Methods for encrypting plaintext

Abstract

The present invention relates to a method for encrypting (ENCR ZF ENCR1, ENCR2 M ) a plaintext (PT) which is part of a plaintext message Mp. The underlying idea of this method is to use a reversible decomposition function (ZF) that assigns two plaintext parts (PT1, PT2) to each plaintext (PT) to be encrypted. That is, ZF(PT) = (PT1, PT2) holds. Then, these plaintext parts (PT1, PT2) are encrypted by at least one encryption function (ENCR1, ENCR2) in two separate steps instead of one step, for example sequentially. Since the decomposition function (ZF) is reversible, for each plaintext to be encrypted, PT = ZF -1 (ZF(PT)) holds, where ZF 1 is the inverse function of the decomposition function. That is, using the inverse function (ZF -1 ), the original plaintext (PT) can always be uniquely derived from the plaintext parts (PT1, PT2). And this is used to decrypt the ciphertext message (M ZF ENCR1 , ENCR2 M ) containing the ciphertext parts (CT1, CT2) generated by the encryption (ENCR C ) through a corresponding decryption (DECR ZF DECR1, DECR2 M ). For this purpose, the ciphertext parts (CT1, CT2) are sequentially decrypted by at least one decryption function (DECR1, DECR2), and then the plaintext (PT) is retrieved therefrom. And instead of a conventional initialization vector for encryption and decryption, it is the selected bits, or all the bits, of the second plaintext part (PT2), or a bit sequence derived therefrom. Thereby, the message (M C ) to be transmitted can be shortened without sacrificing security.

Description

[Technical Field]

[0001] The present invention relates to a method for encrypting plaintext to be encrypted, including a plaintext message, based on a scheme defined in detail in the preamble of claim 1. [Background technology]

[0002] The cryptographic functions used for encryption are called cryptographs. The cryptographs used herein consist of an encryption function and a decryption function. The encryption function maps plaintext to ciphertext, and the corresponding decryption function maps ciphertext to plaintext. Both functions are, of course, injective. Encryption functions often utilize an encryption key. If the encryption function ENCR utilizes a key K, and this should be explicitly indicated, then in this specification, ENCR is referred to as ENCR. K Alternatively, it is represented by the symbol ENCR_K. Similarly, for the decoding function DECR, DECR K Alternatively, DECR_K is a symbol indicating that the decoding function uses K for decoding.

[0003] The high-frequency transmission and reception of short messages is crucial in several applications within the vehicle ecosystem, as can be seen, for example, in Patent Document 1. In such cases, as shown in that document, it is often essential to provide cryptographic integrity protection and / or cryptographic replay protection to these messages without significantly increasing their length, and for efficiency reasons, only symmetric methods may be considered for this purpose, as described in the above-mentioned publication. However, in some cases, it may be important to encrypt the entire message, or at least a portion thereof, such as user data, to protect confidential user data and / or to prevent potential attackers from jointly reading, interpreting, and thereby reverse engineering the message and the protocol used.

[0004] Similar considerations made for integrity protection and replay protection in Patent Document 2 also apply to encryption. Basically, especially short messages can be encrypted asymmetrically, for example by means of an RSA-based method. However, the RSA ciphertext of the plaintext is at least as long as the key used for encryption, that is, for example, 2048 bits when using RSA-2048. As a result, for example, from an unencrypted message of 20 bytes, that is, 160 bits long, a transferred encrypted message of at least 2048 bits long is obtained, which is completely contradictory to the need to use short messages. Furthermore, asymmetric decryption takes much longer than symmetric encryption or decryption. Therefore, for the efficient encryption of short and high-frequency messages, only symmetric methods can be used.

[0005] Currently, for symmetric encryption, block ciphers such as AES are mainly used. In this specification, the block size of block cipher E is L E or denoted as L_E. In Raw encryption by block cipher E with block size L E , a plaintext of exactly L E bits long, so-called plaintext block, is encrypted into a ciphertext of exactly L E bits long, so-called ciphertext block, using a symmetric key. Correspondingly, in Raw decryption by the decryption function D belonging to block cipher E with block size L E , the (exactly L E bits long) ciphertext block is decrypted into a (exactly L E bits long) plaintext block using a symmetric key. That is, in both cases, exactly one complete block is always processed and inputs of different lengths are not accepted. In this specification, E-Raw encryption and D-Raw decryption are denoted by E RAW or D RAW . E-Raw encryption by symmetric key K is denoted by E RAW K , and D-Raw decryption by symmetric key K is denoted by D RAW K .

[0006] When encrypting with block cipher E, L E Encrypting plaintext longer than a bit with a block size L E The input is divided into blocks, and these are then individually encrypted using a symmetric key. The encryption of each plaintext block completely independently of the others is called ECB mode (block cipher). Unlike raw encryption, ciphers operating in ECB mode can handle input of arbitrary length. In this case, if the last plaintext block is shorter than the block size of the block cipher, so-called padding is applied to fill this last plaintext block in a predetermined manner. ECB is the simplest mode of operation for block ciphers, but it has the drawback that, using the same key, the same plaintext block is encrypted into the same ciphertext block, thereby allowing an attacker to infer about the corresponding plaintext block.

