Self-authentication ciphertext chaining

Self-identification password text link

<p>10. . . Encryption system</p><p>12. . . Plaintext</p><p>14. . . Encryptor</p><p>16. . . Encryptor output</p><p>18. . . Storage media</p><p>20. . . Decryptor</p>

Figure 1 is a block diagram of an encryption system that can be used to implement an embodiment of the present invention.

Figure 2 is a flow chart illustrating the encryption process of a full block and remaining blocks of a message.

Figure 3 illustrates the flow chart of the program change shown in Figure 2 when the second authentication block is not used.

Figure 4 illustrates the flow chart of the decryption process for the entire block of information encrypted as shown in Figure 2 and the remaining block.

Refer to related applications before and after

This application claims priority to the U.S. Provisional Patent Application No. 60/138,412 filed on June 8, 1999. In most cases, this publication is fully incorporated herein by reference.

Field of invention

The present invention is generally related to cryptographic systems and in particular to a system that uses an encryption key with a fixed modulus size to effectively encrypt information.

Background of the invention

Encryption is a process of converting information from plain text to cipher text. In this way, only authorized readers can decrypt the cipher text back to plain text. When a message is expected to be transmitted via an unreliable channel or stored on an unsafe data storage medium, encryption is often used to protect the information. The term "information" often refers to the communication between a sender and a receiver, but the terms used here refer to the time and/or place at which it was generated or received by the sender and received by the receiver Any information that may need to be protected in between. Therefore, the message may be an email communication, a program, a data group, an image, a set of data objects regarded as a single message, a data stream, or a combination of the above or similar objects.

One way to determine whether the recipient has the authority to read or access it in different ways is to use a "key" for the clear text of the information. A key has always been data, such as a string of bits. An example is a 128-bit key, which is a 128-bit string. Using this method, the sender will use an encryptor to encrypt the clear text of the message into a cipher text. In this way, any recipient of the cipher text who does not know the key, regardless of their authority, does not spend some computational effort and/or time The lower limit cannot be decrypted from the cipher back to the plaintext.

It is fully understood that, in addition to the limited encryption design such as the use of a time filling, with sufficient computational effort and/or time, the plain text can be extracted from the cipher text without the key. For example, an attacker (that is, an unauthorized receiver) can use various possible keys to sequentially decode the information in an attempt to decrypt the information. However, in a well-designed encryption system, the computational cost required to decrypt without the key will exceed the value of information decryption or it will take too much time to make the value of protecting information security passed before the information is decrypted.

There are several aspects to provide the information security of the encryption system. On the one hand, for confidentiality, even readers with password Ai information can keep clear text information away from unauthorized readers. Another aspect is authentication, in which the recipient of the ciphertext can verify whether the information is actually sent by the alleged sender. There is another aspect of integration, in which the receiver can verify that the information has not been modified after leaving the control of the sender. In some instances only one aspect is used. For example, a digital signature program generates a data sequence that authenticates a message, and often transmits the message "clearly" so that anyone can read the message. Therefore, although the information is not confidential, it can still be authenticated. Although the system does not always encrypt the information before it is transmitted or stored, such as the digital signature in this case, this system is still collectively referred to as an encryption system.

Encryption systems are often classified into private key systems and public key systems, which are often called symmetric key systems and asymmetric key systems, respectively. In a private key system, the sender uses the key to encrypt information and the receiver uses the same key to decrypt or verify the information. As a result, the key must be kept secret from unauthorized parties. In the public key system, the key part is a pair of keys including a public part and a private part. The public part does not need to be kept secret and can be used to verify the information and perform other procedures on the information, but the private key is always required to extract the plain text from the confidential information of the cipher text.

An example of the public key standard is the widely used RSA standard. The advantage of using a standard public key system is that many components of the system are readily available, such as email ciphers, key management programs, encoders, decoders, authentication programs, and the like. However, many standard encryption systems use fixed-size blocks with the length of each key of the information. When transmitting information, it needs to be filled and cannot fill in an integer block properly. Random data should be used to avoid unnecessary use when filling. The key can easily decrypt the information.

When the message size is always an integer block, it is not a problem to use a fixed-size block, but when the message is not an integer block, but contains zero or more full blocks and a partial block, part of it must be processed before processing. The block is filled into a full block. When processing to encrypt, decrypt or verify that the amount of information is a function of the number of blocks, and the amount of processing required for a block is quite large, if the information part of a part of the block is very smaller than the block size, the processing routine may be Many unnecessary operations are performed on the same block.

For example, the block size is often used to specify a key modulus for a block encryption. If the key modulus is 512 bits, the information will be encoded in 512-bit blocks. If the encrypted information is 1025 bits long, the information will be encrypted into three 512-bit blocks, one of which will only represent one bit in the information.

Summary of Invention

As in the encryption system of an embodiment of the present invention, an encryption method that extends the existing fixed-key modulus size uses overlapping parts of encrypted information to generate encrypted information. In another aspect of the present invention, the encryption system can insert one or more data bits to ensure correct encryption/decryption and use the inserted data for authentication.

Refer to the remaining parts of the specifications and drawings to realize a further understanding of the benefits and essence of the present invention published here.

Schematic description

Figure 1 is a block diagram of an encryption system that can be used to implement an embodiment of the present invention.

Figure 2 is a flow chart illustrating the encryption process of a full block and remaining blocks of a message.

Figure 3 illustrates the flow chart of the program change shown in Figure 2 when the second authentication block is not used.

Figure 4 illustrates the flow chart of the decryption process for the entire block of information encrypted as shown in Figure 2 and the remaining block.

