CA2173732A1 - Multistream encryption system for secure communication - Google Patents
Multistream encryption system for secure communicationInfo
- Publication number
- CA2173732A1 CA2173732A1 CA002173732A CA2173732A CA2173732A1 CA 2173732 A1 CA2173732 A1 CA 2173732A1 CA 002173732 A CA002173732 A CA 002173732A CA 2173732 A CA2173732 A CA 2173732A CA 2173732 A1 CA2173732 A1 CA 2173732A1
- Authority
- CA
- Canada
- Prior art keywords
- pseudorandom
- data
- array
- generator
- key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
- H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/12—Details relating to cryptographic hardware or logic circuitry
- H04L2209/125—Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
Abstract
MUSE, a programmable multistream encrytion system for secure communication provides dynamic cryptographic security and a highly efficient surveillance mechanism for transferring very large blocks of data (VLBD) subject to real-time constraints. Encryption varies pseudorandomly in both space and Lime. MUSE allows the user to specify a finite state machine (21) which sequentially accepts parallel streams of data (VLBD) and encrypts this data in real time employing an arithmetic-algebraic pseudorandom array generator (41) (PRAG). The method of enciphering is a one-time algebraic pad system which views the incoming data streams as elements from an algebraic alphabet (finite ring) and encrypts by adding to this a pseudorandom vector sequence (21) iteratively generated from a single seed key (20). Decipherment is obtained by reversing this process.
Description
WO95/10148 ~ 2 1 7 3 ~2 PcT/us94/lllg9 MULTISTREAM ENCRYPTION SYSTEM
FOR SECU~E COMMUNICATION
BACKROUND OF THE INVENTION
1. Field of the Invention The invention relates to an encryption system for secure communications and more particularly to a multistream encryption system called MUSE.
FOR SECU~E COMMUNICATION
BACKROUND OF THE INVENTION
1. Field of the Invention The invention relates to an encryption system for secure communications and more particularly to a multistream encryption system called MUSE.
2. Description of the Related Technology The need for a progr~rnm~l-le high speed encryption system processing parallel streams of very large blocks of data (VLBD) emerges from several new computing and commllnication technologies. Such technologies include distributed multimedia information systems supported by high performance computer networks employing digital fiber optics for tr~ mi~sion. Contem-porary products of these te-~hnologies include e-mail, fax, voicem~il, cellular telephony, video conferencing, image archiving, and satellite communication.
Because of the rapid development of these technologies, contemporary crypto-graphic methods have not concurrently addressed this need in its totality.
SUMMARY OF THE INVENTION
A multistream of data enters MUSE at discrete time instances ti and is dynamically allocated to a large set of buffers Bl,B2,... ~Bm~ The arith--WO 95/10148 S ~ 2 1 7 3 7 3 2 PCT/US94/11199 ~
metic of each buffer Bj is based on an individual ring structure Rj. From a single seed key, not ~tored ~n memory, PRAG, an arithmetic-algebraic pseudo-random array generator, using arithmetic in another direct product of rings, generates a pseudorandom vector key stream K(ti) parametrized by time. At each time instance t" PRAG generates from ~(ti), a pseudorandom vector of pseudorandom number sequences where each vector component is taken in the ring Rj and added to the buffer BJ. The encrypted data is shipped and the buffers are refilled with incoming data. Decryption is performed by reversing the process and requires knowledge of the seed key.
MUSE provides space-time encipherment. Encryption is diÆerent at each buffer (space) and at each time instance. Moreover, the encryption dynamics is itself pseudorandom as space and time vary. This provides an added dimen-sion of security. A novel feature of MUSE is a surveillance me( h~ni~m which instantaneously detects unauthorized attempts at decryption and reports such occurrences to authorized users.
According to an advantageous feature of the invention, incoming data streams may be of a very large or even lmlimited size. Encryption of an endless data stream can be accomplished by a system including a real time array generator. The pseudorandom array generator operates to generate rel-atively small encryption arrays when compared to the potential size of the incoming data stream. According to a preferred embodiment, the encryption array may be lK bits by lK bits. The pseudorandom array generator itera-tively generates a sequence of arrays. Each successive array may be based on the next-state output of the key vector generator.