[0007] To address this weakness of ECB, more complex operating modes (such as CBC, CFB, OFB, and CTR) have been developed. In these modes, instead of encrypting individual plaintext blocks independently and directly as in ECB mode, the encryption of individual plaintext blocks is more or less closely related to each other. As a result, the encryption of the next plaintext block includes not only the plaintext block itself and the key, but also additional data, usually one block in length, generated during the encryption of the preceding block. In this case, the data included in the encryption of the next plaintext block may depend on the preceding plaintext block (CBC, CFB) or not (OFB, CTR).

[0008] In this way, broadly speaking, the same plaintext block is usually encrypted into various ciphertext blocks, except for the initial plaintext block, which has no preceding block to receive additional input data. To address this, an initialization vector of one block length is used, which is usually used as this additional data when encrypting the first block. In this case, each initialization vector is allowed to be used only once, i.e., for only one plaintext block, otherwise the same ciphertext block is generated again for the same plaintext block (with the same key), i.e., the initialization vector must be a nonce while using the same key. In this case, the initialization vector only needs to be new, i.e., a nonce, and does not need to be kept secret. Rather, the initialization vector used for encryption is also needed for decryption, i.e., the initialization vector needs to be known to both the sender and receiver. Since the initialization vector does not need to be kept secret, it can be transmitted as an unencrypted explicit part of the message, as is done, for example, in TLS. In this case, the initialization vector cannot be transmitted in encrypted form, because without the initialization vector existing as a plaintext block, the receiver would not be able to decrypt the encrypted message.

[0009] However, explicitly transferring the initialization vector, especially as part of a short message, is resource-intensive because the initialization vector is typically one block long, for example 128 bits in the case of AES. If the maximum number of messages to be encrypted with the same key is known in advance, the sender can use a counter that increments by one for each new message. In this case, the sender can generate a new initialization vector for each new message, typically one block long, by either supplementing the counter bits with additional bits using a suitable padding method coordinated between the sender and receiver, or by using a cryptographic hash function followed by, if necessary, adaptation to the required length, because the counter was incremented before. This can then be used to encrypt the message. In this case, instead of sending the entire initialization vector with each message, only the counter—that is, the counter bits representing the number of messages—are sent. This reduces the space required in the message from, for example, 128 bits to, for example, 32 bits in the case of a 32-bit counter.

[0010] It would be particularly space-efficient to use implicitly shared initialization vectors by first agreeing on a common starting initialization vector and rules for generating a new, subsequent initialization vector from the current initialization vector, and then, for each new message, both sides synchronously generate this next new initialization vector using the pre-agreed rules. The problem in this case is that messages may be lost or arrive in the wrong order, thereby losing the synchronization of the initialization vectors used by the sender and receiver.

[0011] Another equally space-saving method for implicitly synchronizing the initialization vector between the sender and receiver is to securely derive the initialization vector from the message itself, which will need to be transmitted anyway, and which the sender and receiver can do independently of each other. The problem in this case is that the initialization vector must, on the one hand, be known to the sender before the encryption process and therefore deriveable from the plaintext message, while on the other hand, it must be known to the receiver before the decryption process and therefore deriveable from the encrypted message, which are (seemingly) contradictory requirements.

[0012] A special AEAD (Authenticated Encryption with Associated Data) method, i.e., a method that enables both encryption and authentication, uses a so-called synthetic initialization vector (SIV). This SIV is characterized by generating an initialization vector used for encryption from the message itself, by generating a unique authentication stamp (tag) from the message, which is then used as the initialization vector when initializing the message or a part of the message. For example, variations of AEAD based on synthetic initialization vectors have been developed for various AEAD operating modes such as the combination of CMAC and CTR (SIV-AES), AES-GCM (AES-GCM-SIV), or CCM (CCM-SIV) (see also Patent Document 3). However, the initialization vector, i.e., the authentication stamp generated from the unencrypted message, is also required when decrypting the message, but since the initialization vector cannot be directly derived by the recipient from the encrypted message, the initialization vector must be sent unencrypted to the recipient along with the encrypted message, and thus space in the message is not saved by using the synthetic initialization vector in the manner described above.

[0013] Patent Document 4 defines an authentication method similar to CBC-MAC based on block ciphers. This method, instead of relying solely on the message itself as in the case of CBC-MAC, calculates the authentication through a message that has been extended by a prefix containing the hash value of the message.

[0014] Furthermore, Patent Document 5 discloses a computer implementation method for a receiver to verify a message received from a sender. This message includes a first and a second part. The method includes receiving a token from an authentication unit and a key associated with the sender. To verify the message, the method processes and compares the first part of the message together with the token and the second part of the message together with the key.

[0015] The widely accepted requirement to use a new initialization vector to encrypt every new plaintext is sufficient, though not always necessary, to address the aforementioned weaknesses. That is, if it can be ensured that the first block of plaintext is always new, the requirement to use a new initialization vector can be omitted in operating modes that include preceding blocks, especially preceding ciphertext blocks, when concatenating blocks (e.g., CBC, CFB). In other words, for fixed keys, it is sufficient that the combination of the initialization vector and the first plaintext block is new. If the first plaintext block is always new, in these specific cases, the use of initialization vectors can even be omitted entirely.

