Abstract:
It is described a method of encrypting digital information in a sender and decrypting said digital information in a receiver, where said sender and receiver agree on a block of a working key. First a sender generates a secret padding code. Said sender combines said digital information with the said secret padding code to produce a block of padded plaintext. Then, said sender computes encrypted information by applying a triangular encryption function. The sender transmits said encrypted information to said receiver, where the receiver decrypts said encrypted information received from said sender by applying a triangular decryption function, and then the receiver unpads said digital information by removing said secret padding code from the blocks of plaintext.

Description:
[0001]    The present invention relates to a method of encrypting digital information in a sender and decrypting said digital information in a receiver, where said sender and receiver agrees on a working key. 
       PRIOR ART 
       [0002]    Several symmetric encryption methods are known. The simplest and fastest way to encrypt a message is to use a stream cipher. Stream ciphers encrypt plaintext one byte or one bit at a time. The problem with the stream cipher is that for a new plaintext the sender should use a different key sequence than previously, otherwise the key sequence can be discovered by an adversary. 
         [0003]    The block cipher is a way to handle the problem of reusing the key sequence. Block ciphers encrypt plaintext in blocks; most commonly are 64 and 128 bits. To apply the block cipher the sender cuts the plaintext into blocks, performs the encryption by using a known method of encryption. With a strong block cipher the key sequence can be reused several times. But a strong block cipher is a complicated matter not only to a cryptanalyst but also to the implementer. In particular, it works more slowly than a stream cipher. 
         [0004]    Another common way to reuse said key sequence is to make the cipher be dependent on a public initial vector, which should be transmitted before the cipher text in order for the receiver to be able to decrypt the message correctly. This public initial vector defines the initial state of the cipher, so in some implementations of this idea the cipher may be vulnerable to the chosen public initial vector attack. 
         [0005]    In cryptography there is a natural distinction between the level of secrecy of the cipher key and that of a particular plaintext. Generally, the cipher key should be kept more secret than the plaintext because the knowledge of the key leads to getting all plaintexts encrypted with that key. In a randomized encryption scheme the padding code is supposed to be as secret as the plaintext and the encryption function is based on a strong block or public-key cipher. Therefore the knowledge of the padding code for a particular plaintext does not enhance finding the cipher key. The randomized encryption can be considered as a way of using known ciphers, which makes them strong when the set of possible plaintexts is small. 
         [0006]    Most of the known symmetric ciphers, like DES or AES, are product or iterated ciphers. Their encryption-decryption functions are compositions of a number of rather simple functions. In order to achieve a high level of security the number of terms in the composition (or the number of rounds) should be rather large; usually from 10 to 20. Otherwise some of such ciphers may be vulnerable to algebraic attacks based on effective methods for solving sparse systems of nonlinear equations. Every product or iterated cipher may be described by a sparse system of nonlinear equations, where the degree of sparseness varies from one cipher to another. But increasing the number of rounds obviously results in losing the speed of the encryption-decryption algorithm. 
         [0007]    An aim of the present invention is consequently to present a new method for producing a symmetric cipher, which hopefully will give a faster way of encryption and decryption than block ciphers. 
         [0008]    Therefore, the encryption-decryption algorithm in the present invention, which is in the base of the triangular cipher, may be simplified so that if the triangular cipher is used as an asynchronous stream cipher the encryption will not be secure. But for the triangular cipher comprising a secret padding code, which is supposed to be as secret as the key, the simplification of an encryption function implies a faster encryption without losing its security. 
         [0009]    In opposite to product or iterated ciphers, triangular ciphers are constructed without using compositions of simple functions which depend on small numbers of variables. To encrypt one block of the plaintext a triangular ciphers typically implements one or various modular multiplications of integer numbers of the block size. 
         [0010]    Triangular ciphers generally give a faster way of reusing said key sequence. 
         [0011]    Similarly to block ciphers, triangular ciphers can work with blocks of information, e.g. 128 bits or more. The strength of the cipher increases as the block size n increases, i.e. the brute force attack takes about 2 n  trials. 
         [0012]    Triangular ciphers may be used to protect all communications in computer networks. The method is easy to implement, especially in software. Triangular ciphers may be used to provide confidentiality and data integrity, when used as a Message Authentication Code (MAC), in all computer networks including the Internet. They may be particularly useful for banking. 
       SHORT DESCRIPTION OF THE INVENTION 
       [0013]    The encryption method according to the present invention is based on padding a plaintext with a secret padding code before encryption and using a triangular map as the encryption function. In the triangular cipher method the padding code is as secret as the cipher key so that the knowledge of the secret padding code usually leads to breaking the cipher (finding its key), because a simpler map is taken as the encryption function and, in particular, because of its triangularity. Although the encryption function is very simple, this, on the whole, makes the encryption-decryption algorithm work faster without losing its security. 
         [0014]    For two parties (sender and receiver) to be able to exchange information they agree on a master key. The sender and receiver then expand said master key to a working key. The working key is then used to encrypt messages in an encryption function and decrypt messages in a decryption function. 
         [0015]    The encryption function can also be made to depend on a public initial vector (IV), which may change from one message to another. Therefore said vector should be transmitted before the ciphertext. In this case it is not necessary for the secret code to change very often. 
         [0016]    Another object of the invention is using a triangular cipher as a Message Authentication Code (MAC) along with the encryption. To do so the sender pads the plaintext with a fixed public block at the end and applies the triangular cipher to get a ciphertext. The receiver computes the plaintext from the ciphertext and checks its last block. If it is equal to the fixed public block above, the receiver accepts the integrity and the authenticity of the plaintext, otherwise the receiver rejects it. 
         [0017]    The encryption function in the sender constructs the ciphertext from the information of the secret padding code, the plaintext and the working key sequence. The secret padding code can then be discarded if necessary. Subsequently the encrypted message, i.e. the ciphertext, is sent from the sender to the receiver. 
         [0018]    To decrypt the plaintext from said received ciphertext the receiver computes the plaintext padded with said secret padding code in the decryption function, given the working key and an initial vector, where an invertibility property of the encryption function is used to determine the plaintext. The secret padding code can now be discarded in the receiver if necessary. 
         [0019]    One object of the present invention is characterized by the following steps:
       a) sender generates a secret padding code x,   b) sender combines said digital information with said secret padding code x to produce a padded plaintext represented by blocks p i ,   c) sender computes encrypted information represented by blocks c i , by applying a triangular encryption function g,   d) sender transmits said encrypted information c i  to said receiver,   e) receiver decrypts said encrypted information c i  received from said sender by applying a triangular decryption function h, comprising the inversion of encryption function g, and   f) receiver unpads said digital information by removing said secret padding code x in b) from the blocks of plaintext p i .       
 