~ WO 95/10148 S ~ 2 i 7 3 7 3 2 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
1. Conceptual Architecture The origins of contemporary stream ciphers stems from the one-time pad cTypto3y~tem or Vernam Cipher, named in honor of G. Vernam who developed the method in 1917 for purposes of telegraphic commllnication ( D. Kahn, The Code Brenke-~, The Story of Secret Writing, M~mill~n Publishing Co., New York (1967)). The one-time pad cryptosystem is one of the simplest and most secure of private-key cryptosystems. It operates in the following manner.
Let IF2 denote the finite field of two çlemçnt~s 0, 1 which we call bits (R.
Lidl and H. Niederreiter, Int~oduction to Finite Field~ and their Application~, Cambridge Univ. Press, New York (1986), [L-N]). A plaintext message is given by a string of bits m--ml m2 . . m8 -The sender A(lice) and the receiver B(ob) agree on a long random string of bits k = kl k2 . . . kt, where 5 < t, the p~ivate key, which is to be used only once and then destroyed.
The sender A fo.llls the ciphe~te2;t string c = cl c2 . . . c,"
where ci = mi + k" (i = 1, . . ., s) and addition of bits is in E'2 . The ciphertext c is then transmitted to B who decrypts c by forming ci + ki ~ E'2, thereby, obt~;ning mi. This is a perfect, unbreakable cipher when all different keys and messages are equally likely. Since the key size is at least as large as the datasize, the cost of implementation of this method is very high.
WO 95/10148 ~ ~ ~ ,2 1 7 3 7 3 2 PCT/US94/11199 ~
In order to specify MUSE, we need sor~e concepts from systems theory (see [L-N]). A complete, deterministic, finite state system M is defined by the following:
Ml: A finite nonempty set U = {C~ 2~ h}, called the input alphabet of M.
M2: A finite nonempty set Y = {,Bl"B2,... "B"} called the outp~t alphabet of M. An element of Y is called an output ~ymboL
M3: A finite nonempty set S = {~ r2, . . . ar} called the ~tate ~et of M. An element of S is called a ~tate.
M4: A ne2t ~tate f?mction f: 5 x U ~ Y that maps the set of ordered pairs (cr~ ) into S.
M5: An output f1lnction 9: S x U ~ Y that maps the set of all ordered pairs (ai, ~,) into Y.
A finite-state system M can be interpreted as a device whose input, output and state at time t are denoted by u(t), y(t), and s(t) where the variables are defined for integers t only and assume values taken from U, Y, S, respectively.
Given the state and input of M at time t, f specifies the state at time t + 1 and 9, the oùtput at time t.
M6: s(t + 1) = f (5(t)~ u(t))-M7: y(t) = 9 (~(t)~ u(t)) -A finite state system is called autonomou~ in the case that the next state function depends only on the previous state and not on the input. In this ~ WO95/10148 ~ 2 ! 7~732 PCT/USg4/lll99 r .~ ~
case M8: ~(t Jr l) = f (s(t)) (autonomous transition).
By a ~ynchTonou~ ~tTeam cipher is meant an autonomous finite-state sys-tem Mc (here C denotes cipher) where the plaintext and ciphertext alphabets are the input and output alphabets, respecti~ely. The states S of Mc are referred to as key~, the start-state ~(0) is called the ~eed key, the progression of states ~(O),s(1),..., is called the key stream, the next state function f is called the running key generator, and the output function g(t) is the enci-phering function. Moreover, the finite-state system Mc satisfies the following conditions:
M9: The number of possible keys must be large enough so that e~h~ tive search for the seed key s(O) is not feasible.
M10: The infinite key stream 5(0), s(1), . . ., must have guaranteed minimum length for their periods which exceed the length of the plaintext strings.