[0016] For example, if, for space reasons, you want to omit or must omit a guaranteed new (explicit or implicit) initialization vector for each plaintext to be encrypted, it is worthwhile to design the plaintext format such that the probability that the first block of the plaintext is always new is maximized.

[0017] The probability that each plaintext is "novel," that is, that each pair is different, is greater than the probability that the first block of each plaintext is novel, that is, that each pair is different. Therefore, in order to realize a novel first block with the highest possible probability, it is meaningful to concentrate the "novelty" of the entire plaintext into the first block, that is, to design the first block of each plaintext so that the first blocks of two different plaintexts are always different.

[0018] Here, the difference between two plaintexts can appear in various places in the plaintext depending on the plaintext pair; that is, "novelty" can be distributed across the entire bit position of the plaintext. Therefore, in the general case, simply resorting each plaintext bit will not allow us to find a plaintext format that guarantees the most possible newest first plaintext block. However, the "novelty" contained in a plaintext can be accumulated very well by applying the cryptographic hash function HASH to a selected specific sequence of bits whose combination may be novel. In that case, if at least one bit differs between two bit sequences BF1 and BF2 belonging to two different plaintexts and used to form hash values, there is a very high probability that the hash values ​​HashTag1:=HASH(BF1) and HashTag2:=HASH(BF2) of the two bit sequences containing this different bit will also be different.

[0019] Next, the hash value HashTag := HASH(BF) calculated in this way can be used directly as an initialization vector, or an initialization vector that is always new if there is a plaintext bit sequence BF included in the hash value calculation can be derived from it. In the case of the composite initialization vector (SIV) described above, this can be done, for example. In that case, the problem is that, as already explained above, the receiver must know the initialization vector in order to be able to decrypt the fully or partially encrypted plaintext. If we try to avoid explicitly transmitting the initialization vector as part of the plaintext without encryption for space-saving reasons, this means that no part of the bit sequence BF used to form the hash value HashTag should be encrypted. This is because otherwise the receiver would not be able to derive the initialization vector used by the sender during encryption from the received plaintext, which is partially or fully encrypted. [Prior art documents] [Patent Documents]

[0020] [Patent Document 1] German Patent Application Publication No. 102021001095 Specification [Patent Document 2] German Patent Application Publication No. 102021001095 Specification [Patent Document 3] German Patent Application Publication No. 102019113026 Specification [Patent Document 4] International Publication No. 2009 / 013420 [Patent Document 5] International Publication No. 2019 / 079890 [Overview of the Initiative] [Problems that the invention aims to solve]

[0021] Therefore, the object of the present invention is to provide an improved method for encrypting plaintext to be encrypted contained in a plaintext message, which can achieve high security even though the bit sequence derived from the plaintext is used during encryption. [Means for solving the problem]

[0022] Based on the present invention, this problem is solved by a method having the features of claim 1. Advantageous embodiments will become apparent from the dependent claims relating thereto.

[0023] The method according to the present invention is a plain text message M P The plaintext PT that should be encrypted is encrypted ENCR ZF ENCR1,ENCR2 M To serve this purpose, a plaintext message consists of this plaintext to be encrypted and additional or related data blocks AD ("Related Data") that are not to be encrypted. , M P =(PT, AD) holds true.

[0024] This encryption method includes the ciphertext message M C The ciphertext portions CT1 and CT2 contained within are decrypted using DECR. ZF DECR1,DECR2 M The method includes such that the ciphertext message consists of this ciphertext portion to be decrypted and an unencrypted associated data block. In both cases, a novelty bit sequence ImplAD ("implicit associated data") may be included, which serves as an additional source of novelty.

[0025] According to the present invention, a reversible decomposition function ZF is provided that assigns its decompositions PT1 and PT2 to the plaintext to be encrypted. Decomposition, in the sense used here, is the result of applying a decomposition function that supplies the plaintext portion to the plaintext. Furthermore, at least one encryption function ENCR1, ENCR2 is provided that implicitly assigns appropriate fixed key material and encrypts the plaintext to be encrypted by the encryption function after incorporating a variable input bit sequence N, where the input bit sequence functions as the first parameter and the plaintext to be encrypted functions as the second parameter. Furthermore, at least one decryption function DECR1, DECR2 is provided that implicitly assigns appropriate fixed key material and decrypts the ciphertext CT generated by the encryption function after incorporating the same input bit sequence, where the input bit sequence functions as the first parameter and the plaintext to be encrypted functions as the second parameter.

[0026] In this case, encryption of the plaintext to be encrypted contained in the plaintext message is performed using a novelty bit sequence, which provides two ciphertext portions. The first ciphertext portion can be obtained by at least one encryption function from a second plaintext portion, associated data blocks, and a novelty bit sequence concatenated in any order as a first parameter, and from the first plaintext portion as a second parameter. The second ciphertext portion can be obtained by at least one encryption function from the first ciphertext portion and the second plaintext portion as first and second parameters. Decryption corresponding to encryption returns plaintext by taking a novelty bit sequence from the ciphertext portion contained in the ciphertext message, the plaintext portion being obtainable by decryption from the first ciphertext portion, the second ciphertext portion, associated data blocks, and the novelty bit sequence, the second plaintext portion being obtainable from the ciphertext portions as first and second parameters by at least one encryption function, and the first plaintext portion being obtainable separately from the second plaintext portion, associated data blocks, and novelty bit sequence concatenated in the order used during encryption as the first parameter, as well as from the first ciphertext portion as the second parameter, by at least one decryption function.