         [0026]    Alternative objects of the present invention are described by the features of claims  2 - 10 . 
     
    
     
       SHORT DESCRIPTION OF THE FIGURES 
         [0027]    The invention will now be described with reference to the accompanying drawings, wherein: 
           [0028]      FIG. 1  shows a block diagram of an example of the encryption process of the present invention. 
           [0029]      FIG. 2  shows a block diagram of an example of the decryption process according to  FIG. 1  of the present invention. 
           [0030]      FIG. 3  shows a block diagram of a further example of the encryption method according to the present invention. 
           [0031]      FIG. 4  shows a block diagram of a further example of the decryption method according to  FIG. 3  of the present invention. 
           [0032]      FIG. 5  shows a block diagram of an example of the function g in  FIGS. 3 and 4  according to the present invention. 
           [0033]      FIG. 6  shows a block diagram of a further example of another embodiment of the encryption method according to the present invention. 
           [0034]      FIG. 7  shows a block diagram of a further example of another embodiment of the decryption method according to  FIG. 6  of the present invention. 
       
    
    
     DESCRIPTION OF THE INVENTION 
     The Triangular Symmetry 
       [0035]    Let K, C, X, P be sets, where K denotes a set of keys, P is the set of all possible plaintexts and C is the set of related cipher texts. Let 
         [0000]        K=K   0   ×K   1 , 
         [0000]    where K 0  is a finite set and k=(k 0 ,k 1 ) when kεK. Similarly, 
         [0000]        C=C   0   ×C   1 , 
         [0000]    where C 0  is an finite set and c=(c 0 ,c 1 ) when cεC. Let X be a finite set of secret pads. An encryption function ƒ k  depends on the key kεK and defines the map 
         [0000]      ƒ k   :X×P→C   (1) 
         [0000]    such that a property of triangularity is satisfied. It is claimed that 
         [0000]      ƒ k ( x,p )= c  or ƒ (   k     0     ,k     1     ) ( x,p )=( c   0   ,c   1 ),  (2) 
         [0000]    where xεX, and pεP, and the block c 0  of the cipher text only depends on x and k 0 . We denote this fact as 
         [0000]      ƒ k     0   ( x )= c   0   (3) 
         [0000]    and it is claimed that the function ƒ k     0    the restriction of ƒ k . The function ƒ k  is invertible. This means that given cεC and kεK the unique pair x,p can be found such that formula (2) applies, and given c 0 εC 0  and k 0 εK 0  the unique x can be found such that formula (3) applies. 
         [0036]    Though it is not necessary, it can be assumed that another symmetric property of the invertibility is satisfied. Namely, given any cεC and x,p there is just one kεK such that formula (2) holds and given c 0 εC 0  and xεX the unique k 0 εK 0  is found such that formula (3) applies. 
         [0037]    To encrypt a plaintext the sender represents said plaintext as an element pεP by adding some auxiliary random or fixed bits. Subsequently, said sender produces a secret padding code xεX. Preferably, x should be different for different messages. Thereafter said sender constructs the padded plaintext x,p and computes the ciphertext c by using formula (2), and then he can discard the secret padding code x. In order to decrypt the plaintext from the ciphertext c the receiver computes x,p by using formula (2) and the invertibility of ƒ k , given the key k. Now the sender can find p. Later the receiver can discard the secret padding code x. 
       DETAILED DESCRIPTION OF THE FIGURES 
       [0038]      FIG. 1  shows a sender for implementing a general encryption method of the present invention. Let X, Y, C 0  and K 0  be finite sets. Let P=X s  for the set of all possible plaintexts, and C=C 0   s+1  for the set of ciphertexts, and K=K 0   s+1  for the set of working keys. 
         [0039]    Let g be an encryption function: 
         [0000]        g ( p   i   ,k   i   ,y   i )=( c   i   ,y   i+1 ) 
         [0000]    if and only if h is a decryption function: 
         [0000]        h ( c   i   ,k   i   ,y   i )=( p   i   ,y   i+1 ) 
         [0000]    for any k i εK 0 , p i εX, y i ,y i+1 εY, c i εC 0 , and i=1, 2, 3, . . . . The arguments of the functions are represented by binary n-strings for an appropriate n, such as 128 or 256. Here p 0 ,p 1 ,p 2  . . . is a padded plaintext, where p 0 =x is a secret padding code, and c 0 ,c 1 ,c 2  . . . is the related ciphertext and y 0 ,y 1 ,y 2  . . . is the sequence of internal states of the cipher, which are hereafter referred to as carriers. The initial state y 0  is a public element and may be used as a public initial vector (IV), and can be produced by a random number generator. The public IV would in this case be sent before the ciphertext. 
         [0040]    An alternative method for generating the public IV is for it to be fixed, and it would then be a part of the cipher. 
         [0041]    To implement said encryption method said sender and receiver must agree on a master key by using a public key distribution protocol, such as the Diffie-Hellman protocol or its modification, or the master key can be distributed by an authority. Thereafter, the master key is extended to a working key k i . The working key k is an element of K, so k=(k 0 ,k 1 , . . . , k s ), where k i εK 0 , which may be reused in order to encrypt several messages. However, working keys used only once will enhance security of the algorithm. Because s may be big, it is convenient to repeat some of the sequences in the working key k in order to not keep in the memory very long working keys. For example, a relatively small number s 0 ) like s 0 =0, 1 or 2 is fixed and let k=(k 0 ,k 1 , . . . , k s0 ,k 0 ,k 1 , . . . , k s0 , . . . ). The method to produce k from the master key k* is flexible. One way is to use a one way function φ:K 0 →K 0 . For simplicity let k*εK 0 , then 
         [0000]        k   0 =φ( k *) and  k   i =φ( k   i−1 ) 
         [0000]    for i=1, . . . , s 0 . When s 0 &gt;0 the encryption function ƒ k  may be taken simpler without loss in security. 
         [0042]    In some implementations it is important to avoid a Side Channel Attack. In this case it is preferable to change blocks of the working key k i  from one to another using some simple function, which is not specified herein. 
         [0043]    To encrypt the plaintext pεP, where p=(p 1 , . . . , p s ), and p i εX the sender produces a secret padding code xεX. Said padding code can be produced in a plurality of ways, and preferably the padding code is precomputed, such as in one of the following methods:
       x is an output of a random number generator,   x is a hash-value of the master key and the number of the message the sender is encrypting, or some other information, such as time, receivers name, receivers address, or   x is produced by a mixture of both above-mentioned methods.       
 
