Patent Application
20250004722
This invention relates to computer-implemented methods for generating a pseudorandom number and to a method for symmetrically encrypting a message.
It is very common to want to protect information exchanges. This protection is based on the encryption of messages, such as text, voice and images, exchanged between a sender and a receiver.
The entire process is called “end-to-end encryption” if the message is encrypted from the sender to the recipient(s) without being intelligible for the servers or other services involved in routing the message. Only the sender of the message and the intended recipients must be able to see the unencrypted content.
The only tamper-evident symmetric encryption method known and mathematically demonstrated is the “One Time Pad” (OTP) method. This method is unbreakable by any computer. However, its implementation requires compliance with very stringent conditions, which has so far discouraged its use as a basis for symmetric encryption of long messages.
OTP encryption is inherently indecipherable, regardless of the computing power used, and therefore, as a rule, it has an infinite level of security. A message of length n bytes is masked using an XOR operation with the bytes of a mask of the same length n. To decrypt the hidden message, the same XOR operation must be carried out again, which requires the mask. This mask cannot be calculated, and there are as many possible masks as there are intelligible messages (in all possible languages) of the same length n, with no possibility of guessing which one is the right one. Message length is the only information available to an attacker who does not have the mask, regardless of the available computational power. The same mask must not be reused, because if an attacker had knowledge, by whatever means, of the encrypted and decrypted versions of a message, they would be able to calculate the mask by carrying out the XOR operation between the two versions and to reuse the mask for subsequent messages encrypted with the same mask. The major disadvantages of the OTP method are that the recipient must also have the mask to decrypt the message, that this mask is as long as the message and therefore just as difficult to send securely, and that it must be different every time.
As such, the OTP symmetric key encryption method cannot be used in practice.
Other symmetric encryption methods have been developed and some have been standardized, such as the Advanced Encryption Standard (AES). These algorithms are not tamper-proof. In the case of AES, which is the most commonly used, this algorithm is susceptible to auxiliary channel attacks. Moreover, in its most robust version with 256-bit key length, its resistance to brute force attacks from quantum computers will be insufficient, as a minimum of 512 bits is required. In fact, due to the potential use of the Grover algorithm on a quantum computer as described in Grover L. K.: A fast quantum mechanical algorithm for database search, Proceedings, 28th Annual ACM Symposium on the Theory of Computing, (May 1996) p. 212, the level of security against the risk of breaking AES-256 by brute force is reduced from 256 bits to 256/2=128 bits. For encrypting real-time data streams, specific algorithms were produced with AES as an underlying algorithm. These are the Gallois Counter Mode (GCM) and the Offset Codebook Mode (OCB). In addition to the AES drawbacks discussed earlier, these two modes introduced additional weaknesses. A more recent version of AES-GCM, AES-GCM-SIV, corrects the AES-GCM weaknesses to some extent (reference: “Gueron, S. (April 2019), AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption: IETF: doi: 10.1748/FRC8452”) but at the cost of a significant deterioration in performance.
The present invention aims to remedy one or more of the disadvantages associated with the prior art.
In accordance with the present inventions, a computer-implemented method is provided for generating at least one pseudorandom number, comprising: obtaining a boot value, K, of a certain entropy represented by its bit length; combining, using an XOR operation, the boot value, K, with a pseudorandom nonce, N, of the same bit length s, the combination represented by (K{circumflex over ( )}N) wherein {circumflex over ( )} is an XOR operation; and running a one-way hash function, H, adapted to the bit length on the combination (K{circumflex over ( )}N) to generate a value, M′0, wherein the pseudorandom number M′i+1 is calculated according to H(M′i), wherein 0≤i<n−1.
This method is a practical and robust way to provide a pseudorandom number. In addition, this process and any other process based on its implementation are resistant to auxiliary channel attacks. The XOR operation is carried out with a constant number of clock cycles, irrespective of the values of K and N. This operation therefore cannot be subject to auxiliary channel attacks based on statistical analysis of the calculation times or power consumption required for this calculation if this process is repeated a large number of times with the same K key, since these calculation time and power consumption data remain constant.
A nonce, which can also be called a cryptographic nonce, is an arbitrary number that can only be used once in a cryptographic communication. The function H(K{circumflex over ( )}N) can be called HXOR, where it is defined by HXOR(K, N)=H(K{circumflex over ( )}N).
Advantageously, the method comprises producing a sequence of pseudorandom masks Mi using a sequence of pseudorandom numbers M′i and the nonce N for generating the pseudorandom numbers, according to the expression Mi=H(M′i{circumflex over ( )}N), wherein 0≤i<n.