[0027] In other words, the fundamental idea behind the method according to the present invention is to utilize a reversible decomposition function ZF that assigns two plaintext parts PT1 and PT2 to each plaintext PT to be encrypted. That is, ZF(PT)=(PT1,PT2) holds. Then, these plaintext parts are encrypted not in one step but in two separate steps, for example, sequentially. Since the decomposition function is reversible, PT=ZF for each plaintext to be encrypted. -1 (ZF(PT)) holds true, and here ZF -1represents the inverse function of the decomposition function. That is, the inverse function can always be used to derive the original plaintext from the plaintext portion in a unique way. In this case, the decomposition function does not necessarily have to be defined for all bit sequences in the plaintext we are focusing on; in many cases, it is sufficient to define it for the set of plaintexts to be encrypted with the same key. For example, if only plaintexts longer than 20 bytes are to be encrypted, it is sufficient for the decomposition function to be defined only for plaintexts longer than 20 bytes.

[0028] It should be noted that each decomposition function is novel in the sense that, based on its reversibility, its decompositions ZF(PT)=(PT1,PT2) and ZF(PT')=(PT'1,PT'2) are also different for two different plaintexts PT and PT', meaning that PT1≠PT'1 or PT2≠PT'2 always apply.

[0029] For example, if there exists a decomposition function for a set of plaintext that is potentially to be encrypted, the communication partner involved in encryption / decryption, such as the sender, can encrypt the plaintext parts PT1 and PT2 contained in the decomposition ZF(PT) separately, for example, sequentially, instead of the original plaintext PT, and transmit both resulting ciphertext parts CT1 and CT2. The other communication partner, in this case the receiver, can decrypt the ciphertext parts separately after transmission. After both ciphertext parts have been decrypted, the original plaintext can be determined from both plaintext parts obtained by decryption using the inverse function of the decomposition function. That is, PT = ZF -1 (PT1,PT2) holds true.

[0030] Instead of encrypting the entire plaintext in one step, sequentially encrypting the plaintext parts included in the decomposition has the advantage that each plaintext part included in the decomposition, or the bit sequence novelly generated from them, such as the encryption of the plaintext part, can be used as an initialization vector when encrypting the other plaintext part included in the decomposition, or for generating the initialization vector.

[0031] In particular, when encrypting the first plaintext portion, selected bits or all bits of the second plaintext portion can be used as an initialization vector or for forming an initialization vector. Then, when encrypting the second plaintext portion, the encrypted first plaintext portion thus generated can be used as an initialization vector or for forming an initialization vector.

[0032] In other words, the method according to the present invention allows for the omission of the use of initialization vectors, which tend to cause the problems described at the beginning of the conventional method, when performing symmetric encryption of new plaintext, without significantly sacrificing security, and enables the complete encryption of the plaintext.

[0033] In this case, basically, one encryption function and its corresponding decryption function are sufficient to carry out the present invention, but in a very preferred advanced form, it may be intended that two pairs of encryption and decryption functions be applied. These can be assigned to individual plaintext or ciphertext portions. For example, the plaintext portion PT1 to be encrypted is encrypted by the first encryption function ENCR1, and the second plaintext portion PT2 is encrypted by the second encryption function ENCR2. Then, when decrypting the ciphertext portions CT1 and CT2, the first or second decryption functions DECR1 and DECR2 can be used again accordingly.

[0034] Encryption ENCR ZF ENCR1,ENCR2 M The ciphertext portion ENCR is shown in the following formula. ZF ENCR1,ENCR2 M (PT,AD,ImplAD) ):= (CT1,CT2) is supplied. Here, CT1:=ENCR1(PT2||AD||ImplAD,PT1) and CT2:=ENCR2(CT1,PT2), Here, (PT1, PT2) is the decomposition of the plaintext PT by ZF, i.e., (PT1, PT2) := ZF(PT).

[0035] ImplAD, that is, DECR DECR1,DECR2 M The encrypted message M incorporates (CT1, CT2, AD, ImplaAD). C = From the ciphertext pair (CT1,CT2) contained in (CT1,CT2,AD), ENCR ZF ENCR1,ENCR2 M Corresponding decryption DECR ZF DECR1,DECR2 M DECR ZF DECR1,DECR2 M (CT1,CT2,AD,ImplAD) is defined by PT, where PT2:=DECR2(CT1,CT2), PT1:=DECR1(PT2||AD||ImplAD,CT1), and PT:=ZF -1 (PT1, PT2)

[0036] High flexibility in the data to be transmitted arises through related data blocks that should not be encrypted, because encrypted and unencrypted data portions can be combined. Furthermore, if the probability of novelty in the plaintext is insufficient, it can be increased through the use of a novelty bit sequence. Nevertheless, since it may be sufficient to omit these portions in many cases, a very preferred development of the method according to the present invention allows the related data blocks and / or novelty bit sequence to be set to empty.