         [0047]    Preferably x can be different for different messages. If the same secret padding code is used to encrypt two different plaintexts, the knowledge of one of the plaintexts can reveal some information of the other. Using a good random number generator for producing x can enable encryption up to about 2 n/2−10  messages for any length with one working key. The probability of coincidence of the secret padding code for two different messages is then negligible. 
       Necessary Condition 
       [0048]    The following condition for the general triangular cipher must be fulfilled for the encryption to be secure. 
         [0049]    Let k=(k 0 ,k 1 ) be a working key and for a ciphertext c=(c 0 ,c 1 ) let p be the related plaintext. Then for any fixed triple c o ,k 1 ,p the block c 1  of the cipher text c is a function only in x. Note that it is assumed the properties of invertibility of the function ƒ k  and its restriction. The set 
         [0000]        U ( c   o   ,k   1   ,p )={ c   1   |xεX}   
         [0000]    is defined which is a subset of C 1 . Let u be the size of U(c o ,k 1 ,p). Generally u=u(c 0 ,k 1 ,p) is a function in c 0 ,k 1 ,p and 
         [0000]        u ≦min{| C   1   |,|X|}.    
         [0050]    For each triple c 0 ,k 1 ,p the partition is present: 
         [0000]      X=X 1 ∪ . . . ∪X u   (4) 
         [0000]    into classes, where x′ and x″ are in the same class if and only if c 1 ′=c 1 ″ for the last blocks of related ciphertexts c′,c″ produced from the plaintext p with the secret padding codes x′, x″. 
         [0051]    The necessary condition for the cipher to be secure will then be: 
         [0052]    For most triples, c o ,k 1 ,p, the size of the set U(c o ,k 1 ,p) is about min{|C 1 |,|X|}. 
         [0053]    This condition is also a necessary condition in said decryption method for the cipher to be secure. 
         [0054]    The theorem described below will prove that if the above-mentioned condition is violated, the cipher may be insecure. The natural assumption is: Given a number of pairs
       p 1 , c 1 ,   p 2 , c 2 ,   . . .   p r , c r  
 
of plaintexts p i  and related cipher texts c i , produced with the same working key k, and a particular ciphertext c is also produced with k, find the true plaintext p for c.
       
 
         [0059]    It is assumed that the terms of formula (4) are given explicitly, that is the representatives of the classes are given. Though c 1  depends on k 1  and p, which may be unknown, in practise it is often possible to get them. 
       Theorem 
       [0060]    Let for any triple c o ,k 1 ,p the number u=u(c 0 ,k 1 ,p) be bounded by v. Then
       1. if       
 
