(19)
(11)EP 1 875 405 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
27.11.2013 Bulletin 2013/48

(21)Application number: 06711294.6

(22)Date of filing:  09.03.2006
(51)Int. Cl.: 
H04L 9/18  (2006.01)
(86)International application number:
PCT/IL2006/000312
(87)International publication number:
WO 2006/111950 (26.10.2006 Gazette  2006/43)

(54)

IMPROVED CIPHER SYSTEM

VERBESSERTES CHIFFRE-SYSTEM

SYSTEME DE CHIFFREMENT AMELIORE


(84)Designated Contracting States:
AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

(30)Priority: 20.04.2005 IL 16815205
06.09.2005 IL 17070305

(43)Date of publication of application:
09.01.2008 Bulletin 2008/02

(73)Proprietor: NDS Limited
Staines, Middlesex TW18 4EX (GB)

(72)Inventors:
  • MANTIN, Itsik
    73412 Shoham (IL)
  • SELLA, Yaron
    POB 4232 Yehud (IL)
  • WAISBARD,Erez
    60401 Or-Yehuda (IL)

(74)Representative: Watterson, Peer Marten John 
Marks & Clerk (Luxembourg) LLP 44 rue de la Vallée B.P. 1775
1017 Luxembourg
1017 Luxembourg (LU)


(56)References cited: : 
WO-A1-00/25476
US-A1- 2004 086 117
US-A1- 2002 176 572
  
      
    Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


    Description

    FIELD OF THE INVENTION



    [0001] The present invention relates to stream ciphers and in particular it relates to pseudo-random number generators for use with stream ciphers.

    BACKGROUND OF THE INVENTION



    [0002] A stream cipher is a system for encryption and decryption of digital data.

    [0003] Reference is now made to Fig. 1, which is a stream cipher 10. The stream cipher 10 usually employs a pseudo-random number generator 12 (PRNG) in the following way. The pseudo-random number generator 12 is typically fed with a key 14 (K) and an initial value 16 (IV) and generally derives there from a keystream 18 (KS) of arbitrary length. The encryption of a plaintext 20 is typically the result of an exclusive-OR (XOR) operation, performed by a combiner 21, on the plaintext 20 and a corresponding prefix of the keystream 18 thus providing ciphertext 22. Similarly, the decryption of the ciphertext 22 is typically the result of an XOR operation when performed on the ciphertext 22 and a corresponding prefix of the keystream 18 thus providing the plaintext 20. The combiner 21 has been described herein as an XOR combiner. However, it will be appreciated by those ordinarily skilled in the art that other suitable combiners can be used, for example, but not limited to, an additive combiner.

    [0004] Reference is now made to Fig. 2, which is a detailed view of pseudo-random number generator 12 of the stream cipher 10 of Fig. 1. Many stream ciphers are based on a secret internal state 30 and on three modules. The three modules typically include an initialization module 24, a state update module 26 and an output word module 28. The initialization module 24 is typically used at initialization for translating the IV 16 and the key 14 into an initial state. Then, the cipher 10 generally enters a loop where the state update module 26 updates the state 30 and the output word module 28 uses the updated state 30 to output a next word of the keystream 18. The cipher 10 preferably continues performing the loop until a sufficiently long keystream 18 is emitted.

    [0005] The output word is typically a bit (as in LFSR-based stream ciphers), a byte (as in RC4), or a block of any length.

    [0006] Stream ciphers are also known as state ciphers, since they usually maintain an internal state.

    [0007] In some cases the initialization module 24 takes as input only the key 14 (K), whereas in other cases the initialization module 24 takes as input the key 14 (K) and the IV 16.

    [0008] Some known stream ciphers are:

    "RC4", described in more detail in "Analysis methods for (Alleged) RC4" by Lars R. Knudsen, Willi Meier, Bart Preneel, Vincent Rijmen and Sven Verdoolaege of the Department of Informatics, University of Bergen, Bergen also available at www.cosic.esat.kuleuven.be/publications/article-68.pdf;

    "RC4A", described in more detail in "A New Weakness in the RC4 Keystream Generator and an Approach to Improve the Security of the Cipher," in Fast Software Encryption, FSE 2004, Lecture Notes in Computer Science 3017, Bimal Roy, Willi Meier (Eds.), Springer-Verlag, 2004, pp. 245 - 259, available via www.esat.kuleuven.be/∼psourady/papers.html;

    "VMPC", described in more detail in "VMPC One-Way Function and Stream Cipher" by Bartosz Zoltak presented at FSE'04, Delhi, India, 5-7 February 2004, available at www.vmpcfunction.com/vmpc.pdf;

    "SEAL", described in more detail in "Handbook of Applied Cryptography" by Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, published by CRC Press; and

    "A5/1", described in more detail in "Real Time Cryptanalysis of A5/1 on a PC" by Alex Biryukov, Adi Shamir and David Wagner presented at the FSE Workshop 2000, April 10-12, 2000, New York, NY USA, available at cryptome.org/a51-bsw.htm.



    [0009] A table-shuffle stream cipher is a stream cipher generally having a certain structure of the state 30 and the state update module 26. In a table-shuffle stream cipher, the pseudo-random number generator 12 preferably maintains the state 30 including a stream cipher table of size N. The contents of the table are typically numbered between zero and N-1, permuted in some order. The main part of the secrecy of the state resides in the permutation. In addition, the table generally comprises a set of indices for the table, namely numbers between 0 and N-1 inclusive. The indices are typically divided into traversal indices and pseudo-random indices, differing in the way they are updated by the state update module 26.

    [0010] The state update module 26 of a table-shuffle stream cipher preferably updates pseudo-random indices in a way that depends on the order of the values in the table, and updates traversal indices in a way that is independent of the order of the values in the table when the update takes place. The values in the table entries that are pointed to by the indices are referred to as the "refresh set". The state update module 26 preferably updates the table by permuting the values in the refresh set, namely values in the refresh set may change places with other values in the refresh set.

    [0011] The state 30 of a table-shuffle stream cipher may comprise several tables with equal or different sizes. In that case, every index typically points to one or more tables and the refresh set can include values from several tables. In most of the cases the state update module 26 generally only moves values inside the tables, but does not move values between the tables.

    [0012] The following is an example according to the RC4 stream cipher system, which operates with one table of 256 entries, one traversal index, i, and one pseudo-random index, j. To generate an output word, the following is preferably performed.

    [0013] First, a state update is preferably performed by performing the following two updates:


    and


    where S [x] is the value in the xth location of the table.

    [0014] S[i] and S[j] are the refresh set of the state update module 26.

    [0015] Then S[i] and S[j] are typically swapped with each other.

    [0016] Therefore, the state update generally takes an input state and provides a (usually slightly) different output state.

    [0017] Next, the output word module 28 preferably performs the following on the state 30:


    determine S[t] as the output word.

    [0018] In other words the calculation of the output word can be represented by:



    [0019] Table-shuffle stream ciphers (including RC4) are described in more detail with reference to Applied Cryptography by Bruce Schneier, published by John Wiley & Sons, Inc. in 1996 page 397-398.

