Improved encryption and authentication method with associated data

Abstract

The present inventions there is provides a method, system and computer media of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating a plurality of sets of masks, the plurality of sets of masks being generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function and a function (Φs) of a set of natural integers; encoding a first set of data for secure transmission using a first set of masks of the plurality of sets of masks and a second set of data for secure transmission using a second set of masks of the plurality of sets of masks; generating an encoded message from the first and second set of encoded data for transmission to the intended receiver. The invention further provides a decryption method, system and computer media.

Description

[0001] IMPROVED ENCRYPTION AND AUTHENTICATION METHOD WITH ASSOCIATED DATA

[0002] FIELD OF THE INVENTION

[0003] The present invention relates to a computer-implemented method and an associated system for encrypting messages and authenticating them with associated data.

[0004] BACKGROUND

[0005] Use of encryption and the need to protect the exchange of information between users is well known. Often this includes encryption of messages, such as text, voice and images. The process is often referred to as "end-to-end encryption" particularly if the message is encrypted in a manner that makes it unintelligible to a server or other services involved in message routing. As a result, only the message sender and the intended recipients are able to see the unencrypted content.

[0006] Different types of encryption processes are known for example, "Authenticated Encryption" (AE) is well known and relates to a message that is encrypted and later decrypted, and that can be verified by demonstrating that the decrypted data is identical to the encrypted data.

[0007] In another process referred to as "Authenticated Encryption with Associated Data" (AEAD) the encrypted message is associated with data that remains unencrypted, and on decryption, it is possible to verify that not only the decrypted data but also the associated data is identical to that which was initially processed.

[0008] In a previously proposed idea, an AE process is based on the construction of two sequences of masks from a one-way hash function which produces a digest as a bit string of a given length, a key and a pseudorandom nonce which are also the same length. The process further includes an exclusive OR (XOR) operation of a combination of the bit string in the masks and the nonce.

[0009] The encryption methods described above will be referred to as the basic methods in the remainder of the description of the present invention. These method works well as they offer high speed performance; can withstand classical and quantum attacks as long as the length is > 512; are also resistant to side channel attacks on the key; and are resilient to accidental reuse of the nonce for several encryptions with the same key. However, there are also some weaknesses.

[0010] The manner in which the masks are calculated independently of the data to be encrypted and to some extent in dependence of each other means that the masks are calculated in a sequential manner. This can be a disadvantage in certain applications, such as the processing of audio or video streams due to time for processing and the burden on resources.

[0011] In a "known plaintext" attack, where an attacker knows both the encrypted and plaintext data and seeks to calculate the key or to fool the integrity check by modifying the encrypted version, the basic processes do not allow an attacker to recover the value of the key or any of the values of the mask sequences with any advantage over a purely random oracle. However, in the case of message encryption, the processes do leave open the possibility of modifying the encrypted version to give an arbitrarily chosen decrypted version. This comes at the cost of modifying another part to give an unverifiable decrypted value without this being detected by the integrity check. As an example, if an attacker knows the number of packets in the message and the encrypted message it is possible for the attacker to choose an arbitrary value to the decrypted version of the message and to fool the integrity check. In the example of stream encryption, the encrypted stream is entirely malleable since it is possible for an attacker to modify the ciphertext to give an arbitrarily chosen content to the plaintext at decryption. This weakness is a serious drawback in some applications.

[0012] It is noted that for an effective encoding and encoding system there are many different proposed methods and systems and the variations between them can appear quite small. A general objective and one in which the present invention makes an important contribution is to improve the security margins of the method and system and at the same time increase the speed of processing. The present invention achieves this as described in greater details below.

[0013] The basic encryption methods further do not provide the AEAD functionality that is required for certain applications.

[0014] Whilst the basic encryption methods are resilient with regard to the reuse of the nonce with the same key, if the plaintext version of one of the data items were known to the attacker, decryption of data of the same order from another cipher using the same nonce is possible. As the nonce is a pseudo-random string of "s" bits with 2spossible values, the probability of accidental reuse after 2s / 2encryptions with the same key is 2s / 2, negligible as soon as s > 512. However, if the random number generator is itself seeded with insufficient entropy, significantly less than 512 bits, the probability of accidental reuse no longer has a controlled maximum value. Some use cases require that the probability of an attacker being able to decrypt certain data in the event of a known clear remains sufficiently high.

[0015] The basic encryption method for messages broken down into parts allows an attacker to know the length of the plaintext message from that of the encrypted and signed message, since the length of the nonce and that of the signature are themselves known. In certain applications, particularly for very short messages, this knowledge of the message length is in itself a weakness.

[0016] The present invention is intended to remedy one or more of the disadvantages associated with the prior art.

[0017] SUMMARY OF THE INVENTION

[0018] In accordance with a first aspect of the present inventions there is provided a method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating a plurality of sets of masks, the plurality of sets of masks being generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function and a function (s) of a set of natural integers; encoding a first set of data for secure transmission using a first set of masks of the plurality of sets of masks and a second set of data for secure transmission using a second set of masks of the plurality of sets of masks; generating an encoded message from the first and second set of encoded data for transmission to the intended receiver.

[0019] In an aspect, the data for transmission is split into multiple groups of data and wherein the first and second sets of masks are applied to the groups in parallel.

[0020] In an aspect, further comprising generating a signature for at least one of: a plurality of groups of encoded data; and sequentially updating a signature following the addition of each group of encoded data to a message for sending. In an aspect, generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result or comprises a random rotation process based on a hash logic function.

[0021] In an aspect, the signature is generated and applied to each group in parallel via an iterative process based on a group identifier (j).

[0022] In an aspect, further comprising generating, in parallel, the plurality of sets of masks and the signature for each of at least a first plurality of groups,

[0023] In an aspect, further comprises generating a message signature for the encoded message.

[0024] In an aspect, generating the plurality of sets of masks comprises: calculating M'o according to M'o = HXOR (No,s(j)), where HXOR is calculated from H, according to HXOR (M, N) = H(MAN) ands; iteratively calculating M'i according to M'i = H (M'j-i), for all 0 < i < n'; and calculating Mi according to Mi = HXOR (M'i, No ), for all 0 < i < n from HXOR; wheresis any bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits, such as for instance the function wheres(i) is the binary representation of integer i, completed on the left by as many bits as necessary for the length of s (i) to be equal to s; n' is a number of masks M'; n is number of masks M; m is an integer; No is a string of s bits; j is an identification number for each group.

[0025] In an aspect, in at least one group a portion of the data is left in the clear.

[0026] In an aspect, a nonce (N) is included in the secure transmission.

[0027] In an aspect, the nonce is determined prior to encryption.

[0028] In an aspect, the nonce is generated based on a timestamp.

[0029] In an aspect, the length (£) of a mask is concealed.

[0030] In an aspect, the method is a computer implemented method.

[0031] In an aspect, the data is received via a secure transmission and has previously been encoded in accordance with the first and following aspects. In accordance with a second aspect of the invention there is provided a method of decoding data from a secure transmission between an intended sender and an intended receiver, the method comprising: receiving an encoded packet stream including groups of encoded data; generating a plurality of sets of masks, the plurality of sets of masks being generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function and a function (s) of a set of natural integers; decoding a first set of data from the secure transmission using a first set of masks of the plurality of sets of masks and a second set of data from the secure transmission using a second set of masks of the plurality of sets of masks; rewriting the decoded data in an order corresponding to the order to data in an original message sent by the sender.

[0032] In an aspect, the received data is split into multiple groups of data and wherein the first and second sets of masks are applied to the groups in parallel based in a group identifier.

[0033] In an aspect, further comprising generating a signature to verify the authentication of the decoded message.

[0034] In an aspect, the signature to verify the message is generated for at least one of: a plurality of groups of encoded data; and sequentially updating a signature following the addition of each group of encoded data to a message for sending.

[0035] In an aspect, generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result or comprises a random rotation process based on a hash logic function.

[0036] In an aspect, the signature is generated and applied to each group in parallel via an iterative process based on a group identifier (j).

[0037] In an aspect, generating the plurality of sets of masks comprises: calculating M'o according to M'o = HXOR (No,s(j)), where HXOR is calculated from H (100), according to HXOR (M, N) = H(MAN) ands; iteratively calculating M'i according to M'i = H (MYi), for all 0 < i < n'; and calculating Mi according to Mi = HXOR (M'i, No ), for all 0 < i < n from HXOR; wheresis any bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits, such as for instance the function wheres(i) is the binary representation of integer i, completed on the left by as many bits as necessary for the length of s (i) to be equal to s; n' is a number of masks IVT; n is number of masks M; m is a bit integer; No is a string of s bits; j is an identification number for each group.

[0038] In an aspect, in at least one group a portion of the data is left in the clear.

[0039] In an aspect, the length £ of significant bits of the plaintext is concealed.

[0040] In an aspect, the method is computer implemented.

[0041] According to a further aspect of the present invention there is provided a system for encoding data for secure transmission between an intended sender and an intended receiver, the system comprising a computer configured to execute instructions wherein the instructions of the first aspect of the invention.

[0042] According to a further aspect of the present invention there is provided a system for decoding data from a secure transmission between an intended sender and an intended receiver, the system comprising a computer configured to execute instructions wherein the instructions of the second aspect of the invention.

[0043] According to a further aspect of the present invention there is provided a non-transient computer readable medium containing program instructions for causing a computer to perform the method of the first aspect of the invention.

[0044] According to a further aspect of the present invention there is provided a non-transient computer readable medium containing program instructions for causing a computer to perform the method of the second aspect of the invention.

[0045] According to a further aspect of the present invention there is provided a method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating for a packet stream, a mask and a signature; encrypting and signing the packet stream to form an encoded packet stream for secure transmission to the intended receiver; wherein the generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result.

[0046] According to a further aspect of the present invention there is provided a method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating for a packet stream, a mask and a signature; encrypting and signing the packet stream to form an encoded packet stream for secure transmission to the intended receiver; wherein the generation of the signature comprises a random rotation process based on a hash and exclusive OR functions.

[0047] According to a further aspect of the present invention there is provided a method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating for a packet stream, a mask and a signature; encrypting and signing the packet stream to form an encoded packet stream for secure transmission to the intended receiver; wherein a nonce is determined prior to encryption and is included in the secure transmission.