         [0000]        v&lt;|K   1 | (1−1/r)          for some natural number r and one knows r pairs of plaintexts, ciphertexts produced with the same working key k=(k 0 ,k 1 ), then in         
         [0000]      O(rv log v)       steps on the average one computes the true k 1 .   2. If the true k 1  and a ciphertext c are known, then in O(v) steps a subset of size no more than v of the set P is computed, which comprises the true plaintext p.         
       Proof 
       [0065]    1. Let one pair p, c of plaintext, ciphertext be known, where c=(c 0 ,c 1 ) is produced with the working key k=(k 0 ,k 1 ). For each term X i  of the formula (4) a representative x i εX i  is taken. Then the padded plaintext x i , p is composed and k i =(k i0 ,k i1 ) is computed from the equation 
         [0000]        c=ƒ   k     i   ( x   i   ,p )  (5) 
         [0000]    using the invertibility of ƒ. In the end there is a set of no more than v elements 
         [0000]      {k i1 } ⊂ K 1 . 
         [0066]    One of these elements is the true k 1 . Let the true x be in X i  for some i, where 1≦i≦u and let x i  be the chosen above representative of this class. From the definition of formula (4): 
         [0000]      ( c   0   ,c   1 )=ƒ (k′     0     ,k     1     ) ( x   i   ,p ) 
         [0000]    for some k′ 0 εK 0 . From this equation and formula (5) k i =(k′ 0 ,k 1 ) and therefore k 1 =k i1 . 
         [0067]    So having r pairs of plaintexts, ciphertexts, r random looking subsets of size no more than v of the set K 1  are computed, which have the true k 1  as their common element. On the average the number of common elements of such subsets is bounded by 
         [0000]    
       
         
           
             
               v 
               r 
             
             
               
                  
                 
                   K 
                   1 
                 
                  
               
               
                 ( 
                 
                   r 
                   - 
                   1 
                 
                 ) 
               
             
           
         
       
     
         [0068]    When v&lt;|K 1 | (1−1/r)  this number is less than 1. So on the average there is only one common element, which should be the true k 1 . It is computed by using sorting algorithms in O(rv log v) steps. 
         [0069]    2. Formula (4) is now considered for the triple c o ,k 1 ,p, where p is unknown. For each term X i  of the partition a representative x i  is taken. Then k i0 εK 0  is computed from the equation 
         [0000]        c   0   =ƒ   k     i0   ( x   i ) 
         [0000]    by using the invertibility of the restriction of ƒ k . The working key k i =(k i0 ,k 1 ) is then constructed and a plaintext p 1i  is computed from the equation 
         [0000]        c=ƒ   k     i   ( x   i   ,p   1i )  (6) 
         [0070]    At the end a set of elements is computed 
         [0000]      {p 1i } ⊂ P. 
         [0071]    One of them is the true plaintext p. Let the true x be in X i  for some i. Let x i  be the chosen above representative of this class. From the definition of X i    
         [0000]      ( c   0   ,c   1 )=ƒ k     i   ( x   i   ,p ). 
         [0072]    From this equation and formula (6) we get p=p 1i . 
       Remark 1: Example of Using the Theorem 
       [0073]    Let m by any natural number and Z/m i  be the set of all residues modulo m i . Z/m i  is identified with the set of natural numbers {0, 1, . . . m i −1}. Let: 
         [0000]        K   0   =X=Z/m,  and  K   1   =P=Z/m   s , and  C=Z/m   s+1    
         [0000]    for some natural number s. The padded plaintext x,p is identified with the number p x =x+pmεZ/m s+1  and for kεK we get k=k 0 +k 1 m, where k 0 εZ/m and k 1 εZ/m s . 
         [0074]    Let one get the ciphertext c=c 0 +c 1 m, where c 0 εZ/m and c 1 εZ/m s  by the rule 
         [0000]        c≡p   x   +k (mod  m   s+1 ).  (7) 
         [0075]    The necessary condition will be shown as violated for such an encryption function in the following. The formula (7) is rewritten as 
         [0000]        c   0   ≡k   0   +x (mod  m ), 
         [0000]        c   1   ≡k   1   +p+s ( k   0   ,x )(mod  m   s ), 
         [0000]    where s(k 0 ,x) is the carrier, so s(k 0 ,x)=0 or m. It is assumed that k o ≠0. It implies that 
         [0000]        U ( c   0   ,k   1   ,p )={ k   1   +p,k   1   +p+m}.    
         [0076]    It is easy to define the terms of the partition Z/m=X 1 ∪X 2 , that is to find representatives for classes, which are 0 and m−1. Therefore the Theorem shows that such an encryption function is insecure. To clarify this, an application of the algorithm described in the proof of the Theorem is given. For chosen representatives of the classes one gets two possibilities 
         [0000]      (0 ,p )+( k   0   ,k   1 )=( k   0   ,k   1   +p )=( c   0   ,c   1 ) 
         [0000]    and so k 1 ≡c 1 −p(mod m s ), or 
         [0000]      ( m− 1 ,p )+( k   0   ,k   1 )=( k   0 −1 ,k   1   +p+ 1)=( c   0   ,c   1 ) 
         [0000]    and so k 1 ≡c 1 −p−1(mod m s ). Therefore it is found that 
         [0000]      k 1 ε{c 1 −p,c 1 −p−1}. 
         [0077]    On the average it is only needed one other pair of plaintext, ciphertext to compute the true k 1 . Knowing the true k 1  one finds from the above that 
         [0000]      pε{c 1 −k 1 ,c 1 −k 1 −1} 
         [0000]    then the true p is found using a criterion for the plaintext if there is any. 
         [0078]      FIG. 2  shows a receiver for implementing a general decryption method of the present invention. The decryption function h is the function relating to the encryption function g in  FIG. 1 . 
         [0079]    The similar cryptanalysis is applied to the cipher represented in  FIGS. 1 and 2 . For simplicity it is assumed that given any c 0 εC 0 , xεX, and yεY there exists only one k 0 εK 0  so that 
         [0000]        g ( x,k   0   ,y )=( c   0   ,y   1 )  (8) 
         [0000]    for some y 1 εY. 
         [0080]    For any fixed yεY and c 0 εC 0  the formula (8) defines a map X→Y such that x→y 1 . It is claimed that this map should be injective or close to that. Otherwise a method similar to that presented in the proof of the Theorem can be used to find (k 1 ,k 2  . . . ), which is the part of the working key. By similar reasons another two maps should be injective or close to that. They are: upon fixing any xεX and k 0 εK 0 , the formula (8) defines maps Y→C 0  such that y→c 0  and Y→Y such that y→y 1 . 
         [0081]    Let n be a natural number and m be a prime number such that 2 n−1 &lt;m&lt;2 n . To simplify the computation we take m=2 n −t, where t&lt;2 n/2 −2. Actually a small number for t like 1, 3, 5, . . . can be used. By V n  we denote the set of binary n-strings. Let Z/m be the set of residues modulo m, where Z/m is {0, 1, . . . , m−1}. The numbers bεZ/m are represented by binary n-strings as b=(b 0 ,b 1 , . . . , b n−1 ), where b=b 0 +b 1 2+ . . . +b n−1 2 n−1 , and Z/m ⊂ V n . 
       EMBODIMENT 1 
       [0082]      FIG. 3  shows an exemplary embodiment of the encryption function g of the encryption method for the sender in  FIG. 1 . A first pair is defined: X=Y=C 0 =K 0 =V n  and the encryption function g: V n ×V n ×V n →V n ×V n  is defined by: g(p i ,k i ,y i )=(p i ⊕ k i ⊕ y i ,g 1 (p i ,k i ,y i )) 
         [0000]    where y i+1 =g 1 (p i ,k i ,y i ) is the carrier function so that the ciphertext c i =p i ⊕ k i ⊕ y i  can be calculated. Here ⊕ denotes an XOR of binary strings in V n . 
         [0083]      FIG. 4  shows an exemplary embodiment of the decryption function h of the decryption method corresponding to the encryption method described in  FIG. 3 . 
         [0084]    The general function h: V n ×V n ×V n →V n ×V b  is defined by: h(c i ,k i ,y i )=(c i ⊕ k i ⊕ y i ,g 1 (c i ⊕ k i ⊕ y i ,k i ,y i )) 
         [0000]    where y i+1 =g 1 (p i ,k i ,y i ) is identical to the carrier function g 1  in the encryption function so that plaintext p i =c i ⊕ k i ⊕ y i  can be calculated. Also here ⊕ denotes the XOR of binary strings in V n . 
         [0085]      FIG. 5  shows an exemplary implementation of the carrier function g, in  FIGS. 3 and 4  of the present invention. For performing the encryption-decryption algorithm the carrier function g 1  is implemented by the following formula: 
         [0000]        y   i+1   =g   1 ( p   i   ,k   i   ,y   i )=( p   i   *S ( k   i ))⊕ ( S ( p   i )* y   i )⊕ ( k   i   *S ( y   i ))  (9) 
         [0086]    Here ⊕ denotes an XOR of binary strings in V n , being the set of all binary n-strings, and a*b is the multiplication modulo m=2 n −t, for a small odd natural number t (not specified here) of binary n-strings a and b represented as natural numbers. 
         [0087]    More specifically an XOR function is applied between the following terms to calculate g 1 :
       a modular multiplication between the block of plaintext p i  and the cyclic shift of the binary representation of k i ,   a modular multiplication between the cyclic shift of the binary representation of p i  and the block of carrier y i , and   a modular multiplication between the block of a working key k i  and the cyclic shift of the binary representation of y i .       
 
