159] The predetermined constant C2 is for example a power of 2.

[0160] This other possibility makes it possible to improve the security of the method by preventing an attacker from continuing the hashing process and applying the cryptographic function to the first part of the output data and / or to the second part of the output data (described below).

[0161] If yes in the test step (step S18), the method continues with a step (step S22) of determining the output data during which the processor 4 determines the output data by an “exclusive or” operation between the first parameter and the first result of the last iteration and by an “exclusive or” operation between the second parameter and the second result of the last iteration.

[0162] Typically, processor 4 determines: - a first part Si of the output data by a combination of the “exclusive or” type of the first parameter Pi>n and the first result Ri>n, and - a second part S2 of the output data by a combination of the “exclusive or” type of the second parameter P2>n and the second result R2n.

[0163] The output data is thus made up of the first part S1 and the second part S2.

[0164] Advantageously, during the second application of the cryptographic function of an iteration], which we will call here reduced application, the processor 4 selects an intermediate data item from among the intermediate data and determines a state of the selected intermediate data item, said state resulting from a transformation determined from among the successive transformations, by the implementation of the transformation determined to the intermediate data, during the first application of the cryptographic function of the iteration j concerned, which we will call here complete application.

[0165] Typically, during the first application of the cryptographic function of an iteration], i.e. during the complete application, the processor 4 calculates the state of the intermediate data selected by applying the determined transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the selected intermediate data. During the second application of the cryptographic function for the iteration j concerned, i.e. during the reduced application, the processor 4 recovers the state of the selected intermediate data which was stored during the complete application, and does not recalculate said state of the intermediate data by applying the determined transformation to the intermediate data.

[0166] The method thus makes it possible to limit the calculation time required to hash the input data by sharing the calculation of a state of an intermediate data item, the selected intermediate data item, between the first application and the second application of the cryptographic function of the same iteration of the sequence.

[0167] The selected intermediate data and the state of the selected intermediate data can be selected based on the value of the predetermined constant.

[0168] The value of the predetermined constant may be represented in the form of bits. Typically, the predetermined constant has as many bits as the first parameter.

[0169] The more bits the predetermined constant has at 0, the greater the number of identical intermediate data states between the first application and the second application of the cryptographic function.

[0170] Thus, also advantageously, during the second application of the cryptographic function of iteration j, i.e. during the reduced application mentioned above, the processor 4 can select a first other intermediate data item from among the intermediate data and determine a state of the first other selected intermediate data item, said state resulting from a second transformation from among the successive transformations, by implementing the second transformation to the intermediate data, during the first application of the cryptographic function of said iteration], i.e. during the complete application mentioned above.

[0171] The first other selected intermediate data is an intermediate data different from the selected intermediate data.

[0172] The second transformation among the successive transformations may be the determined transformation or a transformation different from the determined transformation.

[0173] Typically, during the first application of the cryptographic function of iteration j, i.e. during the complete application, the processor 4 calculates the state of the first other selected intermediate data, by applying the second transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the first other selected intermediate data. During the second application of the cryptographic function of said iteration], i.e. during the reduced application, the processor 4 recovers the state of the first other intermediate data selected which was stored during the first application of the cryptographic function, and does not recalculate said state of the first other intermediate data by applying the second transformation to the intermediate data.

[0174] The method thus makes it possible to further limit the calculation time required to hash the input data by sharing the calculation of a state of another intermediate data item, the first other selected intermediate data item, between the first application and the second application of the cryptographic function of the iteration concerned, i.e. of the iteration during which the calculation of a state of the selected intermediate data item is shared.

[0175] Preferably, the first other selected intermediate data and the state of the first other selected intermediate data are selected based on the predetermined constant.

[0176] According to another advantageous manner, during the reduced application, the processor 4 can determine another state of the selected intermediate data, said other state resulting from another transformation among the successive transformations, by the implementation, during the complete application, of the other transformation to the intermediate data, the other transformation being distinct from the determined transformation.