Symbol description of main components

10. . . Encryption system

12. . . Plaintext

14. . . Encryptor

16. . . Encryptor output

18. . . Storage media

20. . . Decryptor

Specific embodiment description

Figure 1 is a block diagram of an encryption system 10, in which an encryption key is used to encrypt a clear text 12 of information with an encryptor 14 to generate a cipher text, authentication data (such as a digital signature), or bothDeviceOutput 16. The encryptor output 16 is sent to a channel and/or storage medium 18, which is unreliable and therefore considered unsafe. The decryptor 20 receives the encryptor output 16 from the channel and/or storage medium 18, and uses a decryption key to generate a plaintext or authorization instruction 22.

In the encryption/decryption operation, the encryptor can encrypt the plaintext, and the decryptor will decrypt it to obtain the plaintext. In another operation, the encryptor can generate a digital signature that the decryptor may use to verify the information and issue an authentication/non-authentication signal.

In a fixed modulus encryption operation, the plain text 12 is divided into blocks of modulus size, and the plain text cannot be divided equally by the modulus. As shown in Figure 2, the last full block and part of the plain text 12 Encryption is implemented for the remaining blocks.

Figure 2 shows the conversion between a series of full blocks and part of the remaining blocks that caused those data to be encrypted. Figure 2(a) illustrates an information and an authentication block AB. AB may represent many data elements of information. In one example, AB is a zero bit or byte (to prevent overflow), a unit identification address (such as a MAC address), a serial number (to prevent repeated attacks), and the transport of information and other data Knot. In the following description, the following variables are used to indicate the length of various components. AB_len The length of the AB field Payload_len The length of the data to be encoded (a full block and a partial block) Enc_len The length of the block used in the encoding process is as shown in Figure 2(b). Divide into a main data M and a remaining data R, when the division is completed, the length M, len(M) is len(M)+AB_len=EnC_len. In this division, the length R is R _len=Payload_len_len(M)=Payload_len_EnC_len+A B_len. As shown in Figure 2(C), ABMC "" is a concatenation operator 1 that uses an encryption key encKey_e to encrypt and generate a ciphertext field C, where len(C)=Enc_len. In one embodiment, an RSA encoding program is used to encode these blocks. For example, (can be (AB M)^encKey_e mod modulus_n, where the value of Enc_len can be expressed as a unique number smaller than modulus_n. In this case, the length can be in any unit, but the data length is generally measured in bits.

As shown in Figure 2(d), divide C into two fields C1 and C2, where the lengths C1 and C2 satisfy the following equation len(C2)=Enc_len-A2 _len-len(R)=2*Enc_len- A2_len-Payload_len-AB_lenlen(C1)=len(C)-len(C2) where, as shown in Figure 2(e), A2_len is the length of the second authentication block A2. Because of the length word Enc_len of A2C2R, the link can be encrypted with ebqKey_e to generate a remaining ciphertext, RC. As illustrated in Figure 2(f), C1 and RC can be provided to a decryptor.

Optionally insert the second authentication block as shown in Figure 2(e), such as A2. When A2 is not used, because the AB cipher effect is fed through the cipher AI C2, the authentication block AB will authenticate R due to overlap. Among them, the cipher text C2 and R are combined, as in the second (e)-(f) Encrypt as shown in the figure. As long as there are enough bits in C2 to make the erosion effect effective in encryption (for example, C2 is 128 or more bits), it is not necessary to include A2 when generating RC to identify R. However, it will be useful to use A2 when C2 is too small. Therefore, it should be understood that in the figure, len(A2) may range from zero to some positive value. Figure 3 illustrates the feeding effect.

Figure 4 illustrates the flow chart of the decryption process for the entire block of information encrypted as shown in Figure 2 and the rest of the block. As shown in Figure 4(a)-(b): Explanation, the receiving block is divided into a C1 part and an RC part. Because 1en(RC)=Enc_len, the decryptor can appropriately divide its input into C1 and an RC that only knows len(C1RC) and Enc_len.

As shown in Figure 4(c)-(g), RC is decrypted and segmented into A2, C2, and R. If the decryptor knows A2_len and len(R) or Payload_len, Enc_len, AB_len, segmentation can be implemented, and len(R) can be calculated. If A2 is used and cannot be verified, the information will be discarded. Otherwise, the information is parsed into C1 and C2.

Once C1 and C2 are confirmed, they can be connected to form C, and then they can be decrypted to generate AB and M. Finally, combine M and R to reconstruct the original plaintext information. If it cannot be verified, AB will discard the information. One situation where the information cannot be verified is that the value of a key sequence is stored in AB, and the information has a sequence number that is less than or out of sequence relative to a previously received sequence number.

In the decryption process (see Figure 4(c)), the decryptor verifies A2 and discards the information if A2 is unexpected. One of the reasons why A2 is an unexpected value is if the password of Ai information has been changed when it passes from the encryptor to the decryptor. In one embodiment, A2 is simply a zero value, such as a "0" bit or a "00" bit. Due to some overlap between C and RC and C2, the identification of R can be completed only by verifying that A2 is as expected and AB is as expected. In fact, this allows only one authentication block, AB, to be used to authenticate two blocks, resulting in savings in bandwidth and processing. In the calculation, the AB intensity used to identify part of the block is related to the amount of overlap, that is, len(C2). Overlap, len(C2) should preferably be at least 128 bits.

One of the systems described above is used to securely transfer the key to a remote security chip that is accessed on an unreliable channel.

Although the present invention has been described with reference to its specific embodiments, these embodiments only illustrate the present invention and do not limit the scope as long as it is determined by the appended patent application items.