[0048] According to a further aspect of the present invention there is provided a method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating for a packet stream, a mask and a signature; encrypting and signing the packet stream to form an encoded packet stream for secure transmission to the intended receiver; wherein only part of the packet stream is encrypted, and all of the packet stream includes one or more signatures for subsequent authentication.

[0049] BRIEF DESCRIPTION OF FIGURES

[0050] Embodiments of the invention are described below with reference to the appended drawings, in which:

[0051] Figure 1 is a simplified overview of an encryption and decryption system according to the present invention.

[0052] Figure 2 is a flow chart showing a simplified process to encrypt and decrypt messages according to the present invention.

[0053] Figure 3 is a simplified diagram showing how a message is encrypted and signed according to the present invention and as shown in greater detail in for example figures 8 and 16.

[0054] Figure 4 is a simplified diagram of a process for decrypting and verifying the integrity of an encrypted message produced according to figure 3 as shown in further detail in for example figure 18.

[0055] Figure 5 is a flowchart of a mask generation process as used in example figure 3. Figure 6 is a flowchart of a process for calculating the signature of a part or package using a multiplicative method.

[0056] Figure 7 is a flowchart of a process for calculating the signature of a group of parts or packages as used in for example figure 3.

[0057] Figure 8 shows a flowchart of a process for encrypting and signing a group of parts or packets.

[0058] Figure 9 shows a flowchart of an AEAD message encryption process.

[0059] Figure 10 shows the flowchart of a process for decrypting a group of parts or packets and calculating the signature to be verified.

[0060] Figure 11 is the flowchart of a process for decrypting and verifying the integrity of an encrypted message.

[0061] Figure 12 is the flowchart of an AEAD encryption process for a stream F of groups of packets.

[0062] Figure 13 is the flowchart of a process for decrypting and verifying the integrity of an encrypted CF stream.

[0063] Figure 14 is the flowchart of a process for calculating the signature of a part or package using a random rotation method.

[0064] Figure 15 is the flowchart of a process for calculating the signature of a group of parts or packages as used in for example figure 3.

[0065] Figure 16 is the flowchart of a process for encrypting and signing a group of parts or packets.

[0066] Figure 17 shows the flowchart of an AEAD message encryption process.

[0067] Figure 18 shows the flowchart of a process for decrypting a group of parts or packets and calculating the signature to be verified as shown in general in figure 4.

[0068] Figure 19 is the flowchart of a process for decrypting and verifying the integrity of an encrypted message.

[0069] Figure 20 is the flowchart of an AEAD encryption process for a stream F of groups of packets.

[0070] Figure 21 is the flowchart of a process for decrypting and verifying the integrity of an encrypted CF stream. Figure 22(a) is the flowchart of a data preparation process.

[0071] Figure 22(b) is the flowchart of a process for extracting data relevant to decryption.

[0072] Figure 23 shows the flowchart of a nonce calculation process.

[0073] DETAILED DESCRIPTION

[0074] The present invention is seeking to address a number of known issues with encryption techniques relating to messages going between a sender and a receiver. Figure 1 to 4 are simplified drawings showing at least some of the broad concepts of the invention. These figures include reference numbers later used in subsequent figure which describe in more detail and include any relevant equations related to the simplified process in figure 1 to 4.

[0075] A simple system and scenario are shown in figure 1. A messaging system 10 receives a message 12 having content 14 from a first user (sender) 16. For the purposes of this description the content of the message is plaintext which means it is viewable by the sender and receiver. It is noted that plaintext is used interchangeably with an unencoded or unencrypted packet stream in some parts of the description. The message is intended to be sent to a second user (receiver) 18 where it is received as a message 20 and contains the same content 14. The system 10 encrypts message 12 using an encryption technique 22 to generate an encrypted or coded message 24, as will be described in greater detail below. At the receiver 18, the encrypted message undergoes a decryption technique 26 and is presented to the second user as message 20 with the content 14 visible. The encryption technique means that the content of message 12 should not be derivable by a third party that is not the receiver during the transmission of the message between the sender and the receiver. The decryption technique is related to the encryption technique so that the message can be correctly decoded prior to delivery to the receiver. The coding and decoding are based on keys, signatures and the like.

[0076] In theory the idea of encryption and decryption should mean the content of the message will not be intercepted by third parties. However, there are many parties intent on hacking coded messages and determining the content thereof for a variety of malicious reasons. Hacking is a technique of intercepting encrypted content, determining the possible technique of encryption and using this to decode the message and thereby gain access to the message content. As the hackers become more sophisticated so too do the owners of data in terms of the levels and types of security used for protection.

[0077] As described above there are many different types of encryption and decryption processes. Each has advantages and disadvantages. One common type of encryption and decryption revolves around the use of data masking. Data masking generally refers to a technique that is used to create a version of data that looks structurally similar to the original but hides (masks) sensitive information. The main objective of masking data is to create a functional substitute that does not reveal the real data so that it can be transmitted to a receiver without being revealed to any third party. On receipt, the mask is removed (decryption occurs) with the appropriate technique and the receiver can see the intended content.

[0078] In known techniques masks are generated based on a variety of different methods these include but are not limited to the following.

[0079] • Replacing personal data with other symbols and characters;

[0080] • Moving data around or randomizing sensitive data like names or account numbers;

[0081] • Scrambling the data, which entails substituting parts of it for other parts from the same dataset;

[0082] • Deleting or "nulling out" sensitive values within the data; and

[0083] • Encrypting the data to make it infeasible for unauthorized parties to access it without a decryption key.

[0084] The present invention relates primarily to encryption but may be applied to other masking techniques as will be clear to the skilled person.

[0085] Figure 2 shows a simplified encryption technique in accordance with the present invention. In general terms the invention relates to an improved AEAD scheme addressing at least some of the disadvantages of known techniques. Figure 2 shows an AEAD process 30 in which a message 32 is to be sent, encrypted and authenticated 34 before sending. The message 32 comprises a packet stream and associated data which is sometimes referred to as a header. According to the present invention, AEAD is in essence a function that takes four arguments: a secret key "K" 36, a nonce "N" 38 along with the associated data and packet stream as inputs and produces information to send 40 which comprises a ciphertext or encrypted text and an authentication tag as an output. After transmission 42 a decryption and authentication or verification process 44 takes part at the receiver end. This uses the key 36 and nonce 38 to decrypt and authenticate the incoming encoded message. If the decryption is authentic "yes" 46 the packet stream 48 is delivered to the receiver. If not "No" 50, there is a failure 52 and no message is delivered.

[0086] The present invention relates to a process of creating and grouping multiple masks from the original data and then due to the nature of the process it is enabled to process the masks in parallel thereby overcoming many of the problem of the art. This will now be described in greater detail. Figure 3 shows a high-level schematic of the process according to the present invention. This is a simplification of figures 8 and 16 which serve as more detailed explanation of the process.

[0087] The process 60 in figure 3 is a process for encrypting and signing a group of parts or packets. Prior to the process two sets of masks (M' and M) are generated from a mask generation operation 62. Each mask is of a predetermined nature defined by the calculation to generate each mask. The predetermined sets of masks that result is calculated in accordance with the following in broad terms and based on the details shown in figure 5. In the examples shown there are two sets of masks, but other numbers of sets could be envisaged by additional and / or alternative specific calculations.

[0088] In a general manner two sets of masks M' and M are generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function (in this example an XOR function) and a function (<T>S) of the set of natural integers based on 2 to the power of the bit length (s). The exact combination of these features is described in respect of figure 5 which provides additional details. An input 64 is initialized 66 such that GC is empty. GC is the string that will be encoded. And is initially set to empty prior to population after encryption or encoding occurs. The input 64 including the masks M' and M and further data ((G and m) in example 1 and (G, b, m, n) in example 2) is initialized such that GC is empty. Example 1 relates to the process shown in greater detail in figure 8 in which the stream of data includes a packet stream that is made up of groups G of packets in the stream and in which a signature S is applied to each group of packets. By contrast example 2 relates to the process shown in greater detail in figure 16 in which a signature S is applied and updated sequentially to all messages in a group G.

[0089] After initialization of the packet stream a first iterative encoding process 68 takes place for all masks in the set M and a second iterative encoding process 70 takes place for all masks in the set M' until all packets have been masked according to the mask. As noted elsewhere there are times when the mask is applied to some but not all the data in a group and the data not masked is left in the clear.

[0090] In a predetermined process for each example (1 and 2) a signature is generated 72.

[0091] The signature generation is respectively for each group in example 1 and sequentially and updated for a message comprising multiple groups. The respective methods are described in greater detail in figures 7 and 15. The generated signatures is then applied 74 and an output encrypted and signed stream 76 is generated to be sent from the sender to the receiver. The generated output comprises at least the encoded string GC and the signature S.

[0092] In general terms the generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result or comprises a random rotation process based on a hash logic function, for example an exclusive OR function. As previously noted, the signature however generated is applied in a different manner for the different examples 1 and 2.

[0093] It is noted that signing a message is always optional and generally depends on the use case: if integrity verification is necessary signing is required and if not, signing can be switched off.

[0094] Figure 4 shows a simplified version of figure 18 and is used to give a general explanation of the decryption or decoding process 80 for a message received by the receiver from the sender in accordance with the various encoding or encryption methods described above and below. The message comprises the input 82 which includes the encoded message GC and other data required to decode or decrypt the message. For example, two sets of pseudo-random masks M' and M along with integers as discussed in greater detail below.

[0095] A decoded string GD is initialized as being empty at initialization process 84 and thereafter undergo iterative calculation of GD 86 and 88 for respective pseudorandom masks M' and M. The bit string is rewritten 90 to generate the original order of the pre-encoded data. The signature S is calculated 92, according to the method of figure 15 and used to verify the signed message 94. The original message is output 96 to the receiver.

[0096] The decoding process can be reciprocal to whatever happened in the encoding process and so the variations and alternatives described with respect to figure 3 also apply to figure 4.

[0097] The specific combination of mask and signature for encoding and decoding as described above and greater detail below has a number of advantages. In particular there are some major improvements in the security margin provided by at least the integrity verification. In addition, processing is reduced by a number of different features of the invention including the manner in which groups of data are processed and the fact that within a group not all data needs to be encoded and / or signed which frees up processing power for different functionalities. In addition, as based on some of the addition features shown with respect to figure 9 parallel processing of multiple (j) groups of packets can improve the speed of encoding and decoding a complete message as many of the time-consuming task occur in parallel.

