METHOD FOR ENCIPHERING A SERIES OF SYMBOLS APPLYING A FUNCTION AND A KEY

Abstract: The invention relates to a method for enciphering a series of input symbols (5, 20) under application of a function (2), such as a sustitution box and as a function of a series of key symbols (4). In order to reinforce the enciphering method in applications in which there is always used the same series of key symbols, there is provided a modification algorithm (9) with which, prior to enciphering, the function (8) is modified using symbols from the series of input symbols.

Description: Method for enciphering a series of symbols applying a function and a key. The invention relates to a method according to the preamble of claim 1. A method of said type is disclosed in EP-A-0399587. With the known method, the function applied for enciphering consists of a non-linear function formed by a substitution box ("S box") generated as a function of the key. The document provides no further description of the way in which the substitution box is generated. For obtaining good statistical properties of the output of the substitution box with respect to variable import, a series of symbols obtained by applying the substitution box are combined with just as long a series of statistically well-distributed symbols. The series of symbols obtained in this connection may be used for enciphering a series of input symbols to be enciphered in an enciphered series of output symbols. By applying a key-dependent substitution box instead of a permanent substitution box, the enciphering algorithm is reinforced. An objection to the known method is that, when there is substantially always used the same key, said reinforcement of the enciphering algorithm in practice is appreciably annihilated. Such may occur, e.g., upon authentication when using a chip card, such as a calling card and a GSM card. The object of the invention is to exclude the drawbacks of the known method. To this end, the invention provides a method as described in claim 1. The sender of the enciphered series of output symbols and the receiver of said series must both dispose of the same key and the series of input symbols used for enciphering, at any rate the portion of the latter series used for modifying the function. As a result, the method is particularly suited for authentication, the receiver of an enciphered series of symbols being capable of checking whether a sender having an identity suggested to the receiver has utilised a corresponding key, and in the event of a positive outcome of said check, the identity of the sender is ensured to the receiver. The series of symbols used for modifying the function are particularly variable and are, e.g., a challenge number generated per session, any (different) number, or a variable attribute of the sender, such as a balance kept up to date on a chip card. If the non-linear function used for enciphering were an invertible function, the receiver of the enciphered series of symbols may carry out said check using the same function, the same key and the received series of symbols as an input for the function. The result must be equal to the series of input symbols used for enciphering. Since the receiver may also carry out the check by executing the same operations as the ones carried out by the sender, the series received by the receiver having to be equal to the series generated by the receiver. In such case, it is not required that the function be an invertible function, as a result of which, in the event of the complexity remaining constant, there may be realised a stronger enciphering algorithm which is more resistant against attacks. The function applied to enciphering preferably is a non-linear function which may be formed by way of a substitution box or a cryptographic function, such as a function in which, depending on the input and the key, specific operations are carried out or not. Further properties and advantages of the invention will become clear from the explanation following below of embodiments of the invention in conjunction with the enclosed drawings, in which: FIG. 1 shows a diagram of a known enciphering algorithm; FIG. 2 shows a diagram of a first embodiment of the invention; FIG. 3 shows a flow diagram for the operation of the embodiment according to FIG. 2; and FIG. 4 shows a different embodiment of the invention. By way of a block 1, FIG. 1 presents a known enciphering algorithm (or encryption algorithm) . The enciphering algorithm utilises one or more functions 2, also presented by blocks. Assuming a series of input symbols IN 3 to be enciphered, the enciphering algorithm using a secret key 4 determines an enciphered series of output symbols EXIT 5. The known enciphering algorithm DES [= Data Encryption Standard] operates according to said principle, eight non-linear functions being used which are formed by substitution boxes ("S boxes") . The invention is not limited, however, to the DES algorithm; neither is it limited to using non-linear functions and substitution boxes for the functions . FIG. 2 