         [0091]    More specifically the results of the multiplication, being a natural number in Z/m, that is the set of natural numbers 0, 1, . . . , m−1, is represented again as a binary n-string, and S(x) denotes the cyclic shift of the binary representation of x to one position. That is 
         [0000]      (x 0 ,x 1 , . . . , x n−1 )→(x 1 , . . . , x n−1 ,x 0 ).  (10) 
         [0092]    For checking the necessary condition for the encryption-decryption algorithm in  FIGS. 3 and 4 , y=y 0  and c 0  are fixed and the size of the image of V n  is considered under the map 
         [0000]        x→y   1 =( x*S ( x⊕ c   0 ⊕ y 0 ))⊕ ( S ( x )* y   0 )⊕ (( x⊕ c   0 ⊕ y 0 )* S ( y   0 )). 
         [0093]    There are no reasons for why it should be much less than the size of V n  which is 2 n . The injectivity of a second map is trivial. A third map y→y 1 =(x*S(k 0 ))⊕ (S(x)*y)⊕ (k 0 *S(y)) for any fixed x and k 0  also looks close to be injective, with the exception x=k 0 =0. But it is very easy to avoid this case in the encryption algorithm. 
         [0094]    The function g 1 , given by formula (9), is a strong function and it is recommended in cases when the working key represented by blocks k i  is the repetition of only one k 0 ⊕ K 0 . That is k=(k 0 , k 0 , . . . ). But for the working key k=(k 0 ,k 1 , . . . , k s     0   ,k 0 ,k 1 , . . . , k s     0   , . . . ) 
         [0000]    where s 0 &gt;0, a simpler carrier function g 1  can be used. It is preferred to use for the one-way function φ the map 
         [0000]        x →(( x⊕ y   0 )*( x⊕ S   7 ( y   0 )))⊕ S 8 ( x ) 
         [0000]    and for the carrier function 
         [0000]        g   1 ( x,k   0   ,y )=( x⊕ S ( k   0 )⊕ S 2 ( y ))*( x⊕ S   3 ( k   0 )⊕ S 5 ( y ))⊕ S 6 ( k   0 )⊕ S 4 ( y ) 
         [0000]    where S i  is the composition of i shifts given by formula (10). It should be noted that φ is needed in order to produce k i  from k 0 . 
         [0095]    The triangular cipher with such an implantation is hereafter referred to as an additive triangular cipher. 
       EXAMPLE 1 
       [0096]    Let n=5 and m=31. Then 
         [0000]        x=x   0   x   1   x   2   x   3   x   4   =x   0   +x   1 2 +x   2 2 2   +x   3  2 3   +x   4 2 4 , 
         [0000]    for binary x i . The shift is 
         [0000]        x→S ( x ) 
         [0000]      x 0 x 1 x 2 x 3 x 4 →x 1 x 2 x 3 x 4 x 0 . 
         [0097]    The encryption algorithm as shown in  FIG. 3  is 
         [0000]        g ( p   i   ,k   i   ,y   i )=( p   i ⊕ k i ⊕ y i   ,g   1 ( p   i   ,k   i   ,y   i )), 
         [0000]    where formula (10) is the carrier function. The element y 0  is public and may be considered as a part of the cipher. 
         [0098]    Put y 0 =10101=21. The plaintext p 1 ,p 2 ,p 3 , . . . is 
         [0000]      23,17,12, . . . =11101,10001,00110, . . . 
         [0099]    The key sequence k 0 , k 1 , k 2 , k 3 , . . . is 
         [0000]      15,29,6,13, . . . =11110,10111,01100,10110, . . . 
       Encryption: 
       [0100]    The sender produces the secret padding code x=p 0 =11=11010 and computes 
         [0000]      c 0 =p 0 ⊕ k 0 ⊕ y 0 =11⊕ 15⊕ 21=17 
         [0000]      because 
         [0000]      c 0 =11⊕ 15⊕ 21=11010⊕ 11110⊕ 10101=10001=17 
         [0000]    bitwise. Then 
         [0000]                    y   1     =              g   1          (       p   0     ,     k   0     ,     y   0       )                   =              g   1          (     11   ,   15   ,   21     )                   =              (     11   *     S        (   15   )         )     ⊕     (       S        (   11   )       *   21     )     ⊕     (     15   *     S        (   21   )         )                   =              (     11   *   23     )     ⊕     (     21   *   21     )     ⊕     (     15   *   26     )                   =            5   ⊕   7   ⊕   18                 =            10100   ⊕   11100   ⊕   01001                 =          00001                 =          16     ,               because 