[0037] A decomposition function is called a conventional decomposition function in the sense of the invention provided here if there exists a case where u > 0, and thereafter, for all plaintext PT longer than u, ZF(PT) = (PT1, PT2) always leads to L(PT1) = u and PT = PT1||PT2. Here, L(BF) represents the bit length of the bit sequence BF. Accordingly, all decomposition functions other than those described above are called unconventional.

[0038] As explained above, depending on the encryption method applied, it may be meaningful to "collect" the novelty contained in the plaintext into a first or second plaintext portion. The decomposition of the plaintext is controlled by a decomposition function in the method according to the present invention, and unconventional decomposition functions offer special flexibility. Therefore, in a very preferred development of the present invention, it may be intended to use an unconventional decomposition function as the decomposition function.

[0039] The following examples of decomposition functions are all examples of such unconventional decomposition functions. For example, a decomposition function could be chosen such that the first plaintext part is formed by the first half of the plaintext, and the second plaintext part is formed by the second half of the plaintext, and if the plaintext contains an odd number of bits, the first plaintext part is one bit longer than the second plaintext part. Another possibility is that all even bits of the plaintext are assigned to the first plaintext part, and all odd bits to the second plaintext part. In practice, there would likely be few meaningful uses for this, but the sum of the lengths of both plaintext parts does not necessarily have to be equal to the length of the plaintext. For example, the first plaintext part could be formed by the first 20 bytes of the plaintext, and the second plaintext part by the entire plaintext.

[0040] An encryption function implicitly provided with appropriate fixed-key material that encrypts plaintext into ciphertext while incorporating a variable input bit sequence is called novel in the sense of the present invention if, for each plaintext to be encrypted, the use of a different variable input bit sequence leads to a different ciphertext with a sufficiently high probability for its intended purpose; that is, for each plaintext to be encrypted, two non-identical input bit sequences, i.e., N1≠N2, lead to a result ENCR(N1,PT)≠ENCR(N2,PT) with sufficient probability for its intended purpose. The constraint "with a sufficiently high probability for its intended purpose" is imposed here because the novelty bit sequence N is not necessarily the initialization vector itself, and the necessary initialization vector must be formed, in some cases, by pseudo-randomization (e.g., by applying a cryptographic hash function) and / or by length adaptation (both within ENCR). In this process, collisions, i.e., the generation of the same initialization vector from non-identical input bit sequences N, cannot be completely eliminated.

[0041] In the described method, it is preferable that the novelty contained in the input bit sequence is not lost when the plaintext is encrypted by the encryption function, but rather is further transmitted to each ciphertext as well as possible, and as completely as possible. Therefore, in a very convenient embodiment of the present invention, it is intended that at least one encryption function be a novelty-acquiring encryption function.

[0042] This is especially important for the first encryption function, as the encryption of the first plaintext portion by the first encryption function is used as the input bit sequence for the encryption of the second plaintext portion by the second encryption function.

[0043] In other words, the decomposition function serves to break down the plaintext into two plaintext parts that are to be encrypted separately. The decomposition function is preferably selected so that the resulting plaintext parts are compatible with the encryption or decryption method used, and in particular so that the prerequisites for the secure application of the encryption function are met as well as possible, for example, by selecting the decomposition function such that the probability of novelty of the first plaintext part is maximized for the message to be encrypted, which includes the plaintext.

[0044] In a highly preferred evolution of the present invention, the decomposition function is defined only once and implemented for both encryption and decryption. That is, a fixed decomposition function that best satisfies the above requirements is agreed upon and subsequently used between the encrypting entity (e.g., the sender) and the decrypting entity (e.g., the receiver). The decomposition function to be used may be fixedly set or agreed upon for the entire lifespan of the system, but in a highly preferred alternative embodiment of the present invention, the encrypting entity and the decrypting entity may also negotiate the decomposition function for each session or for several consecutive sessions, within the framework of a pre-operation adjustment phase, a so-called handshake, in which case the decomposition function that is considered best for ensuring the security of messages expected to be exchanged in future sessions should be selected.

[0045] Another preferred alternative is to have a fixed set of decomposition functions supported by the encryption or decryption system. In such a case, for example, during the handshake between the system that encrypts and transmits and the system that receives and decrypts, it can be decided which of the available decomposition functions to use thereafter.

[0046] However, the types of messages exchanged during a session are often unknown, meaning that in such cases, it is difficult to estimate which decomposition function is best suited to each session. In particular, when encrypting plaintext, it may be useful to select a decomposition function that is particularly well suited to that specific plaintext as needed. In order for the decrypting entity to determine which decomposition function is being used to encrypt the plaintext, the decrypting entity must be notified of it. This can be done, for example, by assigning sequential numbers to the decomposition functions supported by the decrypting entity, which are known to both the encrypting and decrypting entities, and then assigning the number of the decomposition function used by the encrypting entity to the plaintext. Such an extension may seem to contradict the objective of keeping the message to be transmitted as short as possible. However, if only a small number of decomposition functions are supported, for example 16, then fewer bits are sufficient to code the numbers of the decomposition functions used in encryption; for example, 4 bits are sufficient if there are 16 possible decomposition functions.

[0047] It is proposed that the number of the decomposition function ZF used be appended to all or part of the plaintext. Furthermore, for all plaintext PT, it is proposed that the cryptaging entity and the decrypting entity agree on a fixed position within the plaintext PT, for example at its beginning or end, and a fixed number of bits used for coding the number of the decomposition function ZF used.