[0098] The steps of the above overall methodology and system will now be described in greater details with the simplified processes expanded to include further features of the processes described above and additional features of further advantages provided by the invention.

[0099] Figure 5 describes a mask generation process to enable encryption calculations relating to different groups of data to be encrypted to be parallelized.sis any bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits, such as for instance the function wheres(i) is the binary representation of integer i, completed on the left by as many bits as necessary for the length ofs(i) to be equal to s. [No , n', n, j] are the input data of such a modified process, No being a string of s bits, n' and n being the number of masks to be produced for the group in question, respectively for the sequences M' and M, and j an identification number for this group. The output data of the process are two sets of masks M'i, for any 0 < i < n' and Mi , for any 0 < i < n. The process shown in Figure 5 comprises in succession:

[0100] • the calculation, 103, of M'o according to M'o = HXOR (No,s(j)), where HXOR, 101, is calculated from H, 100, according to HXOR (M, N) = H(MAN), whereAis the exclusive OR operator (XOR) andsis 102;

[0101] • iteratively calculating, 104, M'i according to M'i = H (M'j-i), for all 0 < i < n'; and

[0102] • the calculation, 105, of Mi according to Mi = HXOR (M'i, No ), for all 0 < i < n from HXOR, 101.

[0103] The calculation of mask sets M' and M according to the process shown in Figure 5 has a number of properties. The fact that one or more elements of the set M are known compared with a purely random oracle, gives no advantage in determining the values of any other element of the set M, or of No, or of any element of the set M'. The fact that one or more elements of the sets M' and M, relating to an identifier j, are known compared with a purely random oracle, gives no advantage in determining the values of any other element of the sets M' and M relating to another identifier k^j, or of No. The calculation of sets M' and M, relative to an identifier j, has no dependency on that relative to another identifier k j, and these calculations can be carried out in parallel.

[0104] The Hash function can be any type and any version including checksums; universal hash function families, non-cryptographic hash functions and keyed or un-keyed cryptographic hash functions. On example used in the invention is the Keccak hash function. The nonce is an arbitrary number intended to be used only one time in a cryptographic communication. A nonce is often a random or pseudo random generated number.

[0105] Figure 6 describes a method for calculating the signature of a part or packet P using a multiplicative method based on an operator denoted ®m. P is a string of s bits with s = 2s'. m where s' and m are two integers. In practice, as s is a power of 2, this condition is always met. [P, M'] are the input data for this process, M' being a pseudo-random string of s bits. The process shown in Figure 6 comprises the following steps, in which | is the concatenation operator:

[0106] • the initialization, 110, of S as an empty string;

[0107] • the randomization, 111, of the chain P according to R = PAM';

[0108] • the rewriting, 112, of R according to R = po | pi | pz | P3 | ... | pzs'-2 I Pzs'-i where each pi is a string of m bits;

[0109] • iteratively calculates, 113, S according to S = S | ( p2i * Pzi+i) for all 0 < i < s', where * is the m-bit integer multiplication giving a 2m-bit result; and

[0110] • at the end of the iterations, the P®mM' signature of P after randomization is S.

[0111] In the signature calculation, each multiplication of m-bit integers produces a result that potentially has 22mpossible values. There should therefore only be a probability 2-2mthat for a sub-part (pzi | Pzi+i) of R, ( pzi * Pzi+i) takes on a predefined value to compensate, in the calculation of S, for the modification of another sub-part (p2j | P2j+i), according to the known clear attack scheme. In fact, these 22mpossible values are not equiprobable, some are not attainable, others, such as powers of 2 occur more frequently than the average and, moreover, integer multiplication has regularities such as multiplication by 0 and commutativity which increase the probability of collision. It can be shown that, taking all these effects into account, the probability of collision is of the order of 2mand that the safety margin for integrity checking is therefore only m bits.

[0112] Figure 7 describes a process for calculating the signature of a group G = Po | Pi | ... | Pn-i of parts or packets Pi, each being a string of s bits, where n > 1 and with s = 2s'. m where s' and m are two integers. If [G, {M'i, 0 < i < n}, m] are the input data for such a signature calculation process, where {M'i, 0 < i < n} is a set of n pseudo-random strings of s bits. The process of figure 7 comprises successively:

[0113] • the initialization, 120, of S as S = <T>S(0),sbeing the function 102;

[0114] • iteratively calculating, 121, S according to S = SA(Pi 0mM'i), for all 0 < i < n, the operator 0mbeing calculated according to the procedure in Figure 6; and

[0115] • at the end of the iterations, the group signature is S.

[0116] Figure 8 describes a method for encrypting and signing a group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i , made up of n s-bit strings Pi to be encrypted and n' s-bit strings Ai , to remain unencrypted but to be subject to integrity checking on decryption, where n>0, n'>0, n+n'>l and s being such that s = 2s'. m where s' and m are two integers. The input data for the process are [G, M', M, m], where M' = {M'i, 0 < i < n+n'} and M = {Mi, 0 < i < n} are two sets of pseudorandom masks. The process shown in Figure 8 comprises in succession:

[0117] • initialization, 130, of GC as an empty string;

[0118] • iteratively, the calculation, 131, of GC according to GC = GC | (PiAMi), for all 0 < i < n ;

[0119] • iteratively, the calculation, 132, of GC according to GC = GC | Ai, for all 0 < i < n';

[0120] • the calculation, 133, of the signature S according to the process shown in figure 7 with input data [G, {M'i, 0 < i < n+n'}, m]; and

[0121] • process output data are [GC, S],

[0122] Three performance ratios may be defined for this process, and the lower these ratios, the higher the performance. The first ratio, T, is the compactness ratio, defined as the number of bits in the GC and S output data, divided by the number of bits in the G input group, i.e. T = (n+n'+l) / (n+n') = l+l / (n+n'). This ratio tends towards 1 as n and / or n' increase. The second, p, is the non-linearity ratio, defined as the number of pseudo-random masks, each mask requiring the calculation of a hash function H, divided by the number of parts in group G, i.e. p = (2n+n') / (n+n') = 2-n' / ( n+n'). This ratio is always less than or equal to 2 and greater than 1 but approaches the latter value as n' increases. The third ratio, 0, is the logical operation rate and is defined as the number of elementary logical operations required to calculate the signature, divided by the number of bits in the input group G. An m-bit integer multiplication requires on the order of m2logical operations. Considering the exclusive OR operations required for signature calculation, for which, if the processor is 64-bit, an exclusive OR between two strings of s bits requires s / 64 logical operations and noting G = m the safety margin of the integrity check, 0 = (2s / 64+s'.m2) / s = l / 32+s / 2. This ratio is always greater than 1 / 32 and increases linearly as a function of a, with the coefficient1 / 2, which can be penalizing in terms of the latency induced by integrity checking as the targeted safety margin increases.

[0123] Figure 9 describes a process for AEAD encryption of a message P = Go | Gi | ... | Gt-i, consisting of t groups of n+n' parts, each of the parts being a string of s bits and for each group only the first n parts are to be encrypted and where n>0, n'>0, n+n'>l. The input data for the process are [P, K, N, m] where key K and nonce N are strings of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The procedure shown in Figure 9 comprises the following steps:

[0124] • the calculation, 140, of No = HXOR (K, N), HXOR being the function 101;

[0125] • the initialization, 141, of C according to C = N;

[0126] • the initialization, 142, of S according to S =s(0),sbeing the function 102;

[0127] • in parallel, for all 0 < j < t: o calculation, 143, of mask sets M'j and Mj as the data produced by the process shown in figure 5, with input data [No , n+n', n, j]; o the calculation, 144, of [GCj , Sj ] as the data produced by the process of figure 8, with as input data [Gj , M'j , Mj , m]; and o the calculation, 145, of S according to S = SASj; iteratively, the calculation, 146, of C according to C = C | GCj ; and • at the end of the iterations, the calculation, 147, of C according to C = C | H(S), H being function 100.

[0128] Processing 143, 144 and 145 for each of the Gj groups can be carried out in parallel with processing for the other groups, since the mask sets for each group can be calculated independently of each other.

[0129] For improvement of understanding the following terms are defined. Files are divided in parts of s bits, streams are divided in packets of s bits. Then, in both cases, parts / packets are regrouped in "groups". Within a group, some parts / packets can remain in the clear and will only be subject to integrity verification. The length of groups (i.e. the number of parts / packets each group contains) is driven by the structure of data (ratio in the clear / encrypted) but also the bandwidth consumption: the longer the groups are, the less bandwidth will be necessary. On the other hand, for the online mode, the longer the groups are, the less frequently the integrity verification will be done. So, defining the groups' length is left to the user, as are other constraints for a particular use case.

[0130] It is noted that the groups j of data each include part of the packet stream and / or input data. The groups are formed by splitting the whole packet stream into portions or groups. The size or length of the groups can be the same or may be different in length, size or nature. In the earliest groups the stream may include headers and further information such as for example the nonce for later retrieval, the size of the groups, the key or other information that is included in the input to the process and may be useful in later decoding and reforming the groups after secure transmission of the coded message. It will further be appreciated that the additional information may be found in other groups of packets as the case may be. The length of each group is the same or varies according to content and or the nature of the data. For example, data that is not sensitive and is not to be encoded may require a longer or shorter packet than that which is.

[0131] The ability to process data in parallel as shown above and in greater detail below provides a significant advantage over the known systems as the overall time to encrypt or decrypt a packet stream is reduced. The packet stream may relate to any type of data, including but not limited to video, audio, text or the like.

[0132] As noted above different parts of the data are encrypted in different groups. As each group has a specific identifier j, it is possible to find specific parts of the encrypted data based on the identifier. The ability to navigate to a set of masks j allows for a user to focus a decryption activity on the specific part. In order to decrypt the encrypted data, it is possible to decrypt any group in the stream, without being obliged to decrypt preceding group or groups. This will be described in greater detail below.

[0133] In terms of encryption, the data is divided into groups, and it is possible to encrypt some of the content in a group and leave some content in the clear. This provides further reductions in processing but does not impact the overall security in any way. As the groups are recombined after encryption the stream may include encrypted and non-encrypted data. As both are together an attacker will only be able to determine non encrypted data which may not have a secure element. In addition, as each of the groups are processed independently of others there is no reliance on one group relative to another and so knowing the content of one group does not help in determining the content of another group. This is a still further advantage of the present invention in thwarting hacker attacks.