[0177] Typically, during the complete application, the processor 4 calculates the other state of the selected intermediate data, by applying the other transformation to the intermediate data, then the electronic device 2 stores in a memory the other calculated state of the selected intermediate data. During the reduced application, the processor 4 then recovers the other state of the selected intermediate data, which was stored during the first application of the cryptographic function, and does not recalculate said other state of the intermediate data by applying the other transformation to the intermediate data.

[0178] The method thus makes it possible to further limit the calculation time required to hash the input data by sharing the calculation of another state of the selected intermediate data, between the first application and the second application of the cryptographic function of the iteration concerned, that is to say of the iteration during which the calculation of a state of the selected intermediate data is shared.

[0179] Preferably, the selected intermediate data and the other state of the selected intermediate data are selected based on the predetermined constant.

[0180] A person skilled in the art will understand that the steps of this method can be executed in other orders provided that each step has the elements necessary for its execution.

[0181] According to one example, the step (step S22) of determining the output data can begin after the last iteration of the step of obtaining a first result (step S14) and before the end of the last iteration of the step of obtaining a second result (step S16), and ends after the last iteration of the step of obtaining a second result (step S16).

[0182] In this example, processor 4 determines: - the first part If of the output data after the last iteration of the step of obtaining a first result (step S14) and before the end of the last iteration of the step of obtaining a second result (step S16), and - the second part S2 of the output data after the end of the last iteration of the step of obtaining a second result (step S16).

[0183] According to another example, during an iteration of the sequence, the step of obtaining a second result (step S16) of the iteration concerned is implemented before the step of obtaining a first result (step S14) of said iteration concerned.

[0184] In this example, advantageously, during the first application of the cryptographic function of the iteration concerned, which we will call here reduced application, the processor 4 selects an intermediate data item from among the intermediate data and determines a state of the selected intermediate data item, said state resulting from a transformation determined from among the successive transformations, by the implementation, during the second application of the cryptographic function of said iteration concerned, which we will call here complete application, of the transformation determined to the intermediate data.

[0185] Typically, during the second application of the cryptographic function of the iteration concerned, i.e. during the complete application, the processor 4 calculates the state of the intermediate data selected by applying the determined transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the selected intermediate data. During the first application of the cryptographic function of the iteration concerned, i.e. during the reduced application, the processor 4 then recovers the state of the selected intermediate data which has been stored and does not recalculate said state of the intermediate data by applying the determined transformation to the intermediate data.

[0186] The method thus makes it possible to limit the calculation time required to hash the input data.

[0187] Still in this example, also advantageously, during the first application of the cryptographic function of the iteration concerned, that is to say during the reduced application, the processor 4 can select a first other intermediate data item from among the intermediate data and determine a state of the first other intermediate data item selected, said state resulting from a second transformation from among the successive transformations, by the implementation during the second ap plication of the cryptographic function of the said iteration concerned, that is to say during the complete application, of the second transformation to the intermediate data.

[0188] Typically, during the second application of the cryptographic function of the iteration concerned, i.e. during the complete application, the processor 4 calculates the state of the first other selected intermediate data, by applying the second transformation to the intermediate data, then the electronic device 2 stores in a memory the calculated state of the first other selected intermediate data. During the first application of the cryptographic function of said iteration concerned, i.e. during the reduced application, the processor 4 recovers the state of the first other selected intermediate data which has been stored, and does not recalculate the state of the first other intermediate data by applying the second transformation to the intermediate data.

[0189] The method thus makes it possible to further limit the calculation time required to hash the input data.

[0190] As already described, the first other selected intermediate data is an intermediate data different from the selected intermediate data, and the second transformation among the successive transformations can be the determined transformation or a transformation different from the determined transformation.

[0191] Further, the first other selected intermediate data and the state of the first other selected intermediate data are preferably selected based on the predetermined constant.