[0048] Furthermore, not every plaintext PT requires a unique decomposition function; many plaintext PTs can be securely encrypted using a predetermined default or standard decomposition function ZF. In such cases, it may be beneficial for the encrypting entity to omit the transmission of the ZF number and instead inform the recipient that the default decomposition function should be used for decrypting the plaintext. To enable the decrypting entity to determine whether the received plaintext contains the ZF number used, the plaintext must be extended by this binary information, which we call indicator bits.

[0049] Therefore, in an advanced form of the present invention, it is proposed that each plaintext be extended by an indicator bit that indicates whether or not the plaintext has been extended by the number of the decomposition function ZF used. Furthermore, it is proposed that for all plaintexts, the encrypting entity and the decrypting entity agree on the position of the indicator bit in the extended plaintext, for example, that the first or last bit of the original plaintext extended by the indicator bit be determined for the information in question.

[0050] Since the decomposition function is always applied to the plaintext, the encrypting entity can encrypt the extensions to the original plaintext related to the decomposition function used, namely the indicator bits and / or the number of the decomposition function used. A consideration in this process is that when the plaintext is decomposed by the decomposition function, especially when an unconventional decomposition function is used, the positions of individual bits within the plaintext may change. If additional data needs to be encrypted, it may be useful to determine its position in relation to both parts of the plaintext rather than in relation to the original plaintext. This allows the decrypting entity to determine which decomposition function to use by referring to both parts of the plaintext before applying it.

[0051] In particular, it may be intended to encrypt the indicator bits and / or numbers included in the extended plaintext of the decomposition function used during encryption.

[0052] Further advantageous configurations and various embodiments of the method of the present invention will become apparent from the examples described below in detail with reference to the figures. [Brief explanation of the drawing]

[0053] [Figure 1] This is a schematic diagram illustrating encryption and decryption in the first embodiment. [Figure 2] This is a schematic diagram illustrating encryption and decryption in the second embodiment. [Modes for carrying out the invention]

[0054] Figure 1 shows a schematic diagram illustrating the encryption and decryption of plaintext PT.

[0055] Proposed encryption method ENCR ZF ENCR1,ENCR2 M This is a plain text message M containing multiple components and other data. P It receives as input and encrypts the message M using encryption functions ENCR1 and ENCR2. P Encrypt the part marked with an asterisk. Encryption method: ENCR ZF ENCR1,ENCR2 M The following explanation describes the components used by this method, the input format, and how to use the components to send plain text messages. P A fully or partially encrypted ciphertext message M from its components. C This consists of a description of the actual method by which it is generated.

[0056] ENCR encryption system ZF ENCR1,ENCR2 M Components of: - Reversible decomposition function ZF - An encryption function ENCR1 implicitly provided with appropriate fixed-key material, wherein the plaintext PT to be encrypted is encrypted by including a variable input bit sequence N in ENCR1(N,PT). - A second encryption function ENCR2 implicitly comprising suitable fixed-key material, wherein the second encryption function ENCR2 encrypts plaintext PT by including a variable input bit sequence N in ENCR2(N,PT). Input format: - A message M consisting of plaintext PT to be encrypted and associated data block AD of arbitrary length ("associated data"). P , in other words, M P =(PT,AD). The associated data block AD is not encrypted, but it contributes to the formation of the input bit sequence N and, consequently, to increasing the probability of its novelty. • If the use of the associated data block AD is omitted, an empty bit sequence can be selected as the AD. -Similarly, it contributes to the formation of the input bit sequence N and, consequently, to increasing the probability of its novelty, and is known to both the sender and receiver, thereby contributing to the message M P An implicit novelty bit sequence ImplAD ("Implicit Associated Data") of arbitrary length that is not part of the ImplAD, for example, a counter or hash value known on both sides, or encryption of such a counter. • If the use of the novelty bit sequence ImplAD is omitted, an empty bit sequence can be selected as ImplAD.

[0057] In cases where the related data block AD and the novelty bit sequence ImplAD are omitted, the method schematically shown in Figure 2 can be obtained, and the explanations described here apply to this method as well.

[0058] Encryption ENCR ZF ENCR1,ENCR2 M : -input: 1.MP =(PT,AD) 2. Implad - Determining the output: 1. (PT 1, PT2):=ZF(PT) 2.CT1:=ENCR1(PT2||AD||ImplAD,PT1) 3.CT2:=ENCR2(CT 1, PT2) -output: 1. CT1, CT2, the following applies here. M C :=(CT 1, CT 2, AD)

[0059] In short, the plain text message M consists of PT and AD. P It is proposed that the encryption of plaintext PT in (PT,AD) be determined as follows: ENCR ZF ENCR1,ENCR2 M (PT,AD,ImplAD):=(CT1,ENCR2(CT1,PT2)) Here, (PT1,PT2):=ZF(PT) CT1:=ENCR1(PT2||AD||ImplAD,PT1)

[0060] Proposed Decryption Method DECR ZF DECR1,DECR2 M M is a ciphertext message consisting of multiple partially encrypted components. C In addition, other data is received as input, and message M C The encrypted portion is decrypted using both decryption functions DECR1 and DECR2. Decryption method DECR ZF DECR1,DECR2 M The following explanation describes the components used by this method, the input format, and the partially encrypted ciphertext message M that is generated using these components. C The original message M from the component PIt consists of an explanation of the actual method for generating the plaintext part.