[0134] Figure 10 describes a process for decrypting and calculating the signature to be verified, of a group GC = Co | Ci | ... | Cn-i | Bo | Bi | ... | Bn'-i , encrypted according to the process of figure 8 and composed of n+n' strings of s bits, where n>0, n >0, n+n'>l and where s = 2s'. m with s' and m two integers. The process input data are [GC, M', M, m], where M' = {M'i, 0 < i < n+n'} and M = {Mi,0 < i < n} are two sets of pseudo-random masks. The process shown in Figure 10 comprises in succession:

[0135] • initialization, 150, of GD as an empty string;

[0136] • iteratively, the calculation, 151, of GD according to GD = GD | (CiAMi ), for all 0 < i < n ;

[0137] • iteratively, the calculation, 152, of GD according to GD = GD | Bi , for all 0 < i

[0138] < n' ; the calculation, 153, of the signature S according to the method of figure 7, with as input data [GD, {M'i , 0 < i < n+n'}, m]; and process output data are [GD, S],

[0139] Figure 11 describes a process for decrypting and verifying the integrity of an encrypted message according to the process of Figure 9, C = N | GCo | GCi | ... | GCt. i | S, consisting of the nonce N, t groups of n+n' parts, each of the parts being a string of s bits and a signature S and where n>0, n'>0, n+n'>l. The input data for the process are [C, K, m] where the key K is a string of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The procedure shown in Figure 11 comprises the following steps:

[0140] • the calculation, 160, of No = HXOR (K, N), HXOR being the function 101 ;

[0141] • the initialization, 161, of D as an empty string;

[0142] • the initialization, 162, of S' according to S' =s(0),sbeing the function 102;

[0143] • in parallel, for all 0 < j < t: o the calculation, 163, of mask sets M'j and Mj as the data produced by the process shown in figure 5, with input data [No , n+n', n, j]; o the calculation, 164, of [GDj , Sj ] as the data produced by the process of figure 10, with as input data [GCj , M'j , Mj , m]; and o the calculation, 165, of S' according to S' = S'ASj;

[0144] • iteratively, the calculation, 166, of D according to D = D | GDj;

[0145] • at the end of the iterations, the calculation, 167, of the Boolean v = (S == H(S')), where == is the test of equality of two strings of bits and H is the function 100. If v is true, then there is a probability of l-2mthat Di = Pi for all 0 < i < n and Bi = Ai for all 0 < i < n', Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i being the group of same order j before encryption;

[0146] • if v is true, the decrypted message is D; and

[0147] • otherwise, 168, the process generates an integrity check error code.

[0148] Processing 163, 164 and 165 for each of the GCj groups can be carried out in parallel with processing for the other groups, since the mask sets for each group can be calculated independently of each other.

[0149] Figure 12 describes a process for AEAD encryption of a stream F of packet groups Gj , j > 0, of n+n' packets, each of these packets being a string of s bits and for each group only the first n packets are to be encrypted and where n>0, n'>0, n+n'>l. The input data for the process are [F, K, N, m] where key K and nonce N are strings of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. To avoid hashing the signature of each group, which would penalize latency, it is assumed here that n+n'>l so that there is at least oneAoperation in the calculation of the signature of each group. The process shown in Figure 12 for producing a CF encrypted stream successively comprises:

[0150] • the transmission, 170, of the nonce N in the flow CF;

[0151] • the calculation, 171, of No = HXOR (K, N), HXOR being the function 101;

[0152] • for all j > 0: o calculation, 172, of mask sets M'j and Mj as the mask sets produced by the process shown in Figure 5, with input data [No , n+n', n, j]; o the calculation, 173, of [GCj , Sj ] as the data produced by the process of figure 8, with as input data [Gj , M'j , Mj , m]; o the calculation, 174, of the encrypted and signed group GCSj according to GCSj = j | GCj | Sj; and o transmission, 175, in the CF stream of the encrypted and signed GCSj group.

[0153] For this process, the bandwidth required for transmission is directly proportional to the compactness ratio defined above. For an associated data ratio, a, defined as a = n' / n and fixed, the compactness ratio is T = l+l / (n(l+a)) and can be decreased by increasing n.

[0154] Figure 13 describes a process for decrypting and verifying the integrity of a CF stream encrypted according to the process in Figure 12 and consisting of the nonce N followed by encrypted and signed groups j | GCj | Sj , j > 0. The input data is [CF, K, m], where n>0, n'>0, n+n'>l, where the key K is a string of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The process shown in Figure 13 for producing a decrypted DF stream successively comprises:

[0155] • recovery of nonce N as the first packet in the CF encrypted flow;

[0156] • the calculation, 180, of No = HXOR (K, N), HXOR being the function 101;

[0157] • for all j > 0: o the calculation, 181, of mask sets M'j and Mj as the mask sets produced by the process shown in Figure 5, with input data [No , n+n', n, j]; o the calculation, 182, of [GDj , S'j ] as the data produced by the process of figure 10, with as input data [GCj , M'j , Mj , m]; o the calculation, 183, of the Boolean v = (Sj == S'j), where == is the equality test of two strings of bits. If v is true, then there is a probability of l-2mthat Di = Pi for all 0 < i < n and Bi = Ai for all 0 < i < n', Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i being the group of same order j before encryption; o if v is true, the transmission, 184, in the decrypted stream DF of the decrypted group GDj; and o otherwise, 185, an integrity error code is generated.

[0158] With this method, once the nonce N has been recovered and given that the identifier j is part of the encrypted and signed groups j | GCj | Sj , decryption can take place directly at any order j in the flow, without having to calculate all the previous elements of the set M' as previously required. Having established a starting point for decryption this can occur in a predetermined sequence which may be the same or different from the numerical order of the groups based on their group identifier.

[0159] As already seen, signature calculation using the multiplicative method can induce significant latency, when the security margin targeted for integrity verification increases. For these applications, an alternative method is indicated. Figure 14 describes a method for calculating the signature of a part or packet P using a random rotation method based on a function denoted Am, P being a string of s bits with s = s'.m where s' is an integer and m is a power of 2. In practice, as s is itself a power of 2, this condition is always met. If [P, M', b, E] are the input data of this process, M' being a pseudo-random string of s bits, b being an integer and E = eo | ei | ... | eb.s’-i being a concatenation of b.s' pseudo-random strings ei , each of log? (m) bits, the process of figure 14 successively comprises:

[0160] • initialization, 190, of bit string Amwhere Am= b.m (0), b.m being function 102;

[0161] • the calculation, 191, of a randomized version R of P, according to R = PAM';

[0162] • the rewriting, 192, of R as R = po | pi | Ps'-i, where each pi is a string of m bits;

[0163] • iteratively, for all 0 < i < s': o initialization, 193, of Di as an empty string; o iteratively, for all 0 < k < b, the calculation, 194, of Aj = Aj | (pi»>eb.i+k) where p»>e is the m-bit string, resulting from a bit rotation of the string p with a shift of e bits to the right; and o at the end of the iterations, the calculation, 195, of Am= AmAAi;

[0164] • at the end of the iterations, the result of the function Am(P, M', b, E) is Am.

[0165] In the signature calculation, each subpart pi of R can have mbstrings of b.m bits Ai possible as an image in the S calculation, each equiprobable as long as the random shifts eb.i+k are themselves equiprobable. There is therefore only a probability 2’ wj|| take on a predefined value to compensate, in the calculation of S, for the modification of another Aj value, according to the pattern of the known- clear attack. As a result, the margin of safety of the integrity check is b.logz (m) bits. Unlike the multiplicative method, there are no regularities to reduce the expected margin of safety.

[0166] Figure 15 describes a method for calculating the signature of a group G = Po | Pi | ... | Pn-i of parts or packets Pi, each being a string of s bits, where n > 1 and with s = s'.m where s' is an integer and where m is a power of 2. If [G, {M'i , 0 < i < n}, b, m, Eo | Ei | ... | En-i ] are the input data of such a signature calculation process, where {M'i , 0 < i < n} is a set of n pseudo-random strings of s bits, where b is an integer and where Ei = eo | ei | ... | eb.s'-i , for all 0 < i < n, with each ei a pseudo-random string of log? (m) bits, the process of figure 15 successively comprises:

[0167] • initialization, 200, of S according to S = b.m(0), b.m being the function 102;

[0168] • iteratively, for all 0 < i < n, calculating, 201, S = SAAm(Pi, M’i, b, Ei), with the function Amcalculated according to the procedure in Figure 15; and

[0169] • at the end of the iterations, the signature of the G group is S.

[0170] Figure 16 describes a process for encrypting and signing a group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i , consisting of n strings of s bits Pi to be encrypted and n' strings of s bits Ai , to remain unencrypted but to be subject to integrity verification on decryption, where n>0, n'>0, n+n'>l and s being such that s = s'.m where s' is an integer and m is a power of 2. The input data for the process is [G, b, m, w, M', M], where b and w are two integers such that w.m > (n+n')b.log2 (m), where n>0, n'>0, n+n'>l and where M' = {M'i , 0 < i < n+n'+w} and M = {Mi , 0 < i < n} are two sets of pseudorandom masks. The process shown in Figure 16 comprises in succession:

[0171] • initialization, 210, of GC as an empty string;

[0172] • iteratively, the calculation, 211, of GC according to GC = GC | (PiAMi ), for all 0 < i < n ;

[0173] • iteratively, the calculation, 212, of GC according to GC = GC | Ai , for all 0 < i < n' ;

[0174] • the rewriting, 213, of M'n+n' | M'n+n'+i | ... | M' n+n'+w-l as E | r, where E is a string of (n+n')b.s'.log2 (m) bits and r is a string of unused, possibly empty, bits; the calculation, 214, of the signature S according to the method of figure 15, with as input data [G, {M'i , 0 < i < n+n'}, b, m, E]; and process output data are [GC, S], Since w.m > (n+n')b.log2(m), the bit string M'n+n' | M'n+n'+i | ■■■ I M'n+n'+w-i is of length greater than or equal to (n+n')b.s'.log2 (m) and there is sufficient entropy for all rotational shifts in the E string. As with the multiplicative method, three performance ratios are defined for this process, and the lower the ratios, the higher the performance. The compactness ratio is such that T = (n+n'+b.m / s) / (n+n') = l+b / (s'(n+n')) 1+ <j.m / (s.log2 (m)(n+n')). This ratio is less favorable than in the case of the multiplicative method, since in practice b / s'>l. The non-linearity ratio is such that p = (2n+n'+w) / (n+n') 2+c / m-n7(n+n'). This ratio is less favorable than for the multiplicative method with the addition of the o / m term. As with exclusive OR, with a 64-bit processor, the operation p»>e on a bit string p of length s requires on the order of s / 64 logical operations. The logical operation ratio is therefore such that 0 = (s / 64+2b.s / 64) / s = l / 64+(b / c)a / 32 a: l / 64+c / (32log2(m)). This ratio is significantly more favorable than for the multiplicative method, as it only increases linearly with s with a coefficient of l / (32log2 (m)) instead of1 / 2. Overall, for use cases where latency reduction takes precedence over other considerations, the random rotation method is preferable to the multiplicative method, albeit at the cost of higher T and p ratios.