         [0000]        S (15)= S (11110)=11101=23, 
         [0000]        S (11)= S (11010)=10101=21, 
         [0000]        S (21)= S (10101)=01011=26. 
         [0101]    At this point the sender discards the secret pad x. Then he computes 
         [0000]      c 1 =p 1 ⊕ k 1 ⊕ y 1 =23⊕ 29⊕ 16=26. 
         [0000]      and similarly 
         [0000]        y   2   =g   1 ( p   1   ,k   1   ,y   1 )= g   1 (23,29,16)=(23 *S (29))⊕ ( S (23)*16)⊕ (29 *S (16))=(23*30)⊕ (27*16)⊕ (29*8)=8⊕ 29⊕ 5=26. 
         [0000]      Then 
         [0000]      c 2 =p 2 ⊕ k 2 ⊕ y 2 =17⊕ 6⊕ 26=13 
         [0000]      and 
         [0000]        y   3   =g   1 ( p   2   ,k   2   ,y   2 )= g   1 (17,6,26)=(17 *S (6))⊕ ( S (17)*26)⊕ (6 *S (26))=(17*3)⊕ (24*26)⊕ (6*13)=20⊕ 4⊕ 16=0 
         [0000]      Then 
         [0000]      c 3 =p 3 ⊕ k 3 ⊕ y 3 =12⊕ 13⊕ 0=1 
         [0000]      and 
         [0000]        y   4   =g   1 ( p   3   ,k   3   ,y   3 )= g   1 (12,13,0)=(12 *S (13))⊕ ( S (12)*0)⊕ (13 *S (0))=(12*22)=16, 
         [0000]    and so on. Finally, the ciphertext c 0 ,c 1 ,c 2 ,c 3 , . . . is 
         [0000]      17,26,13,1 . . . =10001,01011,10110,10000, . . . . 
       Decryption: 
       [0102]    The receiver gets the ciphertext c 0 ,c 1 ,c 2 ,c 3 , . . . : 
         [0000]      17,26,13,1 . . . =10001,01011,10110,10000, . . . . 
         [0103]    Said receiver has the working key sequence k 0 ,k 1 ,k 2 ,k 3 , . . . : 
         [0000]      15,29,6,13, . . . =11110,10111,01100,10110, . . . 
         [0000]    and the initial value y 0 =10101=21. The receiver computes 
         [0000]      p 0 =x=c 0 ⊕ k 0 ⊕ y 0 =17⊕ 15⊕ 21=11 
         [0000]      and 
         [0000]        y   1   =g   1 ( p   0   ,k   0   ,y   0 )= g   1 (11,15,21)=16 
         [0000]    as above. At this point the receiver discards the secret padding code x. Then he computes 
         [0000]      p 1 =c 1 ⊕ k 1 ⊕ y 1 =26⊕ 29⊕ 16=23 
         [0000]      and 
         [0000]        y   2   =g   1 ( p   1   ,k   1   ,y   1 )= g   1 (23,29,16)=26. 
         [0000]      Then 
         [0000]      p 2 =c 2 ⊕ k 2 ⊕ y 2 =130⊕ 6⊕ 26=17 
         [0000]      and 
         [0000]        y   3   =g   1 ( p   2   ,k   2   ,y   2 )= g   1 (17,6,26)=0. 
         [0000]      Then 
         [0000]      p 3 =c 3 ⊕ k 3 ⊕ y 3 =1⊕ 13⊕ 0=12 
         [0000]      and 
         [0000]        y   4   =g   1 ( p   3   ,k   3   ,y   3 )= g   1 (12,13,0)=16. 
         [0104]    The result of this procedure will give the original plaintext. 
       EMBODIMENT 2 
       [0105]      FIG. 6  shows a further exemplary embodiment of the encryption function g of the encryption method described in  FIG. 1  of the present invention. 
         [0106]    A second pair is defined: X=Y=C 0 =V n  and K 0 =Z*/m, where Z*/m is the set of all nonzero residues modulo m. So 
         [0000]        g,h:V   n   ×Z*/m×V   n   →V   n   ×V   n .  (11) 
         [0107]    To implement the computation g(p i ,k i ,y i )=(c i ,y i+1 ), the function g 2  is considered: g 2 :Z*/m×V n →V n ×V n  so that g 2 (k i ,z i )=(d i ,y i+1 ), where z i =p i ⊕ y i , where z i  is an intermediate variable. Then, (c i ,y i+1 )=(d i ⊕ y i ,y i+1 ). The function g 2  is computed by the following rule: 
         [0108]    If z i εV n \Z/m, or in other words z i ≧m, then d i =z i  and y i+1 =k i ⊕ y i . If z i εZ/m, or in other words z i &lt;m, d i ,y i+1  come from the multiplication of integer numbers k i  and z i  such that 
         [0000]        k   i   z   i   =d   i   +y   i+1   m.   (12) 
         [0109]    In this case, d i ,y i+1 εZ/m are computed with the algorithm:
       1. Compute k i z i =u 0 +u 1 2 n , where the integer number u 0  represents the first n bits of the product k i z i  and u 1  represents the last bits of it.   2. Compute u 0 +u 1 t=u 0 ′+u 1 ′2″, where the integer number u 0 ′ represents the first n bits of u 0 +u 1 t and u 1 ′ represents the last bits of it.   3. Compute v=u 0 ′+u 1 ′t and u=u 1 +u 1 ′. If v&lt;m, then d i =v, and y i+1 =u. If v≧m, then d i =v−m and y i+1 =u+1.       
 