[0061] Decryption system DECR ZF DECR1,DECR2 M Components of: - The inverse function ZF of the reversible decomposition function ZF used during encryption -1 - The decryption function DECR1 belonging to ENCR1 and implicitly equipped with appropriate fixed key material decrypts the ciphertext CT into DECR1(N, CT) by taking in a variable input bit sequence N, so that for all plaintext PTs to be encrypted by ENCR1, DECR1(N, ENCR1(N, PT)) = PT holds. - The decryption function DECR2 belonging to ENCR2 and implicitly equipped with appropriate fixed key material decrypts the ciphertext CT into DECR2(N, CT) by including a variable input bit sequence N, so that for all plaintext PTs to be encrypted by ENCR2, DECR2(N, ENCR2(N, PT)) = PT holds. Input format: - A message M consisting of two ciphertexts CT1 and CT2 and an unencrypted related data block AD, that is, M C , that is, M C = (CT1, CT2, AD). - ImplAD, similar to the encryption case Decryption DECR ZF DECR1,DECR2 M : - Input: 1. M C = (CT 1, CT 2, AD) 2. ImplAD - Output determination: 1. PT2 := DECR2(CT1, CT2) 2. PT1 := DECR1(PT2 || AD || ImplAD, CT1) 3. PT := ZF -1 (PT 1, PT2) -output: 1. PT, here M P The equation :=(PT,AD) holds true.

[0062] In summary, the ciphertext message M consists of CT1, CT2, and AD. C It is proposed that the decryption of the encrypted ciphertext portion (CT1,CT2) of =(CT1,CT2,AD) be determined as follows: DECR ZF DECR1,DECR2 M (CT1,CT2,AD,ImplAD):=ZF -1 (DECR1(PT2||AD||ImplAD,CT1),PT2) Furthermore, PT2:=DECR2(CT1,CT2)

Claims

1. Plaintext message (M ) for encrypting the plaintext (PT) to be encrypted included in the ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ), wherein the plaintext message (M Ｐ ) is composed of the plaintext (PT) to be encrypted and an associated data block (AD) not to be encrypted, and a corresponding method for decrypting (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ Ｃ １ ) the ciphertext part (CT ２ ), CT １ ) included in the ciphertext message (M ２ ), wherein the ciphertext message (M １ ) is composed of the ciphertext part (CT ２ ), CT １ ) and an unencrypted associated data block (AD), In either case, the method includes an implicit novelty bit sequence (ImplAD) that serves as an additional source of novelty, The plaintext (PT) to be encrypted is divided into two plaintext parts (PT １ PT ２ A reversible decomposition function (ZF) is provided that decomposes it into the following: Encryption function (ENCR １ ,ENCR ２ At least one encryption function (ENCR) that encrypts plaintext (PT) to be encrypted by including a variable input bit sequence (N) １ ,ENCR ２ ) is implicitly assigned an appropriate fixed key material, The aforementioned encryption function (ENCR １ ,ENCR ２ At least one encryption function (ENCR) that decrypts the ciphertext (CT) generated by ) by including the same variable input bit sequence (N). １ ,ENCR ２ ) at least one decoding function (DECR １ , DECR ２ ) is implicitly assigned an appropriate fixed key material, Plain text message (M Ｐ The encryption (ENCR) of the plaintext (PT) to be encrypted included in ) ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ) is performed including a novelty bit sequence (ImplAD) and two ciphertext parts (CT １ CT ２ ) is supplied, and at this time, First ciphertext portion (CT １ ) is at least one of the aforementioned encryption functions (ENCR １ ,ENCR ２ ) and the second plaintext portion (PT) concatenated in any order as the first parameter ２ From the associated data block (AD), and novelty bit sequence (ImplAD), and the first plaintext portion (PT) as a second parameter １ ) can be obtained from, Second ciphertext portion (CT ２ ) is the at least one of the encryption functions (ENCR １ ,ENCR ２ ) and the first ciphertext portion (CT) as the first parameter. １ ), and the second plaintext portion as the second parameter (PT ２ ) can be obtained from, The aforementioned ciphertext message (M Ｃ The ciphertext portion (CT) included in ) １ CT ２ ) encryption (ENCR ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ Decryption corresponding to (DECR) ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ ) is performed by including the novelty bit sequence (ImplAD) and returns the plaintext (PT), at which time, The aforementioned plain text portion (PT) １ PT ２ ) is decryption (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ ) by which the first ciphertext portion (CT １ ), the second ciphertext portion (CT ２ The second plaintext portion (PT) can be obtained from the associated data block (AD), and the novelty bit sequence (ImplAD), and the second plaintext portion (PT) ２ ) is the at least one decoding function (DECR １ , DECR ２ ) The ciphertext portion (CT) as the first and second parameters １ CT ２ ) from, and the first plaintext portion (PT １ ) is, separately from this, the at least one decoding function (DECR １ , DECR ２ ) thereafter, as the first parameter, the second plaintext portion (PT) concatenated in the order used during encryption. ２ From the associated data block (AD), and the novelty bit sequence (ImplAD), and the first ciphertext portion (CT) as a second parameter １ It can be obtained from the above decomposition function (ZF), and the inverse function (ZF －１ ) by the aforementioned plaintext portion (PT １ PT ２ A method characterized by being able to obtain plaintext (PT) from ).