[0175] Figure 17 describes a process for AEAD encryption of a message P = Go | Gi | ... | Gt-i , consisting of t groups of n+n' parts, each of the parts being a string of s bits and for each group only the first n parts are to be encrypted and where n>0, n'>0, n+n'>l. The input data for the process are [P, K, N, G, m] where key K and nonce N are strings of s bits, where a is the security margin to be ensured for integrity verification and where s' is an integer and m a power of 2 such that s = s'.m. The procedure shown in Figure 17 comprises the following steps:

[0176] • the calculation, 220, of No = HXOR (K, N), HXOR being the function 101;

[0177] • the calculation, 221, of b = F o / log2(m)l, with F xl the smallest integer greater than or equal to the rational number x;

[0178] • the calculation, 222, of w = F (n+n’)b.log2(m) / ml;

[0179] • the initialization, 223, of C according to C = N ; the initialization, 224, of S according to S =s(0),sbeing the function 102 in parallel, for all 0 < j < t : o the calculation, 225, of mask sets M'j and Mj as the data produced by the process shown in figure 5, with input data [No , n+n'+w, n, j]; o the calculation, 226, of [GCj , Sj ] as the data produced by the process of figure 16, with as input data [Gj , b, m, w, M'j , Mj ]; and o the calculation, 227, of S according to S = SASj ;

[0180] • iteratively, the calculation, 228, of C according to C = C | GCj ; and

[0181] • at the end of the iterations, the calculation, 229, of C according to C = C | H(S), H being function 100.

[0182] Processing 225, 226 and 227 for each of the Gj groups can be carried out in parallel with processing for the other groups, since the mask sets specific to each group can be calculated independently of each other.

[0183] Figure 18 describes a process for decrypting and calculating the signature to be verified, of a group GC = Co | Ci | ... | Cn-i | Bo | Bi | ... | Bn'-i , encrypted according to the process of figure 16 and composed of n+n' strings of s bits, where n>0, n >0, n+n'>l and where s = s'.m with s' an integer and m a power of 2. The process input data are [GC, b, m, w, M', M] where b and w are two integers such that w.m > (n+n')b.log2 (m), where M' = {M'i , 0 < i < n+n'+w} and M = {Mi , 0 < i < n} are two sets of pseudo-random masks. The process shown in Figure 18 comprises in succession:

[0184] • initialization, 230, of GD as an empty string;

[0185] • iteratively, the calculation, 231, of GD according to GD = GD | (CiAMi), for all 0 < i < n ;

[0186] • iteratively, the calculation, 232, of GD according to GD = GD | Bi , for all 0 < i < n';

[0187] • the rewriting, 233, of M'n+n' | M'n+n'+i | ... | M' n+n'+w-l as E | r, where E is a string of (n+n')b.s'.log2 (m) bits and r is a string of unused, possibly empty, bits ;

[0188] • the calculation, 234, of the signature S according to the method of figure 15, with as input data [GD, {M'i , 0 < i < n+n'}, b, m, E]; and

[0189] • process output data are [GD, S],

[0190] Figure 19 describes a process for decrypting and verifying the integrity of an encrypted message according to the process of Figure 17, C = N | GCo | GCi | ... | GCt-i | S, consisting of the nonce N, t groups of n+n' parts, each of the parts being a string of s bits and a signature S and where n>0, n'>0, n+n'>l. The input data of the process are [C, K, G m] where the key K is a string of s bits, where a is the security margin to be ensured for integrity verification and where s' is an integer and m a power of 2 such that s = s'.m. The procedure shown in Figure 19 comprises the following steps:

[0191] • the calculation, 240, of No = HXOR (K, N), HXOR being the function 101 ;

[0192] • the calculation, 241, of b = F o / log2(m)l, with F xl the smallest integer greater than or equal to the rational number x ;

[0193] • the calculation, 242, of w = = F (n+n’)b.log2(m) / ml;

[0194] • initialization, 243, of D as an empty string;

[0195] • the initialization, 244, of S' according to S' =s(0),sbeing the function 102

[0196] • in parallel, for all 0 < j < t : o the calculation, 245, of mask sets M'j and Mj as the data produced by the process shown in figure 5, with input data [No , n+n'+w, n, j]; o the calculation, 246, of [GDj , Sj ] as the data produced by the process of figure 10, with as input data [GCj , b, m, w, M'j , Mj ]; and o the calculation, 247, of S' according to S' = S'ASj ;

[0197] • iteratively, calculating 248 D according to D = D | GDj ;

[0198] • at the end of the iterations, the calculation, 249, of the Boolean v = (S == H(S')), where == is the test of equality of two strings of bits and H is the function 100. If v is true, then there is a probability of l-2mthat for all groups GDj , 0 < j < t, then Di = Pi for all 0 < i < n and Bi = Ai for all 0 < i < n', Po | Pi | ... I Pn-i | Ao | Ai | ... | An'-i being the group of the same order j before encryption ;

[0199] • if v is true, the decrypted message is D; and

[0200] • otherwise, the process generates an integrity check failure error code (250).

[0201] Processing 245, 246 and 247 for each of the GCj groups can be carried out in parallel with processing for the other groups, since the mask sets for each group can be calculated independently of each other.

[0202] Figure 20 describes a process for AEAD encryption of a stream F of packet groups Gj , j > 0, of n+n' packets, each of the packets being a string of s bits and for each group only the first n packets are to be encrypted and where n>0, n'>0, n+n'>l. The input data for the process are [F, K, N, G, m] where key K and nonce N are strings of s bits, where a is the security margin to be ensured for integrity verification and where s' is an integer and m a power of 2 such that s = s'.m. As with the process shown in Figure 12, it is assumed that n+n'>l. The process shown in Figure 20 for producing a CF encrypted stream comprises the following steps:

[0203] • the transmission, 260, of the nonce N in the CF flow;

[0204] • the calculation, 261, of No = HXOR (K, N), HXOR being the function 101;

[0205] • the calculation, 262, of b = F o / log2(m)l, with F xl the smallest integer greater than or equal to the rational number x;

[0206] • the calculation, 263, of w = F (n+n')b.log2(m) / ml;

[0207] • for all j > 0: o calculating, 264, mask sets M'j and Mj as the mask sets produced by the process shown in Figure 5, with input data [No , n+n'+w, n, j]; o the calculation, 265, of [GCj , Sj ] as the data produced by the process of figure 16, with as input data [Gj , b, m, w, M'j , Mj ]; o the calculation, 266, of the encrypted and signed group GCSj according to GCSj = j | GCj | Sj; and o the transmission, 267, in the CF stream of the encrypted and signed GCSj group.

[0208] As with the multiplicative method, for a fixed value of the associated data ratio, the bandwidth required for transmission and the compactness ratio can be reduced by increasing n.

[0209] Figure 21 describes a process for decrypting and verifying the integrity of a CF stream encrypted according to the process in Figure 20 and consisting of the nonce N followed by encrypted and signed groups j | GCj | Sj , j > 0. The input data is [CF, K, <j, m], where n>0, n'>0, n+n'>l, where the key K is a string of s bits, where G is the security margin to be ensured for integrity verification and where s' is an integer and m a power of 2 such that s = s'.m. The process shown in Figure 21 for producing a decrypted DF stream successively comprises:

[0210] • recovery of nonce N as the first packet in the CF encrypted flow;

[0211] • the calculation, 270, of No = HXOR (K, N), HXOR being the function 101 ;

[0212] • the calculation, 271, of b = F o / log2(m)l, with F xl the smallest integer greater than or equal to the rational number x ;

[0213] • the calculation, 272, of w = F (n+n')b.log2(m) / ml where ;

[0214] • for all j > 0 : o calculating, 273, mask sets M'j and Mj as the mask sets produced by the process shown in Figure 5, with input data [No , n+n'+w, n, j]; o the calculation, 274, of [GDj , S'j ] as the data produced by the process of figure 18, with as input data [GCj , b, m, w, M'j , Mj ] ; o the calculation, 275, of the Boolean v = (Sj == S'j ), where == is the test of equality of two strings of bits. If v is true, then there is a probability of l-2mthat Di = Pi for all 0 < i < n and Bi = Ai for all 0 < i < n', Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i being the group of same order j before encryption ; o if v is true, the transmission, 276, in the decrypted stream DF of the decrypted group GDj ; and o otherwise, an integrity error code is generated, 277.

[0215] With this method, once the nonce N has been recovered and given that the identifier j is part of the encrypted and signed groups j | GCj | Sj , decryption can take place directly at any order j in the flow, without having to calculate all the previous elements of the set M' as in the basic methods.

[0216] As seen above, the main advantage of the random rotation method is a favorable value for the logic operation rate 0 = l / 64+c / (32log2(m)). For a fixed integrity check safety margin G, the value of this rate decreases if m increases. The non-linearity rate p — 2+c / m-n7(n+n’) also decreases if m increases. On the other hand, the compactness rate T — 1 +o.m / ((n+n')s.log2(m)) increases slightly with m. For many applications where the slight increase in compactness rate can be compensated for by an increase in n, to optimize performance in the processes shown in Figures 14 to 21, the parameter m can be taken equal to its maximum value, i.e. s, with s' = 1. In this case, performance is given by the following rate values, where b = F o / log2(s)l : T = l+b / (n+n') — 1 +G / ((n+n')log2(s)), p = (2n+n'+ F(n+n')b.log2(s) / sl) / (n+n') — 2+G / S- n' / (n+n') and 0 = l / 64+c / (32log2(s)). In the case where s = 512 and a = 256, this gives b = 29, T = l+29 / (n+n'), p — 2.5- n' / (n+n') and 0 = 0.90451. If s = 512 and a = 64, this gives b = 8, T = l+8 / (n+n'), p — 2.125- n' / (n+n') and 0 = 0.23785.