    [0020] Patents in the related art include US Patent 6,785,389 to Sella, et al.

    [0021] US 2004/086117 discloses a stream cipher system in accordance with the pre-characterising portion of claim 1.

    SUMMARY OF THE INVENTION



    [0022] The present invention seeks to provide an improved stream cipher.

    [0023] The system and method of the present invention, in preferred embodiments thereof, apart from providing an improved stream cipher, typically lends itself to strengthening other known cipher systems and methods.

    [0024] The system of the present invention, in preferred embodiments thereof, includes an improved stream cipher employing at least one dynamic constant for updating the state and/or producing an output word, and/or initializing the extended state, and/or updating the dynamic constants. The dynamic constant(s) are only updated after a minority of the state update/ output word generation rounds. In accordance with a preferred embodiment, a table-shuffle stream cipher system is described.

    [0025] There is thus provided in accordance with a first aspect of the present invention a system as defined in claim 1.

    [0026] Still further in accordance with a preferred embodiment of the present invention the combiner is an encryption combiner to convert from plaintext to ciphertext based on the key stream.

    [0027] Additionally in accordance with a preferred embodiment of the present invention the combiner is a decryption combiner to convert from ciphertext to plaintext based on the key stream.

    [0028] Moreover in accordance with a preferred embodiment of the present invention the update dynamic constant module is adapted to update the at least one dynamic constant such that a new value of the dynamic constant is at least biased away from at least one undesirable value.

    [0029] Further in accordance with a preferred embodiment of the present invention the new value is determined to exclude the at least one undesirable value.

    [0030] Still further in accordance with a preferred embodiment of the present invention when the at least one dynamic constant is used as a multiplier, the at least one undesirable value includes zero.

    [0031] Additionally in accordance with a preferred embodiment of the present invention the at least one dynamic constant includes two dynamic constants, and when a sum of the two dynamic constants is used as a multiplier, the at least one undesirable value is chosen such that the sum of the two dynamic constants is not equal to zero.

    [0032] Moreover in accordance with a preferred embodiment of the present invention the update dynamic constant module is adapted to update the at least one dynamic constant as a function of the extended state.

    [0033] Further in accordance with a preferred embodiment of the present invention the update dynamic constant module is adapted to update the at least one dynamic constant as a function of the at least one dynamic constant

    [0034] Still further in accordance with a preferred embodiment of the present invention the update dynamic constant module is adapted to update the at least one dynamic constant when a condition is satisfied in the reduced state.

    [0035] Additionally in accordance with a preferred embodiment of the present invention the state update module is adapted to XOR a temporal result of the update of the reduced state with the at least one dynamic constant

    [0036] Moreover in accordance with a preferred embodiment of the present invention the state update module is adapted to add the at least one dynamic constant to a temporal result of the update of the reduced state.

    [0037] Further in accordance with a preferred embodiment of the present invention the state update module is adapted to subtract the at least one dynamic constant from a temporal result of the update of the reduced state.

    [0038] Still further in accordance with a preferred embodiment of the present invention the state update module is adapted to multiply the at least one dynamic constant with a temporal result of the update of the reduced state.

    [0039] Additionally in accordance with a preferred embodiment of the present invention the state update module is adapted to update the reduced state by determining a new value of the reduced state such that the new value is at least biased away from at least one undesirable value.

    [0040] Moreover in accordance with a preferred embodiment of the present invention the state update module is adapted to determine the new value such that the new value excludes the at least one undesirable value.

    [0041] Still further in accordance with a preferred embodiment of the present invention the update dynamic constant module is adapted to update the at least one dynamic constant every N of the rounds.

    [0042] Additionally in accordance with a preferred embodiment of the present invention the state update module is adapted to update the at least one traversal index by adding, or subtracting, the at least one dynamic constant to, or from, the at least one traversal index, respectively.

    [0043] Moreover in accordance with a preferred embodiment of the present invention the at least one dynamic constant is an integer which is determined such that the at least one dynamic constant equals N divided by the sum of b and C, wherein a greatest common divisor of the at least one dynamic constant and N is 1, b is less than 5 and is a positive divider of N, and C is one of less than 5 or greater than N-5.

    [0044] Further in accordance with a preferred embodiment of the present invention the state update module is further adapted to update the at least one pseudo-random index as a function of the at least one dynamic constant

    [0045] Still further in accordance with a preferred embodiment of the present invention the at least one dynamic constant is in the range of zero to N-1.

    [0046] Additionally in accordance with a preferred embodiment of the present invention the state update module is adapted to XOR a temporal result of the update of the at least one pseudo-random index with the at least one dynamic constant.

    [0047] Moreover in accordance with a preferred embodiment of the present invention the state update module is adapted to add the at least one dynamic constant to a temporal result of the update of the at least one pseudo random index.

    [0048] Further in accordance with a preferred embodiment of the present invention the state update module is adapted to subtract the at least one dynamic constant from a temporal result of the update of the at least one pseudo random index.

    [0049] Still further in accordance with a preferred embodiment of the present invention the state update module is adapted to multiply the at least one dynamic constant with a temporal result of the update of the at least one pseudo random index.

    [0050] Additionally in accordance with a preferred embodiment of the present invention the state update module is adapted to update the reduced state by determining a new value of the at least one pseudo-random index such that the new value is at least biased away from at least one undesirable value of the pseudo-random index.

    [0051] Moreover in accordance with a preferred embodiment of the present invention the state update module is adapted to determine the new value such that the new value excludes the at least one undesirable value of the pseudo-random index.

    [0052] Further in accordance with a preferred embodiment of the present invention the at least one undesirable value is a number between 0 and 5.

    [0053] Still further in accordance with a preferred embodiment of the present invention the at least one undesirable value is a number between N-5 and N-1.

    [0054] Additionally in accordance with a preferred embodiment of the present invention the at least one undesirable value is a number which is greater than N/5, and the at least one undesirable value and N have a common divisor.

    [0055] Moreover in accordance with a preferred embodiment of the present invention the output word module is further adapted to generate the one output word as a function of the at least one dynamic constant.

    [0056] Further in accordance with a preferred embodiment of the present invention the at least one dynamic constant is in the range of zero to N-1.

    [0057] Still further in accordance with a preferred embodiment of the present invention the output word module is adapted to XOR a temporal result of the generation of the one output word with the at least one dynamic constant.

    [0058] Additionally in accordance with a preferred embodiment of the present invention the output word module is adapted to add the at least one dynamic constant to a temporal result of the generation of the one output word.

    [0059] Moreover in accordance with a preferred embodiment of the present invention the output word module is adapted to subtract the at least one dynamic constant from a temporal result of the generation of the one output word.

    [0060] Further in accordance with a preferred embodiment of the present invention the output word module is adapted to multiply the at least one dynamic constant with a temporal result of the generation of the one output word.