The present invention further relates to a method for encrypting a message, P, comprising the following steps: splitting the message, P, into n equal parts, Pi, wherein 0≤i<n, of the chosen bit length s; combining each part, Pi, with the mask, Mi of the same bit length s, wherein 0≤i<n, to form an encrypted part, C0 to Cn−1, for each part; and concatenating the nonce N and the encrypted parts, C0 to Cn−1 to form an encrypted message, C, in which each mask, M0 to Mn−1, is a pseudorandom number generated according to the method for generating a pseudorandom number.
The combination also includes an XOR operation.
According to one feature, the method comprises the creation of a signature, S, for the encrypted message C.
Advantageously, the method comprises calculating the signature, S, according to HMAC(Sn−1, M′n), wherein sn−1 is the nth value in a sequence calculated according to si+1=Si{circumflex over ( )}Pi+1, wherein 0≤i<n, S0 is P0 and wherein M′n is n+1th value in the sequence of pseudorandom numbers M′i.
Alternatively, the method comprises calculating the signature, S, according to HXOR(Sn−1, N), wherein sn−1 is the nth value in a sequence calculated according to si+1=Si{circumflex over ( )}Pi+1, wherein 0≤i<n, S0 is P0 and N is the nonce.
The encryption method also comprises attaching the signature, S, to the encrypted message, C, to form a signed encrypted message, T.
The present invention further relates to a method for decrypting the encrypted message C, produced according to claim 3 comprising retrieving the nonce N and the encrypted parts, C0 to Cn−1 of the encrypted message C, calculating the masks according to claim 2; decrypting each encrypted part C0 to Cn−1, together with the boot value, K and the nonce N, to form the equal parts, P0 to Pn−1; and combining the parts P0 to Pn−1 to form the message P.
The present invention further relates to a method for encrypting a data stream F, comprising: slicing the data stream F into packets Pi, of bit length s, with i≥0; sending a pseudorandom nonce N in the encrypted stream ES; encrypting each packet Pi, wherein an encrypted packet C2i=(Pi{circumflex over ( )}M2i) and C2i+1=(Pi{circumflex over ( )}M2i+1), wherein Mi is the sequence of pseudorandom masks Mi according to claim 2; concatenating the number i with to form C2i and C2i+1 to form the encrypted version (i| C2i|C2i+1); and sending the encrypted version in the encrypted data stream ES.
The present invention further relates to a method for decrypting an encrypted data stream ES, produced according to claim 8, comprising: retrieving the nonce N at the start of sending the encrypted data stream ES, allowing calculation of the suites Mi and M′i according to claim 2; decrypting each encrypted version (i|C2i|C2i+1) into Di=C2i{circumflex over ( )}M2i; and checking the integrity by establishing that Di=M2i+1{circumflex over ( )}C2i+1, with the certainty that Di=Pi, if this check is positive.
Advantageously, if s≥512, the hash function, H, has a quantum security level of more than 170 bits with respect to its inversion.
According to one feature, the hash function, H, is a Keccak hash function.
According to another feature, the chosen bit length is 512 bits.
The present invention further relates to a computer-implemented method for symmetric encryption using a K key, comprising: obtaining a pseudorandom nonce N for each plaintext message P to be encrypted, each nonce having the same bit length s as the K key; combining, using an XOR operation, the K key with the nonce, N, the combination represented by (K{circumflex over ( )}N) wherein {circumflex over ( )} is an XOR operation; running a one-way hash function, H, adapted to the bit length on the combination (K{circumflex over ( )}N) to generate a modified key, K′; encrypting the message P using the modified key, K′; and concatenating the nonce N with the result of this encryption to form the encrypted message C.
Such a method is resistant to auxiliary channel attacks.
The present invention further relates to a computer-implemented method for symmetrically decrypting the encrypted message C according to claim 14, comprising: obtaining the pseudorandom nonce N of the encrypted message C; combining, using an XOR operation, the K key with the nonce, N, the combination represented by (K{circumflex over ( )}N) wherein {circumflex over ( )} is an XOR operation; running the one-way hash function, H, on the combination (K{circumflex over ( )}N) to generate the modified key, K′; and decrypting the encrypted message C using the modified key, K′, to obtain the plaintext message P.
Within the scope of this application, it is expressly provided that the various aspects, embodiments, examples and variants disclosed in the preceding paragraphs, in the claims and/or in the following description and drawings, and in particular the individual features thereof, can be taken alone or in combination. This means that all embodiments and/or features of any embodiment can be combined in any way and/or combination, unless these features are incompatible. The applicant reserves the right to amend any claim originally filed or to file any new claim accordingly, including the right to amend any claim originally filed to depend on and/or incorporate any feature of any other claim even though it was not originally claimed in this manner.