[0192] According to another advantageous manner, during the first application of the cryptographic function of the iteration concerned, that is to say during the reduced application, the processor 4 can determine another state of the selected intermediate data, said other state resulting from another transformation among the successive transformations, by the implementation of the other transformation to the intermediate data during the complete application of the cryptographic function, the other transformation being distinct from the determined transformation.

[0193] Typically, during the second application of the cryptographic function of the iteration concerned, i.e. during the complete application, the processor 4 calculates the other state of the selected intermediate data, by applying the other transformation to the intermediate data, then the electronic device 2 stores in a memory the other calculated state of the selected intermediate data. During the reduced application, the processor 4 then recovers the other state of the selected intermediate data, which was stored during the second application of the cryptographic function of said iteration concerned, and does not recalculate the other state of the intermediate data by applying the other transformation to the intermediate data.

[0194] The method thus makes it possible to further limit the calculation time required to hash the input data.

[0195] As already described, the selected intermediate data and the other state of the selected intermediate data can be selected according to the predetermined constant.

[0196] Whatever the order of the steps, particularly advantageously, the predetermined constant is a power of two.

[0197] The method thus allows optimal limitation of calculation times by maximizing the number of intermediate data states, i.e. the number of states of the same intermediate data and / or the number of distinct intermediate data states, the calculation of which can be shared between the first application and the second application of the cryptographic function.

[0198] Indeed, in this case, for a given iteration, the first parameter differs from the second parameter by only one bit.

[0199] Advantageous ways of implementing the method have been described above, consisting of sharing the calculation of a state of an intermediate data item and, where appropriate, the calculation of a state of another intermediate data item and / or the calculation of another state of the intermediate data item, between the first application and the second application of the cryptographic function of the same iteration.

[0200] Even more advantageously, the method can be implemented by pooling the calculation of a state of an intermediate data item and, where appropriate, the calculation of a state of another intermediate data item and / or the calculation of another state of the intermediate data item, between the first application and the second application of the cryptographic function of one or more other iteration(s), for example between the first application and the second application of the cryptographic function of each other iteration of the sequence.

[0201] The method thus makes it possible to further limit the calculation time required to hash the input data.

[0202] During an iteration, the state of the intermediate data whose calculation is shared, respectively the intermediate data whose state calculation is shared, may be identical to or different from the state of the intermediate data and / or the other state of the intermediate data and / or the state of the other intermediate data whose calculation is shared during one or more other iteration(s), respectively the intermediate data and / or the other intermediate data whose state calculation is shared during one or more other iteration(s).

[0203] Similarly, during an iteration: - the state of the other intermediate data whose calculation is shared, respectively the other intermediate data whose state calculation is shared, may be identical to or different from the state of the intermediate data and / or the other state of the intermediate data and / or the state of the other intermediate data whose calculation is shared during one or more other iteration(s), respectively the intermediate data and / or the other intermediate data whose state calculation is shared during one or more other iteration(s), and - the other state of the intermediate data whose calculation is shared, may be identical or different from the state of the intermediate data and / or the other state of the intermediate data and / or the state of the other intermediate data whose calculation is shared during one or more other iteration(s).

[0204] In particular, for a second other intermediate data selected from among the intermediate data, during an application of the cryptographic function among the first application and the second application of another iteration, the processor 4 can determine a state of the second other intermediate data selected, resulting from a third transformation among the successive transformations, by the implementation, during the other application among the first application and the second application of said other iteration, of the third transformation to the intermediate data.

[0205] The third transformation may be the determined transformation or the second transformation or the other transformation described above.

[0206] The third transformation may be a transformation different from the determined transformation, the second transformation and the other transformation described above.

[0207] It should be noted that the calculations of intermediate data states that can be shared are the same for all iterations within the method.

[0208] Indeed, for each iteration j, the first parameter Pij and the second parameter P 2j have the same difference value, the predetermined constant Ci: Pij ® P2J= Cr

[0209] For example, if the method of [Fig.6] is with a cryptographic function F of block encryption according to the AES algorithm and the predetermined constant Ci is a power of 2 whose value is greater than or equal to 1 and less than or equal to 128, for each iteration within the method, the calculations of each intermediate data state illustrated in white in [Fig.5] can be shared.