    [0061] Still further in accordance with a preferred embodiment of the present invention the initialization module is adapted to initialize the at least part of the extended state as a function of the at least one dynamic constant.

    [0062] Additionally in accordance with a preferred embodiment of the present invention the reduced state includes a table of a size N having a plurality of entries and a plurality of indices, the initialization module being adapted to initialize the extended state by an initialization process that includes two nested loops having an external loop and an internal loop, the external loop being repeated C1 times, the internal loop being repeated C2 times, a total number of iterations of the initialization process being at least the size of the table such that C1 multiplied by C2 is at least equal to N, the at least one dynamic constant being updated in the external loop, at least one of the entries being updated in the internal loop as a function of the at least one dynamic constant updated in the external loop.

    [0063] Moreover in accordance with a preferred embodiment of the present invention the at least one entry updated in the internal loop is updated as a function of the Key, at least one of the indices, and at least one of the entries.

    [0064] Further in accordance with a preferred embodiment of the present invention the at least one dynamic constant updated in the external loop is updated as a function of the Initial Value and a minimum of N and C2 multiplied by a current number of iterations made by the external loop.

    [0065] In accordance with a second aspect of the present invention there is provided a method for encrypting/decrypting data as defined in claim 16.

    BRIEF DESCRIPTION OF THE DRAWINGS



    [0066] The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which:

    Fig. 1 is a stream cipher system;

    Fig. 2 is a detailed view of a PRNG of the stream cipher system of Fig. 1; and

    Fig. 3 is a stream cipher system constructed and operative in accordance with a preferred embodiment of the present invention.


    DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT



    [0067] Reference is now made to Fig. 3, which is a stream cipher 36.

    [0068] The stream cipher 36 typically includes a pseudo-random number generator 37 and a combiner 58. The pseudo-random number generator 37 preferable has an initialization module 38, a state update module 40, an output word module 42 and an update dynamic constant (DC) module 44.

    [0069] The stream cipher 36 typically includes a register to store a state 46 and one or more dynamic constants 48 (DCs). The state 46 without the DCs 48 is generally referred to herein as a "reduced state". The state 46 together with the DCs 48 is generally referred to herein as an "extended state".

    [0070] In Fig. 3, white rectangles represent modules (for performing a process) and pentagons and rounded rectangles represent data. Thin arrows represent passing control from one module to another. Thick arrows represent the affect of a module on data, or a data on a module. For example, the DC update module 44 preferably affects the DC 48 and the update DC module 44 is preferably affected by the DC 48. By way of another example, the state update module 40 preferably affects the state 46 and is preferably affected by the DC 48 and the state 46.

    [0071] The state update module 40 is generally adapted to update the reduced state. The output word module 42 is generally adapted to generate a plurality of output words thereby forming a keystream 54. The combiner 58 is generally adapted to convert from an input data sequence 56 to an output data sequence 60 based on the keystream 54. The state update module 40, the output word module 42 and the combiner 58 are preferably adapted to operate through a plurality of cyclical rounds. Each of the rounds typically includes updating the reduced state by the state update module 40, then preferably generating one output word by the output word module 42 and then combining the generated output word with one or more bits of the input data sequence 56 by the combiner 58.

    [0072] When the input data sequence 56 is plaintext, the combiner 58 is an encryption combiner and the output data sequence 60 is ciphertext. Therefore, the encryption combiner converts from plaintext to ciphertext based on the keystream 54. The encryption combiner performs a function that is invertible in one of its parameters. In other words, for the function f there exists an inverse F such that for every X and Y, F(X, f(X, Y)) = Y.

    [0073] Conversely, when the input data sequence 56 is ciphertext, the combiner 58 is a decryption combiner and the output data sequence 60 is plaintext. Therefore, the decryption combiner converts from ciphertext to plaintext based on the keystream 54. The decryption combiner performs a function which is the inverse of the function performed by the encryption combiner.

    [0074] The combiner 58 is preferably an XOR combiner. However, it will be appreciated by those ordinarily skilled in the art that other suitable combiners can be used, for example, but not limited to, an additive combiner.

    [0075] A dynamic constant is a parameter that preferably has the following properties. First, in a majority (typically over 50%, preferably between 80% and 100%) of rounds, the updating of the reduced state by the state update module 40, and/or the generation of the output words by the output word module 42, and/or the combining the output words with plaintext/ciphertext, is based on one or more of the dynamic constants 48. Second, in a majority (typically over 50%, preferably between 80% and 100%) of the rounds the dynamic constant(s) 48 used in the updating of the reduced state, and/or the generation of the output words, and/or the combining the output words with plaintext/ciphertext, are unchanged. In other words, in a minority (typically up to 50%, preferably between 0% and 20%) of the rounds the DCs 48 used in the updating of the reduced state, and/or the generation of the output words, and/or the combining the output words with plaintext/ciphertext, are updated.

    [0076] The dynamic constant 48 optionally has one or more "undesirable" or "forbidden" values, either separately (for example, but not limited to, a dynamic constant that is used as a multiplier has an undesirable value including zero) or in combination (for example, but not limited to, when the sum of two DCs 48 is used as a multiplier, the undesirable value(s) is chosen such that the sum does not equal zero).

    [0077] Therefore, the update DC module 44 is preferably adapted to update the DC 48 such that a new value of the DC 48 is at least biased away from one or more undesirable values. Preferably, the new value of the DC 48 is determined to exclude the undesirable value(s).

    [0078] When one or more dynamic constants have forbidden values, separately or in combination, the update DC module 44 preferably avoids the forbidden values. For example, the update DC module 44 checks after the update that the new values of the dynamic constants are not forbidden and re-updates the DC(s) 48 if the new values are forbidden.

    [0079] In accordance with a preferred embodiment of the present invention the update DC module 44 generally uses the state 46 and the DCs 48 (in other words the extended state) to update the DCs 48.

    [0080] The initialization module 38 typically initializes the extended state which includes the DCs 48 and the state 46. In accordance with the most preferred embodiment of the present invention, the DCs 48 are preferably initialized to pseudo-random values based on a key 50 and/or an IV 52.

    [0081] The state update module 40 preferably uses one or more of the DCs 48 as constants in order to update the state 46. The state update module preferably does not update the DCs 48.

    [0082] The output word module 42 preferably uses one or more of the DCs 48 as constants in order to produce an output word. The output word module 42 preferably does not update the DCs 48.

    [0083] The combiner 58 preferably uses one or more of the DCs 48 as constants in order to combine the keystream 54 with plaintext/ciphertext, as appropriate. The combiner 58 preferably does not update the DCs 48.

    [0084] After a certain number of rounds of updating the state 46, producing the output words, and combining the output words with plaintext/ciphertext, the update DC module 44 is preferably invoked in order to update the DC(s) 48.

    [0085] Additionally or alternatively, once a certain condition is satisfied in the internal state 46, the update DC module 44 is generally invoked in order to update the DC 48.