[0217] Figure 22 describes a process for preparing each group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i of a message before encryption, according to one of the processes of Figures 9 or 17, in order to conceal from an attacker the actual length £ of the significant bits of Po | Pi | ... | Pn-i which are the plaintext data to be encrypted. Each group G is transformed into a group G' according to the procedure in figure 22(a), having as input data [G, £, n"] and comprising successively:

[0218] • the initialization, 280, of G' ass(£),sbeing the function 102;

[0219] • iteratively, for all 0 < i < n, the calculation, 281, of G' = G' | Pi;

[0220] • iteratively, for all 0 < i < n", the calculation, 282, of G' = G' |s(0);

[0221] • iteratively, for all 0 < i < n', the calculation, 283, of G' = G' | Ai; and

[0222] • at the end of the iterations, the transformed group is G'. If GD' = D'o | D'i | ... | D'n+n" | Bo | Bi | ... | Bn'-i represents each group deciphered according to one of the processes of figures 11 or 19, in order to extract the significant deciphered data, the group GD' is transformed into a group GD calculated according to the process of figure 22(b) and comprising successively:

[0223] • the rewriting, 284, of GD' as D'o | D' | B where D'o , D' and B are bit strings of length s, (n+n")s and n'.s respectively;

[0224] • the calculation, 285, of £ as the integer value of the bit string D'o;

[0225] • the calculation, 286, of D as the first bits of the string D'; and

[0226] • the calculation, 287, of GD according to GD = D | B;

[0227] According to this preparation method, an attacker only has access to the value s(n+n"), which represents the maximum value of £, but does not have access to the actual value of the significant bit length in the plaintext data. The value of n" can be random and change for each group, and need not be known when the group is decrypted.

[0228] In cases where the assumption of seeding the random number generator with an entropy source of at least s bits cannot be retained, and where resilience to accidental reuse of a nonce value with the same key alone is not sufficient, another source of information is required to restore a safety margin of s / 2 bits with regard to such accidental reuse. This source of information can be a trusted clock accessible to encryption processes. These clocks, accessible via the Internet, deliver real-time timestamps with millisecond precision. This makes it highly unlikely that two encryptions with the same key could be performed at the same time with the same value of a pseudo-random draw Rnd from the generator, even in the case of insufficient entropy. Robustness with regard to the consequences of accidental reuse of the same nonce value N in encryption operations performed with the same key K, can therefore be improved by the process shown in figure 23 for calculating the nonce N, prior to any encryption and successively comprising:

[0229] • obtaining, 290, the TS timestamp as a known 64-bit integer; and the calculation, 291, of the nonce N according to N = HXOR(Rnd,s(TS)), with HXOR the function 101 andsthe function 102.

[0230] As described above in figure 1 the present invention can be used in a computer implemented method and system. The computer system may include known computing equipment connected together to form the overall system capable of implementing the computer implemented executable steps.

[0231] The computing system may include a logic unit; a memory device; a display device, input device or devices, a communication unit and other components as will be understood by the person in the art.

[0232] The logic unit may include one or more physical devices configured to execute instructions. For example, may be configured to execute instructions that are part of one or more applications, services, programs, routines, libraries, objects, components, data structures, or other logical concepts. The logic unit may include one or more processors configured to execute software instructions or one or more hardware or firmware logic machines configured to execute hardware or firmware instructions.

[0233] Processors may be single-core or multi-core, and the instructions executed thereon may be configured for sequential, parallel, and / or distributed processing. Individual components of the logic unit may be distributed among two or more separate devices, which may be remotely located or configured for coordinated processing and may also be virtualized and executed by remotely accessible, networked computing devices configured in a cloudcomputing configuration.

[0234] The memory device may include one or more physical devices configured to hold instructions executable by the logic unit to implement the methods and processes described herein. Memory devices may include removable or built-in devices; optical memory (e.g., CD, DVD, HD-DVD, Blu-Ray Disc, and the like); semiconductor memory (e.g., RAM, EPROM, EEPROM, and the like); and magnetic memory (e.g., hard-disk drive, floppy-disk drive, tape drive, MRAM, and the like). The memory may include volatile, nonvolatile, dynamic, static, read / write, read-only, random-access, sequential-access, location-addressable, file- addressable, and / or content-addressable devices.

[0235] The system may be integrated into one or more hardware-logic components and may include field-programmable gate arrays (FPGAs), program-specific and application-specific integrated circuits (PASIC / ASICs), program-specific and application-specific standard products (PSSP / ASSPs), system-on-a-chip (SOC), or complex programmable logic devices (CPLDs).

[0236] The display unit may be used to present a visual representation of data via a graphical user interface (GUI) using any appropriate display device.

[0237] The input unit may comprise or interface with user-input devices such as a keyboard, mouse, touch screen, or game controller via selected natural user input (NUI) components. Such components may include at least one of a microphone for speech or voice recognition; an infrared, color, stereoscopic, or depth camera for machine vision or gesture recognition; a head tracker, eye tracker, accelerometer, or gyroscope for motion detection or intent recognition; and electric-field sensing components for assessing brain activity.

[0238] The communication unit may be configured to communicatively couple computing system with one or more other computing devices and may include at least one of wired or wireless communication devices compatible with one or more different communication protocols or may allow the computing system to send or receive messages to and from other devices via a network such as the Internet.

[0239] Throughout the description and claims of this specification, the words "comprise" and "contain", and variations thereof mean "including but not limited to" and are not intended to (and do not exclude) other parts, additives, component, integers or steps. Throughout the description and claims of this specification, the singular includes the plural, unless the context otherwise requires. In particular, when the indefinite article is used, the specification is to be understood as envisaging plurality as well as singularity, unless the context requires otherwise.

[0240] Features, integers, characteristics, compounds, or groups described in connection with a particular aspect, embodiment or example of the invention are to be understood as applicable to any other aspect, embodiment or example described herein, unless inconsistent therewith. All features disclosed in this specification (including the claims, abstract and accompanying drawings), and / or all steps of a method or process so disclosed, may be combined in any combination, with the exception of combinations in which at least some of such features and / or steps are mutually exclusive. The invention is not limited to the details of any of the foregoing embodiments. The invention extends to any new feature, or any new combination, of the features disclosed in the present specification (including the accompanying claims, abstract and drawings), or to any new feature, or any new combination, of the steps of any process or procedure so disclosed.

[0241] It is noted that the invention includes many variations and different use cases. These are intended to be encompassed within the scope of the accompanying claims.

[0242] For assistance and in case not defined elsewhere the following is a list of definitions of terms used in the equations:

[0243] K Key

[0244] N Nonce

[0245] H Hash function

[0246] XOR Exclusive OR s Length in bits of the digest of hash function H

[0247] S Signature of P after randomization

[0248] S' Signature computed on decrypted text for verification.

[0249] P Packet

[0250] Pi String of m bits

[0251] M Mask set

[0252] M' Mask set n' Number of masks M' n Number of masks M m Bit integer

[0253] No String of s bits i Integer j ID number for group k Integer

[0254] 0mOperator fig 6

[0255] R Randomised version p Non-linearity ratio

[0256] G Group

[0257] GC A string for groups of encrypted data

[0258] GD A string for groups of decrypted data

[0259] 0 Logical operation rate fig 8 C Encrypted message

[0260] B Associated data after decryption

[0261] T Compactness ratio v A Boolean

[0262] A Associated data

[0263] D Decrypted message

[0264] F Stream of packets

[0265] CF Stream of encrypted and signed group GCS encrypted flow.

[0266] DF Decrypted flow

[0267] Rnd Random draw of s bits a Associated data ratio ei Pseudo-random strings

[0268] E eo | ei | ... | eb.s'-i , for all 0 < i < n, with each ei a pseudo-random string of log? (m) bits

[0269] AExclusive OR operator x Rational number

[0270] F x "I Smallest integer superior or equal to a rational number x w Integer

[0271] £ length of the significant bits of a plaintext P

[0272] TS Timestamp s A bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits such as for instance the function wheres(i) is the binary representation of the integer i, completed on the left by as many bits as necessary for the length ofs(i) to be equal to s.

[0273] According to an aspect of the present invention there is provided a method for generating masks, resulting from an adaptation of the basic method, to enable encryption calculations to be parallelized. Ifsis any bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits such as for instance the function wheres(i) is the binary representation of the integer i, completed on the left by as many bits as necessary for the length ofs(i) to be equal to s and if [No , n', n, j] are the input data of such a modified process, No being a string of s bits, n' and n being the numbers of masks to be produced for the group considered, respectively for the sequences M' and M, and j an identification number of this group, the process produces sets of masks M'i , for any 0 < i < n' and Mi , for all 0 < i < n according to :

[0274] M'o = HXOR(N0, s (j)) ;

[0275] M'i = H(M'i-i ), for all 0 < i < n' ; and Mi = HXOR(M'i , No ), for all 0 < i < n.

[0276] According to an aspect of the present invention there is provided a method for calculating the signature of a part or packet P, according to a multiplicative method based on an operator noted 0m, P being a string of s bits with s = 2s'. m where s' and m are two integers. If [P, M'] are the input data of this method, M' being a pseudo-random string of s bits, this method comprises : calculation of the randomized chain R according to R = PAM' ; rewriting R according to R = po | pi | pz | P3 | ... | P2s'-2 I Pzs'-i , where each pi is an m- bit string; and calculating the signature P®mM' of P after randomization according to P®mM' = (po * Pi ) I (pz * P3 ) | ... (p2s'-2 * P2s'-i ), where * is the m-bit integer multiplication giving a 2m-bit result.

[0277] According to an aspect of the present invention there is provided a method for calculating the signature of a group G = Po | Pi | ... | Pn-i of parts or packets Pi , each being a string of s bits, where n > 1 and with s = 2s'. m, where s' and m are two integers. If [G, {M'i , 0 < i < n}, m] are the input data of such a signature calculation process, where {M'i , 0 < i < n} is a set of n pseudorandom strings of s bits, the group signature S is according to S = SoASiA....ASn-i , where Si = Pi 0mM'i , for all 0 < i < n, with the operator ®maccording to another aspect.