M11: The cipherment must appear to be random.
2. Pseudorandom Array Generator We assume the standard characterization of pseudorandom binary sequences (H. Beker & F. Piper, Ciphe~ Sy~tem~, John Wiley and Sons, New York (1982)). This notion may be generalized to higher dimensions. Consider a vector V = (Vl, . . ., Vn) WO95/10148 ~ 2173732 PCT/US94/11199 ~
of dimension n ~vhose components vi are binary sequences. We say V is pseudorandom if each component vi is pseudorandom and the concatenation vlv2 . . . vn of binary strings is itself pseudorandom. A two ~lim~n~ional arrayof binary strings is pseudorandom if each row and column (considered as vectors) is pseudorandom. Finally, consider a set of arrays of fixed ~limt?n~ionm x n which are parametrized by a discrete time scale t. Denote the array at time t by A(t) = (aij(t))l<iCm, l<jcn We define the parametrized array to be pseudorandom if each array A(t) is pseudorandom and for all fixed i,j with 1 < i < m and 1 < j < n the sequence aij(t) is pseudorandom as t varies.
We now describe a complete deterministic autonomous finite state system with the property that it generates time-parametrized pseudorandom arrays.
Such a m~hine will be called a pseudorandom array generator. It will depend on three progr~rnm~ble parameters, a positive integer m, a positive integer which divides m and an m-tuple (bl,... ~bm) of positive integers bi. To complete the description of the pseudorandom array generator, it only rPm~in~
to specify the set of states S, the set of outputs Y, the next state function f which satisfies M8, i.e., s(t + 1) = f (~(t))~
and the output function g. We assume the state set S consists of a nonempty finite set of ~-tuples whose components are binary strings. Every 3 ~ S will be of the form s = (~1,... ,~) where ~i are binary (or bit) strings of zeros and ones. The output set Y will be a finite set of e x me arrays where the ijth ~ WO 95/10148 ~ 2 ~ 7 3 1 ~ PcTrusg4/lll99 component of the array is a binary string of length be where e = i e + j. ~e require.that the output function 9: S x U ~ Y for our pseudorandom array generator does not depend on U, so that it is a function from S ~ Y, i.e., a generator. The only other requirements for the next state function f and the output function g are that g(s(t)) with ~(t) ~ S is a pseudorandom time parametrized array and that f and g can be computed in real time.
We now describe a special pseudorandom array generator that is based on the algebraic structure of a direct product of finite rings. This particu-lar pseudorandom array generator will henceforth be called PRAG and will constitute the main component of the m~hine MUSE described in the next section.
Fix three progr~nm~ble parameters for PRAG; a positive integer m, a positive integer e which divides m, and an m-tuple (bl,... ~bm) of positive integers bi. Set ~Z' = rI R
~=1 to be the direct product of e finite rings, Rl, . . ., R~. The set of states SPRAG
for PRAG consists of all e-tuples whose ith component is a binary coded element of R'. Then PRAG will have e ~tate buffers gstate B~tate where the bit size of B~tate is rlog2 IR'Il, i.e., the bit size of the largest element of R'. Here ~xl (ceiling function) is the smallest integer greater or equal to x and IAI denotes the cardinality of any set A. At time t = O, the seed key WO95/10148 ~ S 2 1 13-732 PCT/US94/11199 ~
~() = (5()1~ . . ., S(0)~) enters the state buffers (i.e. s(O)i ~ Bi~tate). At time t ~ O, the state buffers are erased and replaced with s(~ + 1) = fp~AG (3(t)), where fpRAG is the next state function for PRAG. The output alphabet YPRAG
will consist of all possible arrays with e rows and ~ columns whose ijth component is a binary string of length be with e = i f + j. At each time ~, the state ~(t) ~ SP~Aa is mapped to YPRAG by the output function gpRAG.
The algorithm for PRAG may be further generalized by allowing the output set 7~' to vary pseudorandomly according to a selection function which selects finite rings from a larger fixed collection of finite rings.