    [0086] Preferred times of when to invoke the update DC module 44 are: after a certain number of rounds, for example, but not limited to, after 256 rounds; and/or when a certain condition on the state 46 is satisfied, for example, but not limited to, when the lowest 4 bits of a certain byte of the state 46 are 1111.

    [0087] The table-shuffle stream cipher of the present invention generally includes many of the features of the stream cipher 36 and is therefore also described with reference to Fig. 3 as an exemplary embodiment of the stream cipher 36.

    [0088] The pseudo-random number generator 37 of the table-shuffle stream cipher 36 is generally adapted to maintain the state 46 having at least one stream cipher table having N entries, one or more traversal indices and one or more pseudo-random indices.

    [0089] The state update module 40 of the table-shuffle stream cipher 36 is now described in more detail.

    [0090] First the update of the traversal indices is described, then the update of the pseudo-random indices is described, and then the update of the rest of the state 46 is described.

    [0091] Updating of the traversal indices is now described in more detail.

    [0092] The state update module 40 generally updates each of the traversal indices, i, by performing the following function:


    where D is one of the dynamic constants 48, and N is the size of the table to which the traversal index points.

    [0093] Therefore, the state update module 40 is adapted to update (in other words determine a new value of) the traversal index as a function of one or more of the dynamic constants 48.

    [0094] The new value of the traversal index is independent of any pseudo-random indices and the entries of the table of state 46.

    [0095] In accordance with a preferred embodiment of the present invention, D is generally in the range of zero to N-1.

    [0096] In accordance with the most preferred embodiment of the present invention, the update DC module 44 is typically adapted to update D (one of the dynamic constant 48) every N rounds.

    [0097] In accordance with the most preferred embodiment of the present invention, f is generally defined as:



    [0098] Therefore, the state update module 40 is preferably adapted to update the traversal index, i, by adding, or subtracting D, to or from, i, respectively.

    [0099] In the example of equation 6, D is preferably an integer of the structure N/b+C, where GCD(D, N)=1 (GCD being the greatest common divisor), b is preferably a positive small divider of N (for example, smaller than 5) and C is preferably a very small or a very large constant (for example, smaller than 5 or greater than N-5).

    [0100] Updating of the pseudo-random indices of the reduced state 46 is now described in more detail.

    [0101] The pseudo-random index/indices (PRI) are preferably updated in accordance with one or more of the following methods.

    [0102] The first method preferably includes updating the PRI of the reduced state as a function of one or more of the DCs 48 as well as other entries of the table. The update DC module 44 is preferably adapted to update the PRI of the reduced state 46 as a function of one or more of the DCs 48 such that at least one of the following criteria is fulfilled:
    1. (a) one or more of the dynamic constants 48 is typically in the range 0 to N-1, where N is the size of the table to which the pseudo-random index points;
    2. (b) one or more of the dynamic constants 48 is typically XORed to a temporal result of the update;
    3. (c) one or more of the dynamic constants 48 is typically added to, or subtracted from, a temporal result of the update; and
    4. (d) one or more of the dynamic constants 48 is typically multiplied with a temporal result of the update.


    [0103] An example of applying the above criteria is:


    where D1, D2 and D3 are dynamic constants.

    [0104] The second method includes assigning "forbidden" or "undesirable" values to the PRI, which are described in more detail, below.

    [0105] By way of introduction, with most of the prior art table-shuffle stream ciphers, the pseudo-random indices are updated through functions of a certain class. The class usually includes functions that for every original value (j'), and for every target value (j"), the index j' may be updated into j", namely the content of the tables send j' to j". Moreover, for every original index j', when taking random tables, the distribution of j" is more or less uniform over the possible indices. Many weaknesses of table-shuffle stream ciphers stem from scenarios where the index j progresses in certain ways, for example, but not limited to, staying in place (j"=j'), making small steps back and forth (|j"-j'|<d for small values of d) and progressing in accordance with i(|(j"-j') - (i"-i')|<d for small values of d, i' being the value of i when j = j', i" being the value of i when j =j").

    [0106] Therefore, in accordance with a preferred embodiment of the present invention, a new value of j, namely, j", is preferably determined such that certain j values are avoided based on j'. Namely, there are generally j" values that are not reached from j', regardless of the content of the tables. Therefore, the state update module 40 is preferably adapted such that the new value of the pseudo-random index of the reduced state is generally determined to exclude, one or more "undesirable" values of the N possible values of the pseudo-random index.

    [0107] In accordance with an alternative preferred embodiment of the present invention, the distribution of the index j" given the previous index j' is preferably biased away from "undesirable" values, namely the values are not totally forbidden, but are less likely to be selected.

    [0108] The forbidden or undesirable values, j", are typically different for each j'. However, some or all of the forbidden or undesirable values j" may be the same for two or more j' values.

    [0109] By way of a non-limiting example, the pseudo-random index progression function having the structure:


    where g is an arbitrary function, is typically strengthened by performing the following two steps. First, a restricting function f is preferably employed that is defined from {0, ..., Nx-1} to {0, ..., Nx-1} that is a non-onto function, namely there is at least one z" for which there is no z' for which f(z')=z"). Second the function g(...) is preferably replaced with the function j = j + f(g(...)).

    [0110] In the above example, in order to avoid calculation of the f function for every state update, it is preferable to create, in advance, a table of size N with the value f(x) in position x for each position in the table. Using such a table allows the use of arbitrary f functions, whereby f actually becomes an S-Box.

    [0111] In accordance with the most preferred embodiment of the present invention, f does not preferably map onto any of the following undesirable values:
    1. (a) small values (for example, but not limited to zero to 5);
    2. (b) negative small values (for example, but not limited to N-5 to N-1, in other words values of mod N that are equivalent to negative small values of N]; and
    3. (c) numbers larger than N/5 that have a common divisor with N (for example, but not limited to N/2, N/3, 2N/3, N/4, 3N/4)


    [0112] Updating of the tables is now described in more detail.

    [0113] The tables are typically updated in a way that is similar to table-shuffle stream ciphers which do not employ dynamic constants, by permuting the refresh set, for example, but not limited to, swapping the entry associated with the new value of the traversal index with the entry associated with the new value of the pseudo-random index.

    [0114] Output word generation is now described in more detail below.

    [0115] The output word is preferably calculated in accordance with one or more of the following methods.

    [0116] In accordance with a first preferred method, the calculation of the output word is preferably a function of one or more of the dynamic constants 48 and the new value of the traversal index and the new value of the pseudo-random index. Therefore, the output word module 42 is preferably adapted to generate the output words as a function of one or more of the DCs 48. The generation of the output words typically includes fulfilling at least one of the following:
    1. (a) one or more of the dynamic constants 48 is in the range 0 to N-1, where N is the size of at least one of the state tables;
    2. (b) one or more of the dynamic constants 48 is typically XORed to a temporal result of the output word generation calculation;
    3. (c) one or more of the dynamic constants 48 is typically added to a temporal result of the output word generation calculation; and
    4. (d) one or more of the dynamic constants 48 is typically multiplied with a temporal result of the output word generation calculation.