shows a diagram of an enciphering algorithm 7 based on the enciphering algorithm of FIG. 1 according to the invention. The functions are indicated by reference numeral 8. The functions 8 may be modified by applying an associated reference algorithm 9 based on the series of input symbols IN 3 or part thereof. The modification algorithms 9 need not be equal . Below, the operation of the enciphering algorithm of FIG. 2 will be explained with reference to the flow diagram of FIG. 3. A modification algorithm 9 modifies the function 8 based on a series of modification symbols initially derived from the series of input symbols IN 3 (block 11) .Modifying the function 8 takes place in several steps, namely, the steps n=0 to n=Nmax inclusive, Nmax being permitted to be permanent or also depending on, e.g., the series IN 3. That is why, at the start of the modification of the function 8 , a step counter is reset (block 12) . Subsequently, the function 8 is modified, based on the value of n and the modification series (block 13) . Then the number of steps counted is incremented by 1 (block 14) .Subsequently, it is checked whether the function 8 has already been modified the maximum number of times (block 15) .When this condition is met, the modification of the function 8 is terminated; otherwise the series of modification symbols are modified (step 16) and the function 8 is modified once again based on the new value of n and the modified series of modification symbols (step 13) .In Box I following below, an example is given for the operation of the enciphering algorithm 7 shown in FIG. 2. TABLE I It is assumed that the set of symbols comprises eight symbols, shown in the Table with the numerals 0 to 7 inclusive. It is further assumed that the function 8 is formed by a substitution box. Said box may be realised by a rewritable memory having eight memory locations containing addresses or sequential numbers 1=0...7. The memory locations each comprise one of the symbols, each symbol figuring only once in the memory locations. In Table I, the content of a memory location having address or sequential number i is indicated by y(i) . Initially, the memory locations for i=0...7 contain the symbols 3, 0, 5, 7, 6, 4, 1, 2, respectively. Said series of symbols form an initial substitution box. A symbol of a series of symbols to be enciphered is considered to be address or sequential number i, and is replaced by the symbol in the memory location having said address. According to the initial substitution box of Table I, e.g., 0 is therefore replaced by 3 , 1 by 0 , 2 by 5 , ... , 7 by 2. Before a series of symbols to be enciphered are actually enciphered, according to the invention the initial substitution box is modified first. According to the example of Table I, modification takes place in ten steps (step n=0 to n=Nmax inclusive) . The modification takes place depending on the symbols of the series of symbols to be enciphered, at any rate of several symbols thereof. In Table I, the symbols to be enciphered which are used for the modification of the substitution box are the symbols 5, 2 and 3 indicated at step n=0. Said symbols are allotted to variables x(0) , x(l) and x(2) , respectively. During the first step with n=0, the symbol y(n) , i.e., the symbol 3 of memory location 0, is exchanged with the symbol y(x(0)), namely, symbol 4 of location x(0)=5. In Table I, for clarity's sake, the exchanged symbols of the substitution box of eight symbols are underlined for each of the ten steps n=0, ...9. Subsequently, there is calculated an auxiliary variable h, which is equal to : h= (x(0) +x(l) ) modulo (the number of possible symbols), or in the example h= (x(0) +x(l) ) modulo 8. Subsequently, the symbols of the series of modification symbols x(0), x(l) and x(2) are replaced as follows (" :=" means "becomes", i.e., an allotment) . x(0) :=x(l) , x(l) :=x(2) , and x(2) :=h. For each step, modifying symbols based on the step number and the symbols of the series of modification symbols are repeated a suitable number of times, in the example of Table I Nmax+l=10 times. At the end of said modification algorithm, the initial substitution box: 3, 0, 5, 7, 6, 4, 1, 2 has been replaced by a final substitution box: 1, 2, 6, 5, 4, 7, 3, 0. Subsequently, the symbols of an input series to be enciphered may, according to the order of the symbols in the eventual substitution box, be replaced for providing an output series of enciphered symbols . As a result, in the example the series of input symbols 5, 2, 3 are replaced by 7, 6, 5, respectively. Said series of output symbols are used for possible further steps of the enciphering algorithm. FIG. 4 shows the diagram of an enciphering algorithm 18 which differs from the enciphering algorithm 5 of FIG. 2 in that the modification algorithm 9 is replaced by a modification algorithm 19. Just as the modification algorithm 9, the modification algorithm 19 depends on a number of symbols IN 3 to be enciphered, but in addition on a number of symbols of the key . Table II offers an example of the