[0278] According to an aspect of the present invention there is provided an encryption method and signature of a group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i , consisting of n strings of s bits Pi to be encrypted and n' strings of s bits Ai , to be left unencrypted but to be subject to integrity checking on decryption, where n>0, n'>0, n+n'>l and s being such that s = 2s'. m where s' and m are two integers. The input data of the method is [G, M', M, m], where M' = {M'i , 0 < i < n+n'} and M = {Mi , 0 < i < n} are two sets of pseudorandom masks and the output data of this method is [GC, S] where GC is the ciphered group and

[0279] S a signature. The method comprises: calculating the numerical group GC according to GC = Co | Ci | ... | Cn-i | Ao| Ai | ... | An’-i , with Ci = PiAMi , for all 0 < i < n ; calculating the S signature of this group according to the method a previous aspect, with input data [G, {M’i , 0 < i < n+n'}, mJ; and the output data of this process are [GC, S].

[0280] According to an aspect of the present invention there is provided a method for AEAD encryption of a message P = Go | Gi | ... | Gt-i , consisting of t groups of n+n' parts, each of the parts being a string of s bits and for each group only the first n parts are to be encrypted and where n>0, n >0, n+n'>l. The input data of the method are [P, K, N, m] where the key K and the nonce N are strings of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The method comprises : the calculation of No = HXOR(K, N) ; calculating for any 0 < j < t [GCj , Sj ] as the data produced by the method of a previous aspect, with as input data [Gj , M’j , Mj , m], where M’j and Mj are the mask sets produced by the method of a previous aspect, with as input data [No, n+n', n, j] ; calculating the signature S according to S = SoASiA...ASn ; and calculation of the encrypted message C according to C = N | GCo | GCi | ... | GCM I H(S).

[0281] According to an aspect of the present invention there is provided a method for decrypting and calculating the signature to be verified, of a group GC = Co | Ci | ... | Cn-i | Bo | Bi | ... | Bn'-i , encrypted according a previous aspect and composed of n+n' strings of s bits, where n>0, n >0, n+n'>l and where s = 2s'. m with s' and m two integers. The input data for the process are [GC, M', M, m], where M' = {M'i , 0 < i < n+n'} and M = {Mi , 0 < i < n} are two sets of pseudo-random masks. The method comprises: calculating the deciphered group GD according to GD = Do| Di | ... | Dn-i | Bo| Bi | ... | Bn’-i , with Di = CiAMi , for all 0 < i < n ; calculating the signature S according to the method of a previous aspect, with input data [GD, {M , 0 < i < n+n'}, m]; and the output data of this process are [GD, S]. According to an aspect of the present invention there is provided a method for decrypting and verifying the integrity of an encrypted message according a previous aspect, C = N | GCo | GCi | ... | GCt-i | S, consisting of the nonce N, t groups of n+n' parts, each of the parts being a string of s bits and a signature S and where n>0, n'>0, n+n'>l. The input data of the method are [C, K, m] where the key K is a string of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The method comprises : the calculation of No = HXOR(K, N) ; the decrypted message D is such that D = GD01 GDi | ... | GDt-i , where [GDj , Sj ] are the data produced by the method of a previous aspect, with as input data [GQ , M'j , Mj , m] and where M’j and Mj are the mask sets produced by the method of a previous aspect, with as input data [No, n+n', n, j]; and integrity checking consists of establishing that S = H(SoASiA...ASt-i ).

[0282] According to an aspect of the present invention there is provided a method for AEAD encryption of a stream F of packet groups Gj , j > 0, of n+n' packets, each of the packets being a string of s bits and for each group only the first n packets are to be encrypted and where n>0, n'>0, n+n'>l. The input data for the process are [F, K, N, m] where key K and nonce N are strings of s bits and where m is the security margin to be ensured for integrity verification and such that s = 2s'. m with s' an integer. The method for producing the CF encrypted stream comprises : transmission in the CF flow of the N ; the calculation of No = HXOR(K, N) ; calculating, for any group Gj , j > 0, the flow F, the encrypted and signed group GCSj = GCj | Sj , where [GCj , Sj ] are the data produced by the method of a previous aspect, with input data [Gj , M'j , Mj , m] and where M'j and Mj are the mask sets produced by the process of a previous aspect with input data [No , n+n', n, j] ; and transmission in the CF stream of each encrypted and signed GCS group j .

[0283] According to an aspect of the present invention there is provided a method for decrypting and verifying the integrity of a CF stream encrypted according to a previous aspect and consisting of the nonce N followed by encrypted and signed groups GCj | Sj , j > 0. The input data is [CF, K, m], where n>0, n'>0, n+n'>l, where the key K is a string of s bits and where m is the security margin to be ensured for the integrity check and such that s = 2s'. m with s' an integer. The process for producing the decrypted and verified DF stream comprises : recovery of the nonce N in the CF encrypted flow; the calculation of No = HXOR(K, N) ; calculating, for any group G , j > 0, the flow CF, of the decrypted group GDj , where [GDj , S’j ] are the data produced by the method of a previous aspect, with as input data [GQ , M’j , Mj , m] and where M'j and Mj are the mask sets produced by the process of a previous aspect, with as input data [No, n+n', n, j] ; the GDj group integrity check, establishing that Sj = S’j ; and if the integrity check is positive, transmission in the DF decrypted stream of each GD decrypted group j .

[0284] According to an aspect of the present invention there is provided a method for calculating the signature of a part or packet P using a random rotation method based on a function denoted Am, P being a string of s bits with s = s'.m where s' is an integer and m is a power of 2. If [P, M', b, m, E] are the input data of this method, M' being a pseudorandom string of s bits, b being an integer and E = eo | ei | ... | eb.s'-i being a concatenation of b.s' pseudo-random strings ei , each of log? (m) bits, the method comprises : randomization of the chain P according to R = PAM' ; rewriting R according to R = po | pi | ps-i , where each pi is an m-bit string; and calculating the function Am, as a string of b.m bits, according to Am(P, M', b, E) = AoAAiA...AAs’-i , with = (pi >»eb.i ) | (Pi >»eb.i+i) | ... | (pi »>eb(i+i)-i ), for all 0 < i < s', where p»>e is the m-bit string, resulting from a bit rotation of the string p with an e-bit shift to the right.

[0285] According to an aspect of the present invention there is provided a method for calculating the signature of a group G = Po | Pi | ... | Pn-i of parts or packets Pi , each being a string of s bits, where n > 1 and with s = s'.m where s' is an integer and where m is a power of 2. If [G, {M'i , 0 < i < n}, b, m, Eo | Ei | ... | En-i ] are the input data of such a signature calculation process, where {M'i , 0 < i < n} is a set of n pseudorandom strings of s bits, where b is an integer and where Ei = eo | ei | ... | eb.s'-i, for all 0 < i < n, with each ei a pseudorandom string of log? (m) bits, the group signature S is a string of b.m bits according to S = SoASiA...ASn-i , where Si = Am(Pi , M'i , b, Ei ), for all 0 < i < n, with the function Amaccording to a previous aspect. According to an aspect of the present invention there is provided a method for encrypting and signing a group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i , consisting of n strings of s bits Pi to be encrypted and n' strings of s bits Ai , to remain in the clear but to be subject to integrity checking on decryption, where n>0, n'>0, n+n'>l and s being such that s = s'.m where s' is an integer and m is a power of 2. The input data of the process are [G, b, m, w, M', M], where b and w are two integers such that w.m > ( n+n')b. log? (m), where M' = {M'i , 0 < i < n+n'+w} and M = {Mi , 0 < i < n} are two sets of pseudorandom masks. The output of this method is [GC, S] where GC is the encrypted group and S is a signature. The method comprises: calculating the numerical group GC according to GC = Co | Ci | ... | Cn-i | Ao| Ai | ... | An’-i , with Ci = PiAMi , for all 0 < i < n ; rewriting M' n+n’ | M' n+n’+1 | ... | M' n+n’+w- 1 as E | r, where E is a string of (n+n')b.s'.log2 (m) bits and r is a string of unused, possibly empty, bits; and calculating the signature of this group S, according to the method a previous aspect, with as input data [G, {M'i , 0 < i < n+n'}, b, m, E],

[0286] According to an aspect of the present invention there is provided a method for AEAD encryption of a message P = Go | Gi | ... | Gt-i , consisting of t groups of n+n' parts, each of the parts being a string of s bits and for each group only the first n parts are to be encrypted and where n>0, n >0, n+n'>l. The input data of the method are [P, K, N, G, m] where the key K and the nonce N are strings of s bits, where a is the security margin to be ensured for the integrity check and where s' is an integer and m a power of 2 such that s = s'.m. The method comprises : the calculation of No = HXOR(K, N) ; calculation of b = FG / log2 (m)l where Fxl is the smallest integer greater than or equal to the rational number x ; calculation of w = F (n+n')b.log2 (m) / ml; calculating for any 0 < j < t [GCj , Sj ] as the data produced by the method of a previous aspect, with as input data [Gj , b, m, w, M'j , Mj ], where and where M’j and Mj are the mask sets produced by the method of a previous aspect, with as input data [No, n+n'+w, n, j] ; calculating the signature S according to S = H(SoASiA...ASn ); and calculation of the encrypted message C according to C = N | GCo | GCi | ... | GCM I S. According to an aspect of the present invention there is provided a method for decrypting and calculating the signature to be verified, of a group GC = Co | Ci | ... | Cn-i | Bo | Bi | ... | Bn'-i , encrypted according to a previous aspect and composed of n+n' strings of s bits, where n>0, n >0, n+n'>l and where s = s'.m with s' an integer and m a power of 2. The process input data are [GC, b, m, w, M', M] where b and w are two integers such that w.m > (n+n')b.log2 (m), where M' = {M'i , 0 < i < n+n'+w} and M = {Mi , 0 < i < n} are two sets of pseudo-random masks. The method comprises: calculating the deciphered group GD according to GD = Do| Di | ... | Dn-i | Bo| Bi | ... | Bn’-i , with Di = CiAMi , for all 0 < i < n ; rewriting M' n+n’ | M' n+n’+1 | ... | M' n+n’+w- 1 as E | r, where E is a string of (n+n')b.s'.log2 (m) bits and r is a string of unused, possibly empty, bits; calculating the signature S according to a previous aspect, with input data [GD, {M , 0 < i < n+n'}, b, m, E]; and the output data of this process are [GD, S].