    [0117] An example of applying the above criteria is to preferably employ the following function for calculating the output word:


    where D1, D2 and D3 are dynamic constants.

    [0118] In accordance with a second preferred method, the output word module 42 preferably selects the output word through the following function:


    where G is typically an XOR or addition modulus 256 and each instance of the function f is typically a function from the following list:

    f(x) = C XOR x;

    f(x) = C + x , where C is not equal to zero;

    f(x) = C * x, where C is not equal to one;

    where each of the C's is either a constant or a dynamic constant, some of the C's being identical or different, and each of the instances of the functions f preferably being a different function.

    [0119] A more general function for traversal indices and pseudo-random indices i1, ..., id, is:


    where preferably for every x the number of inputs to G of the type f(S[f(iX)]) is arbitrary.

    [0120] The update DC module 44 is now described in more detail below.

    [0121] The update DC module 44 preferably updates each of the DCs 48 as a function of the extended state, namely the tables, the indices of the state 46 and one or more of the other DCs 48.

    [0122] In a preferred embodiment of the present invention at least one of the DCs 48, for example a dynamic constant DC1, is updated through the function:


    where C is a constant, S is a state table of size N, and DC2 and DC3 are other dynamic constants.

    [0123] A more general function is:


    where DC2, DC3, ..., DCd are dynamic constants, G is preferably an XOR or addition modulus 256, and each instance of the function f is preferably a masking function, typically one of the following:

    f(x) = C XOR x;

    f(x) = C + x, where C is not equal to zero;

    f(x) = C * x, where C is not equal to 1;

    where each of the C's is a constant, some of the C's may be identical, and each of the instances of the functions f is preferably a different masking function.

    [0124] The initialization module 38 is now described in more detail below.

    [0125] The initialization module 38 preferably translates the IV 52 and the key 50 into an extended internal state, namely tables and indices of the state 46 and the DCs 48.

    [0126] As part of the initialization process, the initialization module 38 typically employs a set of the dynamic constants 48 so that the initialization of the extended state is a function of one or more of the dynamic constants 48. It should be noted that the dynamic constants used by the initialization module 38, do not necessarily need to be the same as the DCs 48 used during the keystream 54 generation, namely, in order to update the state 46 and generate the output words.

    [0127] In accordance with a preferred embodiment of the present invention, the initialization module 38 typically initializes at least one of the tables through an initialization method that employs two nested loops, an external loop and an internal loop, in the following manner.

    [0128] First, the total number of iterations is preferably at least the size of the initialized table. Namely, if the external loop is repeated C1 times and the internal loop is repeated C2 times and the initialized table has N entries, then C1*C2 is greater than or equal to N.

    [0129] Second, in the external loop, the dynamic constants 48 typically are updated.

    [0130] Third, in the internal loop one or more table entries are typically updated in each round, generally using at least one DC 48 updated in the external loop, for the update.

    [0131] In accordance with a preferred embodiment of the present invention the initialization method is implemented as follows:




    where x and y are used as counters for the number of times the external and internal loops are iterated, respectively.

    [0132] The "InitialUpdateState" function of the internal loop updates the state 46, preferably by: updating the indices using the key 50; locating the refresh set; and permuting the values of the refresh set in a predetermined manner.

    [0133] The "InitialUpdateDC" function of the external loop updates the DCs 48 in a way that is not necessarily similar to the update DC module 44.

    [0134] In accordance with the most preferred embodiment of the present invention, the 'InitialUpdateState" function of the internal loop is typically a function of the key 50, one or more indices, one or more tables and one or more of the DCs 48.

    [0135] The "InitialUpdateState" function typically updates one or more of the indices using more than one permutation entry, for example, but not limited to the following function:





    [0136] In accordance with the most preferred embodiment of the present invention the "InitialUpdateDC" function of the external loop is preferably a function of the IV 52 and the minimum of N and C2 multiplied by x, where x is the current number of iterations made by the external loop.

    [0137] The "InitialUpdateDC" function typically updates one or more of the dynamic constants 48 in the following way (z representing C2 multiplied by x):


    where b is a constant, DC2 and DC3 are dynamic constants, IV_WORD is the IV 52 and z indicates the size of the table prefix that has "good" randomness and thus can be used for adding randomness to the DC. When z = 0, a different function is optionally used to calculate the new value of DC1.

    [0138] It will be understood that the system according to the present invention may be a suitably programmed processor. Likewise, the invention contemplates software being readable by a processor for executing the method of the invention. The invention further contemplates a machine-readable memory tangibly embodying a program of instructions executable by the machine for executing the method of the invention.

    [0139] It will be appreciated that various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable sub-combination. It will also be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention is defined only by the claims which follow.


    Claims

    1. A system comprising:

    a pseudo-random number generator (37) including :

    constant; a register to store an extended state, the extended state having a reduced state and including at least one dynamic constant;

    an initialization module (38) to initialize at least part of the extended state based on at least one of a Key and an Initial Value;

    a state update module (40) to update the reduced state;

    an output word module (42) to generate a plurality of output words, the output words forming a keystream;

    an update dynamic constant module (44) to update the at least one dynamic constant; and

    a combiner (58) to convert between plaintext and ciphertext based on the key stream;

    characterised in that:

    the reduced state comprises a stream cipher table having N entries, at least one traversal index and at least one pseudo-random index, wherein the reduced state is the extended state without the at least one dynamic constant; and

    the state update module (40), the output word module (42) and the combiner (58) are adapted to operate through a plurality of cyclical rounds, each of the rounds including: updating the at least one traversal index and the at least one pseudo-random index of the reduced state by the state update module (40) including: (a) determining a new value of the traversal index such that the new value of the traversal index is a function of the at least one dynamic constant, the new value of the traversal index being independent of the pseudo-random index and the entries of the stream cipher table; (b) determining a new value of the pseudo-random index based upon at least one of the entries of the stream cipher table; and (c) swapping the entry associated with the new value of the traversal index with the entry associated with the new value of the pseudo-random index; then generating one of the output words by the output word module (42) as a function of the new value of the traversal index and the new value of the pseudo-random index; and then combining the output word with the plaintext or the ciphertext by the combiner (58);

    the updating of the at least one traversal index and/or the at least one pseudo-random index by the state update module (40) and/or the generation of the output words by the output word module (42) and/or combining of the output word with the plaintext or ciphertext, is a function of the at least one dynamic constant in more than 50% of the rounds; and

    the at least one dynamic constant is updated in up to 50% of the rounds.


     
    2. The system according to claim 1, wherein the combiner (58) is an encryption combiner to convert from the plaintext to the ciphertext based on the key stream.
     
    3. The system according to claim 1, wherein the combiner (58) is a decryption combiner to convert from the ciphertext to the plaintext based on the key stream.
     
    4. The system according to any of claims 1-3, wherein the update dynamic constant module (44) is adapted to update the at least one dynamic constant such that a new value of the dynamic constant is at least biased away from at least one undesirable value.
     