Because of the rapid development of these technologies, contemporary crypto-graphic methods have not concurrently addressed this need in its totality.
SUMMARY OF THE INVENTION
A multistream of data enters MUSE at discrete time instances ti and is dynamically allocated to a large set of buffers Bl,B2,... ~Bm~ The arith--WO 95/10148 S ~ 2 1 7 3 7 3 2 PCT/US94/11199 ~
metic of each buffer Bj is based on an individual ring structure Rj. From a single seed key, not ~tored ~n memory, PRAG, an arithmetic-algebraic pseudo-random array generator, using arithmetic in another direct product of rings, generates a pseudorandom vector key stream K(ti) parametrized by time. At each time instance t" PRAG generates from ~(ti), a pseudorandom vector of pseudorandom number sequences where each vector component is taken in the ring Rj and added to the buffer BJ. The encrypted data is shipped and the buffers are refilled with incoming data. Decryption is performed by reversing the process and requires knowledge of the seed key.
MUSE provides space-time encipherment. Encryption is diÆerent at each buffer (space) and at each time instance. Moreover, the encryption dynamics is itself pseudorandom as space and time vary. This provides an added dimen-sion of security. A novel feature of MUSE is a surveillance me( h~ni~m which instantaneously detects unauthorized attempts at decryption and reports such occurrences to authorized users.
According to an advantageous feature of the invention, incoming data streams may be of a very large or even lmlimited size. Encryption of an endless data stream can be accomplished by a system including a real time array generator. The pseudorandom array generator operates to generate rel-atively small encryption arrays when compared to the potential size of the incoming data stream. According to a preferred embodiment, the encryption array may be lK bits by lK bits. The pseudorandom array generator itera-tively generates a sequence of arrays. Each successive array may be based on the next-state output of the key vector generator.
~ WO 95/10148 S ~ 2 i 7 3 7 3 2 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
1. Conceptual Architecture The origins of contemporary stream ciphers stems from the one-time pad cTypto3y~tem or Vernam Cipher, named in honor of G. Vernam who developed the method in 1917 for purposes of telegraphic commllnication ( D. Kahn, The Code Brenke-~, The Story of Secret Writing, M~mill~n Publishing Co., New York (1967)). The one-time pad cryptosystem is one of the simplest and most secure of private-key cryptosystems. It operates in the following manner.
Let IF2 denote the finite field of two çlemçnt~s 0, 1 which we call bits (R.
Lidl and H. Niederreiter, Int~oduction to Finite Field~ and their Application~, Cambridge Univ. Press, New York (1986), [L-N]). A plaintext message is given by a string of bits m--ml m2 . . m8 -The sender A(lice) and the receiver B(ob) agree on a long random string of bits k = kl k2 . . . kt, where 5 < t, the p~ivate key, which is to be used only once and then destroyed.
The sender A fo.llls the ciphe~te2;t string c = cl c2 . . . c,"
where ci = mi + k" (i = 1, . . ., s) and addition of bits is in E'2 . The ciphertext c is then transmitted to B who decrypts c by forming ci + ki ~ E'2, thereby, obt~;ning mi. This is a perfect, unbreakable cipher when all different keys and messages are equally likely. Since the key size is at least as large as the datasize, the cost of implementation of this method is very high.
WO 95/10148 ~ ~ ~ ,2 1 7 3 7 3 2 PCT/US94/11199 ~
In order to specify MUSE, we need sor~e concepts from systems theory (see [L-N]). A complete, deterministic, finite state system M is defined by the following:
Ml: A finite nonempty set U = {C~ 2~ h}, called the input alphabet of M.
M2: A finite nonempty set Y = {,Bl"B2,... "B"} called the outp~t alphabet of M. An element of Y is called an output ~ymboL
M3: A finite nonempty set S = {~ r2, . . . ar} called the ~tate ~et of M. An element of S is called a ~tate.