Various embodiments of the invention are described below with reference to the attached drawings, in which:
Referring to
The first operation in the process shown in
With reference to
In this way, symmetric One Time Pad encryption can be provided as a secure and cost-effective way of encrypting transmitted information, but with a reduced level of security relative to infinity. In one example in which the chosen bit length is 512 bits and the method is as shown in
Since mask calculation is entirely separate from the message to be encrypted itself, for data streams where reducing information transmission latency could be an issue, frame production and mask construction can be two processes run in parallel. Latency is therefore only penalized by the XOR operation, which is one of the fastest operations that can be carried out on a computer. This is a clear advantage over other symmetric encryption algorithms, such as AES 256, where the message to be encrypted must be available before the encryption operations begin, since the latter are much longer than a simple XOR.
For the one-way hash function, the Keccak algorithm, as described by Guido Bertoni, Joan Daemen, Michael Peeters, Gilles Van Assche and Ronny Van Keer in “KANGAROO Twelve: fast hashing based on KECCAK-p (International Association for Cryptologic Research, 2016”), has a 512-bit security level against attacks originating from conventional computers. The security level with regard to attacks originating from quantum computers was determined by Gilles Brassard, Peter Hoyer and Alain Tapp in “Quantum cryptanalysis of hash and claw-free functions, Springer, 2006”, and is equal to 512/3 is equal to around 170.
If the entropy of the information for the boot value K is 512 bits, all Mis will retain the same entropy level, namely 512 bits, if the likelihood of a collision, when applying the H function to Mi−1 remains sufficiently low.
The use of pseudorandom numbers generated by the method described in relation to
In order to take full account of an IND-CCA2 level attack, it is necessary to ensure that the acquisition, by any means, of the encrypted and decrypted versions of a block of the message P does not allow the subsequent blocks of the same message to be decrypted. In this respect, the calculation of the mask sequence must be consistent with the method in relation to
With reference to
Referring now to
Referring now to
For decryption, if T=N|C0|C1|C2 . . . |Cn|S is the encrypted message, optionally signed if S is present, and if the recipient has the K key, he can reconstruct the M′i and Mi sequences with the same formulas as before, construct the decrypted message D=(C0{circumflex over ( )}M0)|(C1{circumflex over ( )}M1)|(C2{circumflex over ( )}M2) . . . |(Cn−1{circumflex over ( )}Mn−1). If the message is signed, the recipient can also reconstruct the signature S′=HMAC(Sn−1, M′n) with S′0=D0, S′i+1=S′i{circumflex over ( )}Di+1, for any i such as n−1>i≥0. Alternatively, as seen above, this signature could be reconstructed according to S′=HXOR(Sn−1, N).
In the case of a signed message, the integrity check can be done by testing equality S=S′, with a very high likelihood that Di=Pi, for any i such as n>i≥0, if the test is positive.
To encrypt and decrypt, with or without checking integrity, the plaintext message P of any length, it is sufficient to have previously exchanged, using a signed asymmetric encryption method, a K key of a certain bit length s, for example 512 bits, constructed in such a way as to ensure an entropy level of 512 bits, then to encrypt each of the messages with a different value of the nonce N. In OTP encryption, the fact that the security level is infinite stems from the fact that there are no selection criteria for deciding which of the potential masks corresponds to the encryption chosen by the sender. In the embodiments of the invention, this criterion exists whenever the message has more than one block or is signed. If the message is unsigned but contains several blocks, the criterion will be, when trying a K key, that all the decrypted blocks are simultaneously “intelligible” in at least one language. If the message is signed, the criterion will simply be that for the K key attempted, the result is S=S′. The security level is therefore not infinite, but decrypting without the key means exploring 2512 possibilities for a K key and a 512-bit hash function. This colossal number, of the order of magnitude of the square of the number of atoms in the universe, makes decryption impossible in practice, even with an attack mechanism using a quantum computer, for which the security level is reduced from 512 to 170.
If the pseudorandom nonce N is inadvertently reused to encrypt two plaintext messages P and P′, the consequences will be very limited. If the attacker has found that the nonce N has been reused and knows the encrypted and decrypted versions of P, and that P has n blocks, he will be able to find the decrypted version of the first n blocks of P′, but this will be the only possible breach. The K key can never be recreated to decrypt other messages, and if P′ has more blocks than P, the last blocks cannot be decrypted. More precisely, the only blocks of P′ that can be decrypted are the ones for which the encrypted and decrypted versions of the same sequence number of P are known to the attacker. Because of this extremely substantial limitation, an encryption process whose mask sequence calculation is based on
Referring to
The process illustrated in
Each encrypted form of the packet (i|C2i|C2i+1) can be decrypted in Di, with Di=M2i{circumflex over ( )}C2i and the integrity check consists of verifying that Di=M2i+1{circumflex over ( )}C2i+1 as well. If this verification is positive, then Di=Pi, this time with certainty and not just with a very high probability.