    5. The system according to claim 4, wherein the new value is determined to exclude the at least one undesirable value.
     
    6. The system according to claim 4, wherein when the at least one dynamic constant is used as a multiplier, the at least one undesirable value including zero.
     
    7. The system according to claim 4, wherein:

    the at least one dynamic constant includes two dynamic constants; and

    when a sum of the two dynamic constants is used as a multiplier, the at least one undesirable value is chosen such that the sum of the two dynamic constants is not equal to zero.


     
    8. The system according to any of claims 1-7, wherein the update dynamic constant module (44) is adapted to update the at least one dynamic constant as a function of the extended state.
     
    9. The system according to any of claims 1-8, wherein the update dynamic constant module (44) is adapted to update the at least one dynamic constant as a function of the at least one dynamic constant.
     
    10. The system according to any of claims 1-9, wherein the update dynamic constant module (44) is adapted to update the at least one dynamic constant when a condition is satisfied in the reduced state.
     
    11. The system according to any of claims 1-10, wherein the initialization module (38) is adapted to initialize the at least part of the extended state as a function of the at least one dynamic constant.
     
    12. The system according to any of claims 1-6, wherein the updating of the at least one traversal index by the state update module (40) is a function of the at least one dynamic constant in more than 50% of the rounds.
     
    13. The system according to any of claims 1-6, wherein the updating of the at least one pseudo-random index by the state update module (40) is a function of the at least one dynamic constant in more than 50% of the rounds.
     
    14. The system according to any of claims 1-6, wherein the generation of the output words by the output word module (42) is a function of the at least one dynamic constant in more than 50% of the rounds.
     
    15. The system according to any of claims 1-6, wherein the combining of the output word with the plaintext or ciphertext, is a function of the at least one dynamic constant in more than 50% of the rounds.
     
    16. A method for encrypting/decrypting data, comprising:

    providing a register to store an extended state having a reduced state and including at least one dynamic constant, the reduced state comprising a stream cipher table having N entries, at least one traversal index and at least one pseudo-random index, wherein the reduced state is the extended state without the at least one dynamic constant;

    initializing at least part of the extended state based on at least one of a Key and an Initial Value;

    updating the reduced state;

    generating a plurality of output words, the output words forming a keystream;

    updating the at least one dynamic constant;

    converting between plaintext and ciphertext based on the key stream, wherein:

    the updating, the generating and the combining are performed through a plurality of cyclical rounds such that each of the rounds includes updating the at least one traversal index and the at least one pseudo-random index of the reduced state including: (a) determining a new value of the traversal index such that the new value of the traversal index is a function of the at least one dynamic constant, the new value of the traversal index being independent of the pseudo-random index and the entries of the stream cipher table; (b) determining a new value of the pseudo random index based upon at least one of the entries of the stream cipher table; and (c) swapping the entry associated with the new value of the traversal index with the entry associated with the new value of the pseudo-random index, then generating one of the output words as a function of the new value of the traversal index and the new value of the pseudo-random index and then combining the output word with one of the plaintext and the ciphertext by the combiner; and

    the updating of the at least one traversal index and/or the at least one pseudo-random index by the state update module and/or the generation of the output words by the output word module and/or the combining of the output word with the plaintext or ciphertext is a function of the at least one dynamic constant in more than 50% of the rounds; and

    the at least one dynamic constant is only updated in up to 50% of the rounds.


     


    Ansprüche

    1. System, umfassend:

    einen Pseudo-Zufallszahlengenerator (37), enthaltend:

    ein Register zum Speichern eines erweiterten Status, wobei der erweiterte Status einen reduzierten Status aufweist und enthaltend mindestens eine dynamische Konstante;

    ein Initialisierungsmodul (38) zum Initialisieren mindestens eines Teils des erweiterten Status basierend auf mindestens einem eines Schlüssels und eines Anfangswerts;

    ein Status-Aktualisierungsmodul (40) zum Aktualisieren des reduzierten Zustands;

    ein Ausgabewortmodul (42) zum Erzeugen einer Vielzahl von Ausgabeworten, wobei die Ausgabeworte einen Schlüsselstrom bilden;

    ein Aktualisierungsmodul für die dynamische Konstante (44) zum Aktualisieren der mindestens einen dynamischen Konstante; und

    einen Kombinierer (58) zum Umwandeln zwischen Klartext und chiffriertem Text basierend auf dem Schlüsselstrom;

    dadurch gekennzeichnet, dass:

    der reduzierte Status eine Stromchiffriertabelle mit N Einträgen, mindestens einen Traversindex und mindestens einen Pseudozufallsindex umfasst, wobei der reduzierte Status der erweiterte Status ohne die mindestens eine dynamische Konstante ist; und

    das Status-Aktualisierungsmodul (40), das Ausgabewortmodul (42) und der Kombinierer (58) angepasst sind, durch eine Vielzahl von zyklischen Runden zu operieren, wobei jede der Runden enthält: Aktualisieren des mindestens einen Traversindex und des mindestens einen Pseudozufallsindex des reduzierten Status durch das Status-Aktualisierungsmodul (40), enthaltend: (a) Bestimmen eines neuen Werts des Traversindex, so dass der neue Wert des Traversindex eine Funktion der mindestens einen dynamischen Konstante ist, wobei der neue Wert des Traversindex von dem Pseudozufallsindex und den Einträgen der Stromchiffriertabelle unabhängig ist; (b) Bestimmen eines neuen Werts des Pseudozufallsindex basierend auf mindestens einem der Einträge der Stromchiffriertabelle; und (c) Vertauschen des Eintrags, der mit dem neuen Wert des Traversindex assoziiert ist, mit dem Eintrag, der mit dem neuen Wert des Pseudozufallsindex assoziiert ist; dann Erzeugen eines der Ausgabeworte durch das Ausgabewortmodul (42) in Abhängigkeit des neuen Werts des Traversindex und des neuen Werts des Pseudozufallsindex; und dann Kombinieren des Ausgabeworts mit dem Klartext oder dem chiffrierten Text durch den Kombinierer (58);

    wobei das Aktualisieren des mindestens einen Traversindex und/oder des mindestens einen Pseudozufallsindex durch das Status-Aktualisierungsmodul (40) und/oder das Erzeugen der Ausgabeworte durch das Ausgabewortmodul (42) und/oder Kombinieren des Ausgabeworts mit dem Klartext oder chiffrierten Text eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist; und

    die mindestens eine dynamische Konstante in bis zu 50 % der Runden aktualisiert wird.


     
    2. System nach Anspruch 1, wobei der Kombinierer (58) ein Verschlüsselungskombinierer zum Umwandeln aus dem Klartext in den chiffrierten Text basierend auf dem Schlüsselstrom ist.
     
    3. System nach Anspruch 1, wobei der Kombinierer (58) ein Entschlüsselungskombinierer zum Umwandeln aus dem chiffrierten Text in den Klartext basierend auf dem Schlüsselstrom ist.
     