M4: A ne2t ~tate f?mction f: 5 x U ~ Y that maps the set of ordered pairs (cr~ ) into S.
M5: An output f1lnction 9: S x U ~ Y that maps the set of all ordered pairs (ai, ~,) into Y.
A finite-state system M can be interpreted as a device whose input, output and state at time t are denoted by u(t), y(t), and s(t) where the variables are defined for integers t only and assume values taken from U, Y, S, respectively.
Given the state and input of M at time t, f specifies the state at time t + 1 and 9, the oùtput at time t.
M6: s(t + 1) = f (5(t)~ u(t))-M7: y(t) = 9 (~(t)~ u(t)) -A finite state system is called autonomou~ in the case that the next state function depends only on the previous state and not on the input. In this ~ WO95/10148 ~ 2 ! 7~732 PCT/USg4/lll99 r .~ ~
case M8: ~(t Jr l) = f (s(t)) (autonomous transition).
By a ~ynchTonou~ ~tTeam cipher is meant an autonomous finite-state sys-tem Mc (here C denotes cipher) where the plaintext and ciphertext alphabets are the input and output alphabets, respecti~ely. The states S of Mc are referred to as key~, the start-state ~(0) is called the ~eed key, the progression of states ~(O),s(1),..., is called the key stream, the next state function f is called the running key generator, and the output function g(t) is the enci-phering function. Moreover, the finite-state system Mc satisfies the following conditions:
M9: The number of possible keys must be large enough so that e~h~ tive search for the seed key s(O) is not feasible.
M10: The infinite key stream 5(0), s(1), . . ., must have guaranteed minimum length for their periods which exceed the length of the plaintext strings.
M11: The cipherment must appear to be random.
2. Pseudorandom Array Generator We assume the standard characterization of pseudorandom binary sequences (H. Beker & F. Piper, Ciphe~ Sy~tem~, John Wiley and Sons, New York (1982)). This notion may be generalized to higher dimensions. Consider a vector V = (Vl, . . ., Vn) WO95/10148 ~ 2173732 PCT/US94/11199 ~
of dimension n ~vhose components vi are binary sequences. We say V is pseudorandom if each component vi is pseudorandom and the concatenation vlv2 . . . vn of binary strings is itself pseudorandom. A two ~lim~n~ional arrayof binary strings is pseudorandom if each row and column (considered as vectors) is pseudorandom. Finally, consider a set of arrays of fixed ~limt?n~ionm x n which are parametrized by a discrete time scale t. Denote the array at time t by A(t) = (aij(t))l<iCm, l<jcn We define the parametrized array to be pseudorandom if each array A(t) is pseudorandom and for all fixed i,j with 1 < i < m and 1 < j < n the sequence aij(t) is pseudorandom as t varies.
We now describe a complete deterministic autonomous finite state system with the property that it generates time-parametrized pseudorandom arrays.
Such a m~hine will be called a pseudorandom array generator. It will depend on three progr~rnm~ble parameters, a positive integer m, a positive integer which divides m and an m-tuple (bl,... ~bm) of positive integers bi. To complete the description of the pseudorandom array generator, it only rPm~in~
to specify the set of states S, the set of outputs Y, the next state function f which satisfies M8, i.e., s(t + 1) = f (~(t))~
and the output function g. We assume the state set S consists of a nonempty finite set of ~-tuples whose components are binary strings. Every 3 ~ S will be of the form s = (~1,... ,~) where ~i are binary (or bit) strings of zeros and ones. The output set Y will be a finite set of e x me arrays where the ijth ~ WO 95/10148 ~ 2 ~ 7 3 1 ~ PcTrusg4/lll99 component of the array is a binary string of length be where e = i e + j. ~e require.that the output function 9: S x U ~ Y for our pseudorandom array generator does not depend on U, so that it is a function from S ~ Y, i.e., a generator. The only other requirements for the next state function f and the output function g are that g(s(t)) with ~(t) ~ S is a pseudorandom time parametrized array and that f and g can be computed in real time.