Expressed as the number of clock cycles required to decrypt each packet of s bits with integrity checking, this process results in lower latency than AES alone, AES-GCM or AES-OCB, without the same security weaknesses. Thus, with 64-bit processors, to decrypt a 512-bit packet with integrity checking, due to the complete decorrelation between mask calculation and decryption process, the process covered by the present inventions requires only 24 clock cycles with a single-core processor (16 cycles for decryption and 8 cycles for comparison), whereas AES256 alone requires 1,610 clock cycles (reference: Schneier, Bruce; Kelsey, John; Whiting, Doug; Wagner, David; Hall, Chris; Ferguson, Niels (1999 Feb. 1), Performance Comparisons of the AES submissions), AES256-OCB and AES256-GCM require over 80 cycles, AES256-GCM-SIV over 170 (reference: Krovetz, Ted and Rogaway, Philip, The Design and Evolution of OCB. Journal of Cryptology, Jul. 27, 2021. https://link.springer.com/content/pdf/10.1007/s00145-021-09399-8.pdf). Similar to the message encryption process described above, the stream encryption process covered by these disclosures can be considered resistant to inadvertent reuse of the nonce.
To make the E algorithm impervious to auxiliary channel attacks, the function HXOR defined as HXOR(K, N)=H(K{circumflex over ( )}N) can be considered, wherein s is the number of bits in the K key, N is a pseudorandom nonce of the same bit length s and which will be different for each message to be encrypted P, {circumflex over ( )} is the XOR operation and H is a one-way hash function producing a result of s bits in length. The converted E′ algorithm is then defined by C′=E′(P, K)=N|E(P, HXOR(K, N)), | being the concatenation operation and N being a randomly chosen, but different, nonce for each message P to be encrypted. Due to the properties of the hash function H, sending N in plaintext in C′ does not allow the K key or the P message to be compromised.
For decryption, the nonce N 65 is obtained from the encrypted message C′, 68. The modified key can then be derived from the nonce N and the K key 61 in the same way as described above with respect to encryption. The encrypted message C′, 68, can then be decrypted, using the modified key, to obtain the plaintext message P 62.
The converted E′ algorithm described above is not susceptible to auxiliary channel attacks. In fact, since the first operation carried out for encryption or decryption is the XOR operation on s bits, which always requires the same number of clock cycles to be run, this operation in itself is not subject to auxiliary channel attacks. All of the subsequent operations in the hash function H and then in the E algorithm have runtimes and power consumption that depend on the result of this XOR function but since N is different at each encryption, the variability of this result cannot be distinguished from that of the messages processed and, since the result is no longer a constant, no auxiliary channel attack based on statistical analysis of the runtimes or power consumption of H and/or E will be able to find the bits in the K key. Even if the nonce N is inadvertently reused a few times and the attacker detects this, no statistical processing will be possible if the number of reuses remains low. The method covered in these disclosures can therefore be considered resistant to the reuse of the nonce. It will be understood that these advantages apply to other methods using the function described herein.
Referring now to
The processes in the embodiments of the invention are based on the use of a hash function H. If I is the interval [0, 2s−1] of natural numbers, of cardinal 2s, a hash function of s bits in length is a function of I in I such that the likelihood for any X that H(X) is equal to a given value Y is equal to ½s. If the only known method of inverting the hash function is to browse the list of 2s values of I, the hash function is said to be one-way and the security level of the inversion is equal to s bits for a conventional deterministic computer. If a value C in | is equal to C=H(C), C is a collision value of H. If nc is the number of collision values in I, the quality of the hash function is measured by the fact that the probability density of the H values is uniform over | and that the likelihood of a collision, equal to nc/2s, remains very low.
Throughout the description and claims of this specification, the words “understand” and “contain” and their variations mean “including but not limited to” and are not intended for (and do not exclude) other parts, additives, components, integers or steps. Throughout the description and claims of this specification, the singular includes the plural, unless the context requires otherwise. In particular, when the indefinite article is used, the specification must be understood as envisaging plurality as well as singularity, unless the context requires otherwise.
Features, integers, characteristics, compounds or groups described in connection with a particular aspect, embodiment or example of the invention are to be understood as applicable to any other aspect, embodiment or example described herein, unless inconsistent therewith. All of the features disclosed in this specification (including the claims, abstract and accompanying drawings), and/or all of the steps of a method or process thus disclosed, can be combined in any combination, with the exception of combinations in which at least some of these features and/or steps are mutually exclusive. The invention is not limited to the details of all of the preceding embodiments. The invention extends to any new feature, or any new combination, of the features disclosed in the present specification (including the claims, abstract and accompanying drawings), or to any new feature, or any new combination, of the steps of any method or process thus disclosed.
The readers attention is directed to all papers and documents which have been contemporaneously or previously filed with this specification in connection with this application and which are open to public inspection with this specification, and the contents of all such papers and documents are incorporated herein by reference.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2110513 | Oct 2021 | FR | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2022/078024 | 10/10/2022 | WO |