    4. System nach einem der Ansprüche 1-3, wobei das Aktualisierungsmodul für die dynamische Konstante (44) angepasst ist, die mindestens eine dynamische Konstante derart zu aktualisieren, dass ein neuer Wert der dynamischen Konstanten mindestens weg von mindestens einem unerwünschten Wert gerichtet ist.
     
    5. System nach Anspruch 4, wobei der neue Wert bestimmt wird, um den mindestens einen unerwünschten Wert auszuschließen.
     
    6. System nach Anspruch 4, wobei, wenn die mindestens eine dynamische Konstante als ein Multiplikator verwendet wird, der mindestens eine unerwünschte Wert null enthält.
     
    7. System nach Anspruch 4, wobei:

    die mindestens eine dynamische Konstante zwei dynamische Konstanten enthält; und

    wenn eine Summe der beiden dynamischen Konstanten als ein Multiplikator verwendet wird, der mindestens eine unerwünschte Wert derart ausgewählt wird, dass die Summe der beiden dynamischen Konstanten nicht gleich null ist.


     
    8. System nach einem der Ansprüche 1-7, wobei das Aktualisierungsmodul für die dynamische Konstante (44) angepasst ist, die mindestens eine dynamische Konstante in Abhängigkeit des erweiterten Status zu aktualisieren.
     
    9. System nach einem der Ansprüche 1-8, wobei das Aktualisierungsmodul für die dynamische Konstante (44) angepasst ist, die mindestens eine dynamische Konstante in Abhängigkeit der mindestens einen dynamischen Konstante zu aktualisieren.
     
    10. System nach einem der Ansprüche 1-9, wobei das Aktualisierungsmodul für die dynamische Konstante (44) angepasst ist, die mindestens eine dynamische Konstante zu aktualisieren, wenn eine Bedingung in dem reduzierten Status erfüllt ist.
     
    11. System nach einem der Ansprüche 1-10, wobei das Initialisierungsmodul (38) angepasst ist, mindestens einen Teil des erweiterten Status als eine Funktion der mindestens einen dynamischen Konstante zu aktualisieren.
     
    12. System nach einem der Ansprüche 1-6, wobei das Aktualisieren des mindestens einen Traversindex durch das Status-Aktualisierungsmodul (40) eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist.
     
    13. System nach einem der Ansprüche 1-6, wobei das Aktualisieren des mindestens einen Pseudozufallsindex durch das Status-Aktualisierungsmodul (40) eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist.
     
    14. System nach einem der Ansprüche 1-6, wobei das Erzeugen der Ausgabeworte durch das Ausgabewortmodul (42) eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist.
     
    15. System nach einem der Ansprüche 1-6, wobei das Kombinieren des Ausgabewortes mit dem Klartext oder chiffrierten Text eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist.
     
    16. Verfahren zum Verschlüsseln/Entschlüsseln von Daten, umfassend:

    Bereitstellen eines Registers zum Speichern eines erweiterten Status, der einen reduzierten Status aufweist und enthaltend mindestens eine dynamische Konstante, der reduzierte Status umfassend eine Stromchiffriertabelle mit N Einträgen, mindestens einen Traversindex und mindestens einen Pseudozufallsindex, wobei der reduzierte Status der erweiterte Status ohne die mindestens eine dynamische Konstante ist;

    Initialisieren mindestens eines Teils des erweiterten Status basierend auf mindestens einem eines Schlüssels und eines Anfangswerts;

    Aktualisieren des reduzierten Zustands;

    Erzeugen einer Vielzahl von Ausgabeworten, wobei die Ausgabeworte einen Schlüsselstrom bilden;

    Aktualisieren der mindestens einen dynamischen Konstante;

    Umwandeln zwischen Klartext und chiffriertem Text basierend auf dem Schlüsselstrom, wobei:

    das Aktualisieren, das Erzeugen und das Kombinieren durch eine Vielzahl von zyklischen Runden derart durchgeführt werden, dass jede der Runden Aktualisieren des mindestens einen Traversindex und des mindestens einen Pseudozufallsindex des reduzierten Status enthält, enthaltend: (a) Bestimmen eines neuen Werts des Traversindex, so dass der neue Wert des Traversindex eine Funktion der mindestens einen dynamischen Konstante ist, wobei der neue Wert des Traversindex von dem Pseudozufallsindex und den Einträgen der Stromchiffriertabelle unabhängig ist; (b) Bestimmen eines neuen Werts des Pseudozufallsindex basierend auf mindestens einem der Einträge der Stromchiffriertabelle; und (c) Vertauschen des Eintrags, der mit dem neuen Wert des Traversindex assoziiert ist, mit dem Eintrag, der mit dem neuen Wert des Pseudozufallsindex assoziiert ist; dann Erzeugen eines der Ausgabeworte in Abhängigkeit des neuen Werts des Traversindex und des neuen Werts des Pseudozufallsindex und dann Kombinieren des Ausgabeworts mit einem des Klartexts und des chiffrierten Texts durch den Kombinierer; und

    wobei das Aktualisieren des mindestens einen Traversindex und/oder des mindestens einen Pseudozufallsindex durch das Status-Aktualisierungsmodul und/oder das Erzeugen der Ausgabeworte durch das Ausgabewortmodul und/oder das Kombinieren des Ausgabeworts mit dem Klartext oder chiffrierten Text eine Funktion der mindestens einen dynamischen Konstante in mehr als 50 % der Runden ist; und

    die mindestens eine dynamische Konstante nur in bis zu 50 % der Runden aktualisiert wird.


     


    Revendications

    1. Système comprenant :

    un générateur de nombres pseudoaléatoires (37), incluant :

    un registre destiné à stocker un état étendu, l'état étendu présentant un état réduit et incluant au moins une constante dynamique ;

    un module d'initialisation (38) destiné à initialiser au moins une partie de l'état étendu sur la base d'au moins l'une parmi une clé et une valeur initiale ;

    un module de mise à jour d'état (40) destiné à mettre à jour l'état réduit ;

    un module de mots de sortie (42) destiné à générer une pluralité de mots de sortie, les mots de sortie formant un flux de clés ;

    un module de mise à jour de la constante dynamique (44) destiné à mettre à jour ladite au moins une constante dynamique ; et

    un combinateur (58) destiné à permuter entre texte en clair et cryptogramme sur la base du flux de clés ;

    caractérisé en ce que :

    l'état réduit comprend une table de chiffrement de flux présentant N entrées, au moins un index de parcours et au moins un index pseudoaléatoire, dans lequel l'état réduit correspond à l'état étendu sans ladite au moins une constante dynamique ; et