We now describe a special pseudorandom array generator that is based on the algebraic structure of a direct product of finite rings. This particu-lar pseudorandom array generator will henceforth be called PRAG and will constitute the main component of the m~hine MUSE described in the next section.
Fix three progr~nm~ble parameters for PRAG; a positive integer m, a positive integer e which divides m, and an m-tuple (bl,... ~bm) of positive integers bi. Set ~Z' = rI R
~=1 to be the direct product of e finite rings, Rl, . . ., R~. The set of states SPRAG
for PRAG consists of all e-tuples whose ith component is a binary coded element of R'. Then PRAG will have e ~tate buffers gstate B~tate where the bit size of B~tate is rlog2 IR'Il, i.e., the bit size of the largest element of R'. Here ~xl (ceiling function) is the smallest integer greater or equal to x and IAI denotes the cardinality of any set A. At time t = O, the seed key WO95/10148 ~ S 2 1 13-732 PCT/US94/11199 ~
~() = (5()1~ . . ., S(0)~) enters the state buffers (i.e. s(O)i ~ Bi~tate). At time t ~ O, the state buffers are erased and replaced with s(~ + 1) = fp~AG (3(t)), where fpRAG is the next state function for PRAG. The output alphabet YPRAG
will consist of all possible arrays with e rows and ~ columns whose ijth component is a binary string of length be with e = i f + j. At each time ~, the state ~(t) ~ SP~Aa is mapped to YPRAG by the output function gpRAG.
The algorithm for PRAG may be further generalized by allowing the output set 7~' to vary pseudorandomly according to a selection function which selects finite rings from a larger fixed collection of finite rings.
3. Mathematical Description of MUSE
Fix a positive integer m and a vector b = (bl,b2,... ~bm) of positive inte-gers. We assume we have m data bufl~ers Bdata Bdata m of sizes bl,... ~bm~ A multistream of data enters and fills each data buffer Bdata with a bi-tuple of elements in a finite ring Ri. The bit size of this b~-tuple is in general larger than bi. This, hc)w~vel, poses no problem in our subsequent discussion. Let .
Ri i=l be the direct product of the m finite rings Ri. The choice of m, b, and ~ deter-mines the algebraic structure in which MUSE operates and MUSE provides the user with an algorithm to specify these three data types.
~ WO95/10148 ~ 3, i~ 2~73732 PCT~us94/lll99 Having chosen m, e¦m, b~ 1~, choose another direct product of rings ~' = rI R', =1 which together with m, elm, b determine PRAG as in section 2. We may now define MUSE as an autonomous finite state system satisfying M1 - M11. We proceed to specify the input alphabet UMUSE~ the output alphabet YMUSE~ the set of states SMUSE~ the next state function fMusE, and the output function 9MUSE~ for MUSE.
First, m UMUSE = YMUSE = YPRAG = I1: Ri .
i=l This agrees with our earlier description of YPRAG after noting the isomorphism ~ bl bl+l b( ~ +l \
(bl, ~bm) ~ b~ b2t . . . bm~ J ~
i.e., this corresponds to laying out the buffers in an array of e rows and e columns.
Second, the set of states for MUSE is the same as the set of~states for PRAG, SMUSE = SPRAG -- Similarly, the next state function fMUSE = fPRAG ~
WO 95/10148 e ~ rt~ $ 2 1 ? 3 7 3 2 PCT/US94/11199 but the output functions 9MUsE ~ 9PRAG ~
are different.
MUSE will have two possible output modes: the encryption output func-tion, denoted gMnucSrEPt and the decryption output function, denoted gMeucsrEpt.Let u(t) ~ UMUSE be a multistream input of data which arrives at time t, which we envision as instantaneously filling m buffers of lengths bl, . . ., bm.We define the output functions for MUSE by the rules 9enCrypt (s(t)~ U(t)) = U(t) + 9PRAG(~(t)) gdecrypt (~S(t), U(t)) = U(t) 9PRAG( ( )) where addition (subtraction) is performed componentwise in the direct prod-uct of rings ~. The block diagram ' IPRAG ¦
9 P}IAG
UMUSE ¦ MUSE ¦ ~ YMUSE
9MUsE
completes our construction.