         [0113]    More specifically, z i  equals the XOR of the block of the plaintext p i  and the carrier y i , so that if z i ≧m, in the representation of z i  as a natural number, then d i =z i , and y i+1  equals the XOR of the block of the working key k i  and the carrier y i , and otherwise the product k i z i  of representations of k i ,z i  as natural numbers is computed, where d i  and y i+1  are the first and second m-adic digits of said product such that k i z i =d i +y i+1 m. 
         [0114]    In order to compute d i ,y i+1  the representation k i z i =u 0 +u 1 2 n  is computed, where the natural number u 0  represents n the least significant bits of the product k i z i  and u 1  represents the last most significant bits of it. Then, u 0 +u 1 t, where t=2 n −m, is computed and is represented as u 0 ′+u 1 ′2 n , where the integer number u 0 ′ represents n the least significant bits of u 0 +u 1 t and u 1 ′ represents the last most significant bits of it. Then, the numbers v=u 0 ′+u 1 ′t and u=u 1 +u 1 ′ are computed. If v&lt;m, then d i =v, and y i+1 =u. If v≧m, then d i =v−m and y i+1 =u+1. Finally, in both cases, the block of the ciphertext c i  is computed as the XOR of d i  and y i . 
         [0115]      FIG. 7  shows a further exemplary embodiment of the decryption function h of the encryption method described in  FIG. 1  of the present invention. 
         [0116]    To implement the computation h(c i ,k i ,y i )=(p i ,y i+1 ), the function h 2  is considered: h 2 :Z*/m×V n →V n ×V n  so that h 2 (k i ,d i )=(z i ,y i+1 ), where d i =c i ⊕ y i . Then, (p i ,y i+1 )=(z i ⊕ y i ,y i+1 ). The function h 2  is computed by the rule: 
         [0117]    If d i εV n \Z/m, or in other words d i ≧m, then z i =d i  and y i+1 =k i ⊕ y i , and if d i εZ/m, or in other words d i &lt;m, then z i ,y i+1  come from formula (12), where k i ,d i ,m are known, and computed by the following algorithm. 
         [0118]    The algorithm uses three auxiliary strings A, B, C of integer numbers, where A=(a 1 ,a 2 ,a 3 ) and B=(b 1 ,b 2 ,b 3 ) are changing during the computation and [a] 0  denotes the least significant bit of a. 
         [0000]        A ←(0 ,m−d   i ),  B ←( d   i   ,k   i ,0),  C ←( m, 0 ,k   i ) 
         [0000]    while a 2 &gt;1 do
 