    le module de mise à jour d'état (40), le module de mots de sortie (42) et le combinateur (58) sont aptes à opérer à travers une pluralité de périodes cycliques, chacune des périodes cycliques incluant : la mise à jour dudit au moins un index de parcours et dudit au moins un index pseudoaléatoire de l'état réduit, par le biais du module de mise à jour d'état (40), consistant à : (a) déterminer une nouvelle valeur de l'index de parcours de sorte que la nouvelle valeur de l'index de parcours est une fonction de ladite au moins une constante dynamique, la nouvelle valeur de l'index de parcours étant indépendante de l'index pseudoaléatoire et des entrées de la table de chiffrement de flux ; (b) déterminer une nouvelle valeur de l'index pseudoaléatoire sur la base d'au moins l'une des entrées de la table de chiffrement de flux ; et (c) permuter l'entrée associée à la nouvelle valeur de l'index de parcours avec l'entrée associée à la nouvelle valeur de l'index pseudoaléatoire ; générer ensuite l'un des mots de sortie, par le biais du module de mots de sortie (42), en fonction de la nouvelle valeur de l'index de parcours et de la nouvelle valeur de l'index pseudoaléatoire ; et combiner ensuite le mot de sortie avec le texte en clair ou le cryptogramme, par le biais du combinateur (58) ;

    la mise à jour dudit au moins un index de parcours et/ou dudit au moins un index pseudoaléatoire par le module de mise à jour d'état (40), et/ou la génération des mots de sortie par le module de mots de sortie (42), et/ou la combinaison du mot de sortie avec le texte en clair ou le cryptogramme, est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques ; et

    ladite au moins une constante dynamique est mise à jour dans tout au plus 50 % des périodes cycliques.


     
    2. Système selon la revendication 1, dans lequel le combinateur (58) est un combinateur de chiffrement destiné à convertir le texte en clair en cryptogramme sur la base du flux de clés.
     
    3. Système selon la revendication 1, dans lequel le combinateur (58) est un combinateur de déchiffrement destiné à convertir le cryptogramme en texte en clair sur la base du flux de clés.
     
    4. Système selon l'une quelconque des revendications 1 à 3, dans lequel le module de mise à jour de la constante dynamique (44) est apte à mettre à jour ladite au moins une constante dynamique de sorte qu'une nouvelle valeur de la constante dynamique est au moins écartée d'au moins une valeur indésirable.
     
    5. Système selon la revendication 4, dans lequel la nouvelle valeur est déterminée de manière à exclure ladite au moins une valeur indésirable.
     
    6. Système selon la revendication 4, dans lequel, lorsque ladite au moins une constante dynamique est utilisée en tant que multiplicateur, ladite au moins une valeur indésirable inclut une valeur nulle.
     
    7. Système selon la revendication 4, dans lequel :

    ladite au moins une constante dynamique comprend deux constantes dynamiques ; et

    lorsque la somme des deux constantes dynamiques est utilisée en tant que multiplicateur, ladite au moins une valeur indésirable est choisie de sorte que la somme des deux constantes dynamiques n'est pas nulle.


     
    8. Système selon l'une quelconque des revendications 1 à 7, dans lequel le module de mise à jour de la constante dynamique (44) est apte à mettre à jour ladite au moins une constante dynamique en fonction de l'état étendu.
     
    9. Système selon l'une quelconque des revendications 1 à 8, dans lequel le module de mise à jour de la constante dynamique (44) est apte à mettre à jour ladite au moins une constante dynamique en fonction de ladite au moins une constante dynamique.
     
    10. Système selon l'une quelconque des revendications 1 à 9, dans lequel le module de mise à jour de la constante dynamique (44) est apte à mettre à jour ladite au moins une constante dynamique lorsqu'une condition est satisfaite dans l'état réduit.
     
    11. Système selon l'une quelconque des revendications 1 à 10, dans lequel le module d'initialisation (38) est apte à initialiser ladite au moins une partie de l'état étendu en fonction de ladite au moins une constante dynamique.
     
    12. Système selon l'une quelconque des revendications 1 à 6, dans lequel la mise à jour dudit au moins un index de parcours par le module de mise à jour d'état (40) est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques.
     
    13. Système selon l'une quelconque des revendications 1 à 6, dans lequel la mise à jour dudit au moins un index pseudoaléatoire par le module de mise à jour d'état (40) est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques.
     
    14. Système selon l'une quelconque des revendications 1 à 6, dans lequel la génération des mots de sortie par le module de mots de sortie (42) est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques.
     
    15. Système selon l'une quelconque des revendications 1 à 6, dans lequel la combinaison du mot de sortie avec le texte en clair ou le cryptogramme est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques.
     
    16. Procédé de chiffrement / déchiffrement de données, consistant à :

    fournir un registre destiné à stocker un état étendu présentant un état réduit et incluant au moins une constante dynamique, l'état réduit comprenant une table de chiffrement de flux présentant N entrées, au moins un index de parcours et au moins un index pseudoaléatoire, dans lequel l'état réduit correspond à l'état étendu sans ladite au moins une constante dynamique ;

    initialiser au moins une partie de l'état étendu sur la base d'au moins l'une parmi une clé et une valeur initiale ;

    mettre à jour l'état réduit ;

    générer une pluralité de mots de sortie, les mots de sortie formant un flux de clés ;

    mettre à jour ladite au moins une constante dynamique ;

    permuter entre texte en clair et cryptogramme sur la base du flux de clés, dans lequel :

    la mise à jour, la génération et la combinaison sont mises en oeuvre à travers une pluralité de périodes cycliques de sorte que chacune des périodes cycliques inclut la mise à jour dudit au moins un index de parcours et dudit au moins un index pseudoaléatoire de l'état réduit, consistant à : (a) déterminer une nouvelle valeur de l'index de parcours de sorte que la nouvelle valeur de l'index de parcours est une fonction de ladite au moins une constante dynamique, la nouvelle valeur de l'index de parcours étant indépendante de l'index pseudoaléatoire et des entrées de la table de chiffrement de flux ; (b) déterminer une nouvelle valeur de l'index pseudoaléatoire sur la base d'au moins l'une des entrées de la table de chiffrement de flux ; et (c) permuter l'entrée associée à la nouvelle valeur de l'index de parcours avec l'entrée associée à la nouvelle valeur de l'index pseudoaléatoire, générer ensuite l'un des mots de sortie en fonction de la nouvelle valeur de l'index de parcours et de la nouvelle valeur de l'index pseudoaléatoire, et combiner ensuite le mot de sortie avec le texte en clair ou le cryptogramme, par le biais du combinateur ; et

    la mise à jour dudit au moins un index de parcours et/ou dudit au moins un index pseudoaléatoire par le module de mise à jour d'état, et/ou la génération des mots de sortie par le module de mots de sortie, et/ou la combinaison du mot de sortie avec le texte en clair ou le cryptogramme, est une fonction de ladite au moins une constante dynamique dans plus de 50 % des périodes cycliques ; et

    ladite au moins une constante dynamique est seulement mise à jour dans tout au plus 50 % des périodes cycliques.


     




    Drawing









    REFERENCES CITED IN THE DESCRIPTION



    This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

    Patent documents cited in the description




    Non-patent literature cited in the description