2. Each of the two encryption and decryption functions (ENCR １ ,ENCR ２ , DECR １ , DECR ２ ) applies, Each of the aforementioned encryption functions (ENCR １ ,ENCR ２ The first and second encryption functions (ENCR) encrypt the plaintext (PT) to be encrypted by including a variable input bit sequence (N). １ ,ENCR ２ Each of them is implicitly assigned an appropriate fixed key material, Each of the aforementioned encryption functions (ENCR １ ,ENCR ２ The first and second encryption functions (ENCR) respectively decrypt the ciphertext (CT) generated by ) by including a variable input bit sequence (N). １ ,ENCR ２ The first and second decoding functions (DECR) corresponding to ) １ , DECR ２ ) is implicitly assigned an appropriate fixed key material, The plaintext message (M Ｐ ) is encrypted by including the plaintext (PT) to be encrypted in the ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ) by including the novelty bit sequence (ImplAD), resulting in two ciphertext parts (CT １ , CT ２ ), and at this time, The first ciphertext portion (CT １ ) is the first encryption function (ENCR １ ) and the second plaintext portion (PT) concatenated in any order as the first parameter ２ From the associated data block (AD), and the novelty bit sequence (ImplAD), and the first plaintext portion (PT) as the second parameter １ ) can be obtained from, The second ciphertext part (CT ２ ), by the second encryption function (ENCR ２ ), can be obtained from the first ciphertext part (CT １ ) and the second plaintext part (PT ２ ) as the first and second parameters, The aforementioned ciphertext message (M Ｃ The ciphertext portion (CT) included in ) １ CT ２ ) the encryption (ENCR ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ The decoding (DECR) corresponding to ) ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ ) is performed using the novelty bit sequence (ImplAD) and returns a plaintext (PT), at which time, The aforementioned plain text portion (PT) １ PT ２ ) is the decoding function (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ ) by the first ciphertext portion (CT １ ), the second ciphertext portion (CT ２ The second plaintext portion (PT) can be obtained from the associated data block (AD), and the novelty bit sequence (ImplAD), and the second plaintext portion (PT) ２ ) is the second decoding function (DECR ２ ) The ciphertext portion (CT) as the first and second parameters １ CT ２ ) from, and the first plaintext portion (PT １ ) is separate from the first decoding function (DECR １ ) by which the second plaintext portion (PT) is concatenated as the first parameter in the order used during encryption. ２ From the associated data block (AD), and the novelty bit sequence (ImplAD), and the first ciphertext portion (CT) as a second parameter １ The method according to claim 1, characterized in that it can be obtained from ).

3. The method according to claim 1 or 2, characterized in that the associated data block (AD) and / or the novelty bit sequence (ImplAD) are set to empty.

4. The method according to any one of claims 1 to 3, characterized in that an unconventional decomposition function (ZF) is used as the aforementioned decomposition function (ZF).

5. The at least one of the encryption functions (ENCR １ ,ENCR ２ The method according to any one of claims 1 to 4, characterized in that a novel cryptographic function is used as the method for acquiring novelty.

6. The aforementioned decomposition function (ZF) is defined only once and the encryption (ENCR) ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ), and the decoding (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ The method according to any one of claims 1 to 5, characterized in that it is implemented in )

7. The aforementioned decomposition function (ZF) is used for encryption (ENCR). ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ) and decoding (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ The method according to any one of claims 1 to 5, characterized in that an agreement is made between the two communication partners regarding one or more consecutive sessions of the two communication partners performing the same action.

8. The aforementioned decomposition function (ZF) is defined as a set of decomposition functions (ZF), and the encryption (ENCR) ＺＦ ＥＮＣＲ１，ＥＮＣＲ２ Ｍ ) and the decoding (DECR ＺＦ ＤＥＣＲ１，ＤＥＣＲ２ Ｍ The method according to any one of claims 1 to 5, characterized in that it is implemented in )

9. The method according to claim 8, characterized in that each of the set of decomposition functions (ZF) is assigned a sequential number for identification purposes.

10. The method according to claim 9, characterized in that the number of the decomposition function (ZF) used for encryption and required for decryption is incorporated into the plaintext (PT) to be encrypted.

11. The aforementioned number is the part of the plaintext (PT) that is, or is part of one or both of the plaintext parts (PT) １ PT ２ The method according to claim 10, characterized in that it is positioned in a predetermined location within ).

12. The number of the decomposition function (ZF) is the plaintext (PT) or the plaintext portion (PT) １ PT ２ The method according to any one of claims 9 to 11, characterized in that the plaintext (PT) is expanded by an indicator bit indicating whether or not it is included in one of the following.

13. The indicator bit is a part of the plaintext (PT) that is one or both of the plaintext parts (PT) １ PT ２ The method according to claim 12, characterized in that it is positioned in a predetermined location within ).

14. The method according to any one of claims 9 to 13, characterized in that a standard decomposition function (ZF) is used if the aforementioned number does not exist.

Images