[0210] The hashing method described with reference to [Fig.6] executes the turns, i.e. the iterations, of the loop with an index that increments at each turn. Those skilled in the art will understand that the index of the loop can be managed differently as long as all the values of the index are traversed by executing the turns of said loop, and that the step of obtaining a first result (step S14) and the step of obtaining a second result (step S16) of an iteration, use the parameters and results of the step of obtaining a first result and of the step of obtaining a second result of the iteration executed immediately before.

[0211] Typically, the method may be adapted to perform the n iterations of the step of obtaining a first result (step S14) and the step of obtaining a second result (step S16) in a different order, each iteration using a different value of the integer, between 1 and n. For example, the person skilled in the art may initialize the integer with the value n in the index initialization step (step S12), replace the incrementation step (step S20) with a decrementation step that decrements j by 1, and determine in the test step (step S18) whether the integer ja reaches the value 1.

Claims

Claims

1. A method of hashing an input data item into an output data item with a cryptographic function (F) for block encryption or block decryption, the cryptographic function associating an output block with an input block by successive transformations of intermediate data (D) initialized with the input block, at least one of the successive transformations depending on a cryptographic key, the method being implemented by an electronic device (2) and the method comprising an ordered sequence of at least one iteration of the following two steps, the sequence starting with a first iteration and ending with a last iteration: - obtaining (S2,S14) a first result (Ri,Rij) by a first application of the cryptographic function (F) to a first parameter (Pi,Pi j) with an intermediate key (K,K'j); the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the first application of the cryptographic function; - obtaining (S4, S16) a second result (R2, R2jj) by a second application of the cryptographic function (F) with the intermediate key (K, K'j), to a second parameter (P2, P2jj) equal to the combination by "exclusive or" of a predetermined constant (Ci) and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic function during the second application of the cryptographic function; the method further comprising a step of determining (S6, S22) the output data by an “exclusive or” operation between the first parameter (Pi, Pi.n) and the first result (Ri, Ri>n) of the last iteration of the sequence, and by an “exclusive or” operation between the second parameter (P2, P2>n) and the second result (R2, R2 n) of said last iteration; and the method being characterized in that for an intermediate data item selected from among the intermediate data items, during an application of the cryptographic function, called reduced application, among the first application and the second application of an iteration of the sequence, a state of the selected intermediate data item (do), resulting from a determined transformation (Ti) among the successive transformations cessives, is obtained by the implementation during the other application, called complete application, among the first application and the second application of said one iteration of the sequence, of the transformation determined to the intermediate data.

2. A method of hashing an input data into an output data according to the preceding claim, wherein the selected intermediate data and the state of the selected intermediate data are selected according to the predetermined constant.

3. Method for hashing an input data into an output data according to any one of the preceding claims, in which for a first other intermediate data selected from among the intermediate data, during the reduced application of the cryptographic function, a state of the first other intermediate data selected (di), resulting from a second transformation (Ti) among the successive transformations, is obtained by the implementation, during the complete application of the cryptographic function, of the second transformation to the intermediate data.

4. A method of hashing an input data into an output data according to the preceding claim, wherein the first other selected intermediate data and the state of the first other selected intermediate data are selected according to the predetermined constant.

5. Method for hashing an input data into an output data according to any one of the preceding claims, in which during the reduced application of the cryptographic function, another state of the selected intermediate data (d2), resulting from another transformation (T2) among the successive transformations, is obtained by the implementation, during the complete application of the cryptographic function, of the other transformation to the intermediate data, the other transformation being distinct from the determined transformation.

6. A method of hashing an input data into an output data according to the preceding claim, wherein the selected intermediate data and the other state of the selected intermediate data are selected according to the predetermined constant.

7. A method of hashing input data into output data according to any preceding claim, wherein the predetermined constant is a power of two.