We conclude the mathematical description of MUSE by noting that a , .
surveillance me~.h~ni~m derives from the following observations:
If decryption is performed with an illegal seed key s'(O) ~ s(O) (where s(O) is the legitimate seed key), then the output will be a pseudorandom time WO 95/10148 ~ 2 1 7 3 7 3 2 PCT/US94/11199 parametrized array which may be quickly detected via simple statistical tests of counting zeros and ones and blocks of zeros (gaps) and blocks of ones (runs).Moreover, the overall space-time complexity of the surveillance mechanism is negligible and its benefit to the user, subst~rlti~l.
Fix a positive integer m and a vector b = (bl,b2,... ~bm) of positive inte-gers. We assume we have m data bufl~ers Bdata Bdata m of sizes bl,... ~bm~ A multistream of data enters and fills each data buffer Bdata with a bi-tuple of elements in a finite ring Ri. The bit size of this b~-tuple is in general larger than bi. This, hc)w~vel, poses no problem in our subsequent discussion. Let .
Ri i=l be the direct product of the m finite rings Ri. The choice of m, b, and ~ deter-mines the algebraic structure in which MUSE operates and MUSE provides the user with an algorithm to specify these three data types.
~ WO95/10148 ~ 3, i~ 2~73732 PCT~us94/lll99 Having chosen m, e¦m, b~ 1~, choose another direct product of rings ~' = rI R', =1 which together with m, elm, b determine PRAG as in section 2. We may now define MUSE as an autonomous finite state system satisfying M1 - M11. We proceed to specify the input alphabet UMUSE~ the output alphabet YMUSE~ the set of states SMUSE~ the next state function fMusE, and the output function 9MUSE~ for MUSE.
First, m UMUSE = YMUSE = YPRAG = I1: Ri .
i=l This agrees with our earlier description of YPRAG after noting the isomorphism ~ bl bl+l b( ~ +l \
(bl, ~bm) ~ b~ b2t . . . bm~ J ~
i.e., this corresponds to laying out the buffers in an array of e rows and e columns.
Second, the set of states for MUSE is the same as the set of~states for PRAG, SMUSE = SPRAG -- Similarly, the next state function fMUSE = fPRAG ~
WO 95/10148 e ~ rt~ $ 2 1 ? 3 7 3 2 PCT/US94/11199 but the output functions 9MUsE ~ 9PRAG ~
are different.
MUSE will have two possible output modes: the encryption output func-tion, denoted gMnucSrEPt and the decryption output function, denoted gMeucsrEpt.Let u(t) ~ UMUSE be a multistream input of data which arrives at time t, which we envision as instantaneously filling m buffers of lengths bl, . . ., bm.We define the output functions for MUSE by the rules 9enCrypt (s(t)~ U(t)) = U(t) + 9PRAG(~(t)) gdecrypt (~S(t), U(t)) = U(t) 9PRAG( ( )) where addition (subtraction) is performed componentwise in the direct prod-uct of rings ~. The block diagram ' IPRAG ¦
9 P}IAG
UMUSE ¦ MUSE ¦ ~ YMUSE
9MUsE
completes our construction.
We conclude the mathematical description of MUSE by noting that a , .
surveillance me~.h~ni~m derives from the following observations:
If decryption is performed with an illegal seed key s'(O) ~ s(O) (where s(O) is the legitimate seed key), then the output will be a pseudorandom time WO 95/10148 ~ 2 1 7 3 7 3 2 PCT/US94/11199 parametrized array which may be quickly detected via simple statistical tests of counting zeros and ones and blocks of zeros (gaps) and blocks of ones (runs).Moreover, the overall space-time complexity of the surveillance mechanism is negligible and its benefit to the user, subst~rlti~l.