operation of the modification algorithm 19. TABLE II Table II differs from Table I only in that the series of modification symbols x(0) , x(l), x(2) are completed by x(3) , x(4) . The symbols x(3) and x(4) are derived from the key 4. In the example of Table II, the initial series of modification symbols is 5, 2, 3, 2, 4. According to Table II, the eventual substitution box is: 2, 7, 0, 5, 6, 3, 4, 1. The series of input symbols IN 3 having the symbols 5, 2, 3 is replaced, according to said eventual substitution box, by the enciphered series of output symbols EXIT 20 having the symbols 3, 0, 5. The symbols of the initial substitution box may be sorted at random for as long as both the sender of a series of enciphered symbols UIT 5 and the receiver of the series of enciphered symbols use the same initial substitution box. If it is possible to always meet said condition, the enciphering algorithm may be reinforced by using, as an initial substitution box, a substitution box used during a preceding enciphering process, e.g., the most recently used eventual substitution box. If there is a danger that said condition is not always met, it may be provided that the receiver of the series of enciphered symbols 5 recalls several of such preceding substitution boxes and uses an older one thereof if deciphering the series received leads to a negative check result. Since, both during enciphering a series of symbols and during deciphering thereof, the keys used must be equal and knowledge must be available on the series of enciphered symbols IN 3 , the receiver of the enciphered series may carry out exactly the same operation, i.e., enciphering, as the receiver has carried out, and compare the results to one another. In this event, a non-invertible function may be used for the function which, in the event of constant complexity, makes a stronger enciphering algorithm possible. The modification algorithms explained in conjunction with Tables I and II serve only as an example. For modifying the series of modification symbols there may be applied, e.g., for each step, more than two and/or a different number of modulo additions, and the symbols of the modification series may be rearranged in other ways instead of by way of simple shifting.

Claims: CLAIMS 1. Method for, applying a function (2, 8) and depending on a series of key symbols (4), enciphering a series of input symbols (3), comprising: - 5 modifying, by way of a modification algorithm and depending on a series of modification symbols, the function; subjecting, to the modified function, the series of input symbols for, depending on the series of key symbols, determining a series of output symbols (5, 20) , 10 characterised in that the modification algorithm (9, 19) comprises several sequential steps, the function (8) being modified in each step, depending on the series of modification symbols, and there being modified, after each step, the series of modification symbols by way of a subalgorithm, there being used, for the first step (n=0) , as a series of modification 15 symbols, an initial series of modification symbols derived from the series of input symbols (3) . 2. Method according to claim 1, characterised in that the initial series of modification symbols are also derived from the series of key 20 symbols (4) . 3. Method according to claim l or 2 , characterised in that the modification algorithm (9, 19) comprises the replacement of a symbol of the series of modification symbols, by a replacement symbol obtained by an 25 addition of two or more symbols of the series of modification symbols modulo the number of possible different symbols. 4. Method according to any preceding claim, characterised in that the modification algorithm (9, 19) comprises the modification of sequence 30 numbers of two or more of the symbols of the series of modification symbols . 5. Method according to any preceding claim, characterised in that, for the modification of the function, there is used as an initial function the 35 function which was used earlier for determining an earlier series of output symbols (5, 20) . 6. Method according to any preceding claim, characterised in that the function is a substitution function. 7. Method according to any of the claims 1 to 5 inclusive, characterised in that the function is a non-invertible function. 8. Method according to any of the preceding claims, characterised in that the function comprises a substitution box ("S" box) containing replacement symbols for the symbols of the series of input symbols, and the modification algorithm containing the exchange, depending on the series of modification symbols, of two or more symbols of the substitution box.

Inventors: MULLER FRANK, PRINS SHARON CHRISTIE LESLEY, ROELOFSEN GERRIT, MULLER, FRANK, PRINS, SHARON, CHRISTIE, LESLEY, ROELOFSEN, GERRIT
Applicants: KONINKL KPN NV, MULLER FRANK, PRINS SHARON CHRISTIE LESLEY, ROELOFSEN GERRIT, KONINKLIJKE KPN N.V., MULLER, FRANK, PRINS, SHARON, CHRISTIE, LESLEY, ROELOFSEN, GERRIT
Application year: 2000
Main classification: H04L9
IPC codes: H04L9