8. Method of hashing an input data into an output data according to any one of the preceding claims in which: - the sequence comprises only one iteration of the step of obtaining (S2) a first result and of obtaining (S4) a second result, - the intermediate key comprises at least part of the input data, and - the first parameter is a first part of a hash key or the result of the combination by "exclusive or" of another predetermined constant and the first part of the hash key.

9. A method of hashing an input data into an output data according to the preceding claim, wherein the hash key has a value other than 0.

10. A method of hashing an input data item into an output data item according to any one of claims 1 to 7 wherein, - the sequence comprises a plurality of iterations of the step of obtaining (S14) a first result and the step of obtaining (S16) a second result, - for each iteration of the sequence, the intermediate key (K'j) comprises at least a portion of the input data item, - the first parameter (Pi,n) of the last iteration is equal to the combination by "exclusive or" of another predetermined constant (C2), the first result (Ri,ni) of the penultimate iteration and the first parameter (Pi>ni) of said penultimate iteration, - for each iteration other than the first iteration and the last iteration of said sequence,the first parameter (Pij) of the iteration concerned is equal to the combination by “exclusive or” of the first result (Rij i) and the first parameter (Pij i) of another iteration which immediately precedes the iteration concerned, and - for each iteration other than the first iteration, the intermediate key of the iteration concerned (K'j) comprises a third parameter determined by an “exclusive or” operation between the second parameter (P2j-i) and the second result (R2,ji) of another iteration which immediately precedes the iteration concerned.,

11. A method of hashing an input data into an output data according to the preceding claim, wherein the first parameter of the first iteration is a first part of a hash key and the intermediate key of the first iteration is the concatenation of at least one part of the input data and a second part of the hash key.

12. A method of hashing an input data into an output data according to the preceding claim, wherein the hash key has a value other than 0.

13. A method of hashing an input data item into an output data item, according to any one of claims 10 to 12, wherein for a second other intermediate data item selected from among the intermediate data items, during an application of the cryptographic function among the first application and the second application of another iteration, a state of the second other intermediate data item selected, resulting from a third transformation among the successive transformations, is obtained by implementing, during the other application among the first application and the second application of said other iteration, the third transformation to the intermediate data.

14. A method of hashing an input data into an output data according to the preceding claim, wherein the second other selected intermediate data and the state of the second other selected intermediate data are selected according to the predetermined constant.

15. Electronic device (2) for hashing input data into output data, the device comprising: - a cryptographic block encryption or block decryption module, configured to associate an output block with an input block by successive transformations of intermediate data initialized with the input block, at least one of the successive transformations depending on a cryptographic key, - an iteration module configured to implement an ordered sequence of at least one iteration of the following two steps, the sequence starting with a first iteration and ending with a last iteration 1) obtaining (S2, S14) a first result (Ri, Rij) by a first application of the cryptographic module to a first parameter (Pi, Pij) with an intermediate key (K, K'j);the first parameter, the first result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic module during the first application of said cryptographic module; 2) obtaining (S4, S16) a second result (R2, R2j) by a second application of the cryptographic module with the intermediate key (K, K'j; ), to a second parameter (P2,P2.j) equal to the combination by “exclusive or” of a predetermined constant (Ci) and the first parameter; the second parameter, the second result and the intermediate key being respectively the input block, the output block and the cryptographic key of the cryptographic module during the second application of said cryptographic module; - an output data determination module configured to determine the output data by an “exclusive or” operation between the first parameter (Pi,Pi>n) and the first result (R^R^) of the last iteration of the sequence, and by an “exclusive or” operation between the second parameter (P2,P2.n) and the second result (R2,R2 n) of said last iteration; the device being characterized in that for an intermediate data item selected from among the intermediate data items, during an application of the cryptographic module among the first application and the second application of an iteration of the sequence, a state of the selected intermediate data item (do), resulting from a determined transformation (Ti) among the successive transformations, is obtained by the implementation, during the other application among the first application and the second application of said iteration of the sequence, of the determined transformation to the intermediate data.

Images