if a 2 &lt;b 2  then A         B
 
if [b 2 ] 0 =0 then A         B
 
         [0000]        A ←( A−[a   2 ] 0   B −([ a   1 ] 0   −[a   2 ] 0   [b   1 ] 0 ) C )/2 
         [0000]    if a 1 &lt;0 then A←A+C
 
return z i ←a 1 , y i+1 ←a 3  
 
         [0119]    The triangular cipher with such an implantation is hereafter referred to as a multiplicative triangular cipher. 
         [0120]    More specifically, h is determined by defining the function h 2 (k i ,d i )=(z i ,y i+1 ), where d i  equals the XOR of the block of the ciphertext c i  and the carrier y i , so that if d i ≧m, in the representation of d i  as a natural number, then z i =d i  and y i+1  equals the XOR of the block of the working key k i  and the carrier y i . Otherwise, in order to compute z i  and y i+1 , the four auxiliary 3-strings of integer numbers A, B, C and D are defined, where A, B, D change during computation. The strings are initialized as A=(0,m,−d i ), B=(d i ,k i ,0) and C=(m,0,k i ). The following step is repeated until a 2 =1, then z i =a 1  and y i+1 =a 3 . Otherwise, if a 2 &lt;b 2 , then D=A, A=B and B=D is done, and if [b 2 ] 0 =0, then D=A, A=B and B=D. The string D=(A−[a 2 ] 0 B−([a 1 ] 0 −[a 2 ] 0 [b 1 ] 0 )C)/2 is then computed and A=D. After that if a 1 &lt;0 then D=A+C and A=D. Finally, in both cases, the block of plaintext p i  is computed as the XOR of z i  and y i . 
         [0121]    The discussion of the necessary conditions for this multiplicative method to be secure is similar to that for the above-mentioned additive triangular cipher. 
       EXAMPLE 2 
       [0122]    Let n=5 and m=31. The encryption-decryption algorithm is as on  FIGS. 4 and 5 , that is to compute g(p i ,k i ,y i )=(c i ,y i+1 ). 
         [0123]    Let y 0 =10101=21, this value is a fixed part of the cipher. The plaintext p 1 ,p 2 ,p 3 , . . . is 
         [0000]      23,17,12, . . . 
         [0124]    The key sequence k 0 , k 1 , k 2 , k 3  is 
         [0000]      15,29,6,13, . . . 
       Encryption: 
       [0125]    The sender produces the secret padding code x=p 0 =11=11010 and computes 
         [0000]      z 0 =p 0 ⊕ y 0 =11⊕  21 = 30 . 
         [0126]    Because 30εZ/31, the sender finds the product 
         [0000]        k   0   z   0 =15×30=450=16+14×31, 
         [0000]    so (d 0 ,y 1 )=g 2 (k 0 ,z 0 )=g 2 (15,30)=(16,14) and 
         [0000]      c 0 =d 0 ⊕ y 0 =16⊕ 21=5. 
         [0000]      Then 
         [0000]      z 1 =p 1 ⊕ y 1 =23⊕ 14=25. 
         [0127]    Because 25εZ/31, the sender finds the product 
         [0000]        k   1   z   1 =29×25=725=12+23×31, 
         [0000]    so (d 1 ,y 2 )=g 2 (29,25) (12,23) and 
         [0000]      c 1 =d 1 ⊕ y 1 =12⊕ 14=2. 
         [0000]      Then 
         [0000]      z 2 =p 2 ⊕ y 2 =17⊕ 23=6. 
         [0128]    Because 6εZ/31, the sender finds the product 
         [0000]        k   2   z   2 =6×6=36=5+1×31 
         [0000]    so (d 2 ,y 3 )=g 2 (6,6)=(5,1) and 
         [0000]      c 2 =d 2 ⊕ y 2=5⊕ 23=18    
         [0000]      Then 
         [0000]      z 3 =p 3 ⊕ y 3 =12⊕ 1=13. 
         [0129]    Because 13εZ/31, the sender finds the product 
         [0000]        k   3   z   3 =13×13=169=14+5×31, 
         [0000]    so (d 3 ,y 4 )=g 2 (13,13)=(14,5) and 
         [0000]      c 3 =d 3 ⊕ y 3 =14⊕ 1=15, 
         [0000]    and so on. So the ciphertext c 0 ,c 1 , c 2 ,c 3 , . . . is 
         [0000]      5,2,18,15, . . . 
       Decryption: 
       [0130]    The receiver has the key sequence k 0 ,k 1 ,k 2 ,k 3 , . . . : 
         [0000]      15,29,6,13, . . . 
         [0131]    Then the receiver gets the ciphertext c 0 , c 1 , c 2 ,c 3 , . . . : 
         [0000]      5,2,18,15, . . . . 
         [0000]    from the sender. 
         [0132]    The receiver computes 
         [0000]      d 0 =c 0 ⊕ y 0 =5⊕ 21=16 
         [0000]    and finds z 0 ,y 1  from 15z 0 =16+y 1 31, so (z 0 ,y 1 )=h 2 (15,16)=(16,14) and p 0 =x=z 0 ⊕ y 0 =30⊕ 21=11. At this point the sender discards x. Then the receiver computes 
         [0000]      d 1 =c 1 ⊕ y 1 =2⊕ 14=12 
         [0000]    and finds z 1 ,y 2  from 29z 1 =12+y 2 31, so (z 1 ,y 2 )=h 2l ( 29,12)=(25,23) and p 0 =z 1 ⊕ y 1 =25⊕ 4=23. At this point the sender discards x. Then the receiver computes 
         [0000]      d 2 =c 2 ⊕ y 2 =18⊕ 23=5 
         [0000]    and finds z 2 ,y 3  from 6z 1 =5+y 2 31, so (z 2 ,y 3 )=h 2 (6,5)=(6,1) and p 2 =z 2⊕ y   2 =6⊕ 23=17. Then the receiver computes 
         [0000]      d 3 =c 3 ⊕ y 3 =15⊕ 1=14 
         [0000]    and finds z 3 ,y 4  from 13z 3 =14+y 4 31, so (z 3 ,y 4 )=h 2 (13,14)=(13,5) and p 3 =z 3 ⊕ y 3 =13⊕ 1=12.