[0287] According to an aspect of the present invention there is provided a method for decryption with integrity verification of an encrypted message according another aspect, C = N | GCo | GCi | ... | GCt-i | S, consisting of the nonce N, t groups of n+n' parts, each of the parts being a string of s bits and a signature S and where n>0, n'>0, n+n'>l. The input data of the method are [C, K, G, m] where the key K is a string of s bits, where a is the security margin to be ensured for integrity verification and where s' is an integer and m a power of 2 such that s = s'.m. The method comprises : the calculation of No = HXOR(K, N) ; calculation of b = FG / log2 (m)~| where M is the smallest integer greater than or equal to the rational number x ; calculation of w = F (n+n')b.log2 (m) / m 1 ; calculating the decrypted message D according to D = GD01 GDi | ... | GDt-i , where [GDj , Sj ] are the data produced by the method a previous aspect, with as input data [GQ , b, m, w, M’j , Mj ], where M’j and Mj are the mask sets produced by the a previous aspect, with as input data [No, n+n'+w, n, j]; and integrity checking consists of establishing that S = H(SoASiA...ASt-i).

[0288] According to an aspect of the present invention there is provided a method for AEAD encryption of a stream F of packet groups Gj , j > 0, of n+n' packets, each of the packets being a string of s bits and for each group only the first n packets are to be encrypted and where n>0, n'>0, n+n'>l. The input data of the process are [F, K, N, a, m] where the key K and the nonce N are strings of s bits, where G is the security margin to be ensured for the integrity check and where s' is an integer and m a power of 2 such that s = s'.m. The method for producing the CF encrypted stream comprises : transmission of the nonce N in the CF encrypted stream; the calculation of No = HXOR(K, N) ; calculation of b = FG / log2 (m)~| where M is the smallest integer greater than or equal to the rational number x ; calculation of w = F (n+n')b.log2 (m) / m~| ; calculating, for any group Gj , j > 0, the flow F, the encrypted and signed group GCSj = GQ | Sj , where [GQ , Sj ] are the data produced by the method of a previous aspect, with input data [Gj , b, m , w, M’j , Mj ], and where M’j and Mj are the mask sets produced by the process of a previous aspect, with input data [No, n+n'+w, n, j] ; and transmission in the CF stream of each encrypted and signed GCS group j .

[0289] According to an aspect of the present invention there is provided Method for decrypting and verifying the integrity of a stream CF, encrypted according to another aspect and consisting of the nonce N followed by encrypted and signed groups GQ | Sj , j > 0. The input data are [CF, K, a, m], where n>0, n’>0, n+n'>l, where the key K is a string of s bits, where a is the security margin to be ensured for integrity checking and where s' is an integer and m a power of 2 such that s = s'.m. The process for producing the decrypted and verified DF stream comprises : recovery of the nonce N in the CF encrypted flow; the calculation of No = HXOR(K, N) ; calculation of b = Fo / log2 (m)~| where M is the smallest integer greater than or equal to the rational number x ; calculation of w = F (n+n')b.log2 (m) / m~| ; calculating, for any group G , j > 0, the flow CF, of the decrypted group GDj , where [GDj , S’j ] are the data produced by the method of a previous aspect, with as input data [GQ , b, m, w, M’j , Mj ] and where M’j and Mj are the mask sets produced by the process of a previous aspect, with as input data [No, n+n'+w, n, j] ; the GQ group integrity check, establishing that Sj = S’j ; and if the integrity check is positive, transmission in the DF decrypted stream of each GD decrypted group j . According to an aspect of the present invention there is provided a process according to previous aspects, where the parameter m is taken to be equal to s, so s' = 1, to optimize performance.

[0290] According to an aspect of the present invention there is provided a method according to a pervious aspect, wherein the actual length £ of the plaintext data to be encrypted is masked from an attacker by a preparation of each group G = Po | Pi | ... | Pn-i | Ao | Ai | ... | An'-i before encryption into : transforming it into a group G' = <DS(£) | P'o | P’i | ... | P'n+n"-i, where I is the length of the bit string Po | Pi | ■■■ | Pn-i , where P'i = Pi , for all 0 < i < n and where P'n+i= <t>s (0), for all 0 < i < n", with n" an arbitrarily chosen number; and at decryption, in the processes according to a previous aspect, each decrypted group GD' = D'o| D’i | ... | D'n+n” | Bo| Bi | ... | Bn-i is transformed into a group GD according to GD = D | Bo| Bi | ... | Bn-i where I is the integer transformation of the bit string D'o and D is the string of the first I bits of D’i | ... | D'n+n” ...

[0291] According to an aspect of the present invention there is provided a method according to a previous aspect, in which it is possible to improve robustness with respect to the consequences of accidental reuse of the same nonce value N in encryption operations performed with the same key K, for example due to insufficient entropy in the seed value of the pseudo-random number generator producing the values of this nonce N. If A is the string of s bits returned by the pseudo-random number generator, the corresponding value of the nonce is according to N = HXOR(A,s(TS)), TS being the timestamp produced by a trusted clock at the precise instant of the encryption operation.

[0292] According to an aspect of the present invention there is provided Method according to a previous aspect, wherein the hash function, H, has a quantum security level of more than 170 bits with regard to its inversion.

[0293] According to an aspect of the present invention there is provided a method according to a previous aspect, wherein the hash function, H, is a Keccak hash function.

[0294] According to an aspect of the present invention there is provided a method according to a previous aspect, wherein the selected bit length s is 512 bits.

Claims

Claims:Masks Generation and Encoding.

1. A method of encoding data for secure transmission between an intended sender and an intended receiver, the method comprising: generating a plurality of sets of masks, the plurality of sets of masks being generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function and a function (s) of a set of natural integers; encoding a first set of data for secure transmission using a first set of masks of the plurality of sets of masks and a second set of data for secure transmission using a second set of masks of the plurality of sets of masks; generating an encoded message from the first and second set of encoded data for transmission to the intended receiver.

2. The method of claim 1, wherein the data for transmission is split into multiple groups of data and wherein the first and second sets of masks are applied to the groups in parallel.

3. The method of claim 1 or claim 2, further comprising generating a signature for at least one of a plurality of groups of encoded data; and sequentially updating a signature following the addition of each group of encoded data to a message for sending.

4. The method of claim 3, wherein generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result or comprises a random rotation process based on a hash logic function.

5. The method of any preceding claim when depended on claim 3 to 4, wherein the signature is generated and applied to each group in parallel via an iterative process based on a group identifier (j).

6. The method of claim 5, further comprising generating, in parallel, the plurality of sets of masks and the signature for each of at least a first plurality of groups,7. The method of any preceding claim, further comprises generating a message signature for the encoded message.

8. The method of any preceding claim, wherein generating the plurality of sets of masks comprises: calculating M'o according to M'o = HXOR (No,s(j)), where HXOR is calculated from H, according to HXOR (M, N) = H(MAN) ands; iteratively calculating M'i according to M'i = H (M'j-i), for all 0 < i < n'; and calculating Mi according to Mi = HXOR (M'i, No ), for all 0 < i < n from HXOR; wheresis any bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits, such as for instance the function wheres(i) is the binary representation of integer i, completed on the left by as many bits as necessary for the length of s (i) to be equal to s; n' is a number of masks M'; n is number of masks M; m is an integer; No is a string of s bits; j is an identification number for each group.

9. The method of any preceding claim, wherein in at least one group a portion of the data is left in the clear.

10. The method of any preceding claim, wherein a nonce (N) is included in the secure transmission.

11. The method of claim 10, wherein the nonce is determined prior to encryption.

12. The method of claim 10 or claim 11, wherein the nonce is generated based on a timestamp.

13. The method of any preceding claim, wherein the length (£) of a mask is concealed.

14. The method of any preceding claims, wherein the method is a computer implemented method.

15. A method of decoding data into a packet stream, wherein the data is received via a secure transmission and has previously been encoded in accordance with any preceding claim.

16. A method of decoding data from a secure transmission between an intended sender and an intended receiver, the method comprising: receiving an encoded packet stream including groups of encoded data; generating a plurality of sets of masks, the plurality of sets of masks being generated based on a combination of one or more of a hash function (H), a nonce (N), a logic function and a function (s) of a set of natural integers; decoding a first set of data from the secure transmission using a first set of masks of the plurality of sets of masks and a second set of data from the secure transmission using a second set of masks of the plurality of sets of masks; rewriting the decoded data in an order corresponding to the order to data in an original message sent by the sender.

17. The method of claim 16, wherein the received data is split into multiple groups of data and wherein the first and second sets of masks are applied to the groups in parallel based in a group identifier.

18. The method of claim 16 or claim 17 further comprising generating a signature to verify the authentication of the decoded message.

19. The method of claim 18, wherein the signature to verify the message is generated for at least one of: a plurality of groups of encoded data; and sequentially updating a signature following the addition of each group of encoded data to a message for sending.

20. The method of claim 18, wherein generation of the signature comprises a multiplicative process using an m-bit integer multiplication giving a 2m-bit result or comprises a random rotation process based on a hash logic function.

21. The method of claim 18, wherein the signature is generated and applied to each group in parallel via an iterative process based on a group identifier (j).

22. The method of any one of claims 16 to 21, wherein generating the plurality of sets of masks comprises: calculating M'o according to M'o = HXOR (No,s(j)), where HXOR is calculated from H (100), according to HXOR (M, N) = H(MAN) ands; iteratively calculating M'i according to M'i = H (MYi), for all 0 < i < n'; and calculating Mi according to Mi = HXOR (M'i, No ), for all 0 < i < n from HXOR; wheresis a bijective function of the set of natural integers strictly less than 2sin the set of strings of s bits, such as the function wheres(i) is the binary representation of integer i, completed on the left by as many bits as necessary for the length ofs(i) to beequal to s; n' is a number of masks IVT; n is number of masks M; m is a bit integer; No is a string of s bits; j is an identification number for each group.

23. The method of any one of claims 16 to 22, wherein in at least one group a portion of the data is left in the clear.

24. The method of one of claims 16 to 23, wherein the length £ of significant bits of the plaintext is concealed.

25. The method of any one of claims 16 to 24 wherein the method is computer implemented.

26. A system for encoding data for secure transmission between an intended sender and an intended receiver, the system comprising a computer configured to execute instructions wherein the instructions comprise any one of claims 1 to 14.

27. A system for decoding data from a secure transmission between an intended sender and an intended receiver, the system comprising a computer configured to execute instructions wherein the instructions comprise any one of claims 15 to 25.

28. A non-transient computer readable medium containing program instructions for causing a computer to perform the method of any one of claims 1 to 14.

29. A non-transient computer readable medium containing program instructions for causing a computer to perform the method of any one of claims 15 to 25.

Images