4. Example [1]
We employ the notation of section 3. Let m be a fixed small positive integer and let b = (bl,b2,... ~bm) again denote a fixed vector of positive integers.
Let '7?, E'm be the direct product of m copies of ~2. Choose ~ = 1 which satisfies the condition that e divides m.
Following the notation of [L-N], denote (for a positive integer N) the finite ring of integers (mod N) by ~/(N). We shall say a prime number p is ~ucce~ive if p--3 is divisible by 4, (p--1)/2 is also a prime, and ( P2 1--1)/2 is again a prime. Define the function ~(x) = +1 if ( ~2 1--1)/8 is an integer and ~(~) =--1 if ( ~2 1 + 1)/8 is an integer. Choose two large ~ucce~ive primes p, q satisfying ~(p) ~ 14(q)~ and define the ring ~ /(N) with N = pq.
With these choices for m,~, and ~' we shall now describe a pseudorandomarray generator PRAG. The peculiar choice of N insures a very long cycle length (see L. Blum, M. Blum, and M. Shub, Siam J. Comput. Vol 15, No. 2 (1986), 364-383) in PRAG.
The state set SPRAG is the set 1~ /(N). The next state function fpRAG
WO 95/10148 ~ rS 2 t 1 g73 2 PCT/US94/11199 ~
is defined by the rule:
fPRAG(~S(t)) = ~S(t) + 1 = s(t + 1) (mod N).
Now we specify the output function gpRAG- Code the elements of ~/(IV) as binary coded integers of fixed length exceeding m. It is required that m <
log2(N). For ~ /(N) define Projm(:Z~) to be the last m bits of 2~ in this coding. We now describe an algorithm to compute gpRAG(~(t)). All arithmetic is performed in the ring ~/(N).
Step 1. Compute b = max{bl, , bm } -Step 2. Compute the b-element vector ~t) = (~(t)2, 5(t)4, ..., .S(t)2 ) .
Step 3. Apply Projm to each component of ~t) obt~ining (PrOim (5(t)2)~ Proim (~(t)2 )) -Step 4. Create the dynamic array Dl(t) of b rows and m columns where the jth row is the vector Projm (~(t)2j ) .
Step 5. Shape a new array D2(t) which has b rows but whose column lengths vary. ~or 1 < j ~ m, the jLh column of D2(t) will consist of bj elements, namely, the first bj elem.onts of the jth column of Dl(t).
This describes the output function 9PRAG at time t. In this example encrypt _ decrypt 9MUsE gMUSE
because addition and subtraction are the same in E`2, the finite field of two elements.
~ WO95/10148 ~ 2 1 t3. ~3.2 PCTlus94/lll99
We employ the notation of section 3. Let m be a fixed small positive integer and let b = (bl,b2,... ~bm) again denote a fixed vector of positive integers.
Let '7?, E'm be the direct product of m copies of ~2. Choose ~ = 1 which satisfies the condition that e divides m.
Following the notation of [L-N], denote (for a positive integer N) the finite ring of integers (mod N) by ~/(N). We shall say a prime number p is ~ucce~ive if p--3 is divisible by 4, (p--1)/2 is also a prime, and ( P2 1--1)/2 is again a prime. Define the function ~(x) = +1 if ( ~2 1--1)/8 is an integer and ~(~) =--1 if ( ~2 1 + 1)/8 is an integer. Choose two large ~ucce~ive primes p, q satisfying ~(p) ~ 14(q)~ and define the ring ~ /(N) with N = pq.
With these choices for m,~, and ~' we shall now describe a pseudorandomarray generator PRAG. The peculiar choice of N insures a very long cycle length (see L. Blum, M. Blum, and M. Shub, Siam J. Comput. Vol 15, No. 2 (1986), 364-383) in PRAG.
The state set SPRAG is the set 1~ /(N). The next state function fpRAG
WO 95/10148 ~ rS 2 t 1 g73 2 PCT/US94/11199 ~
is defined by the rule:
fPRAG(~S(t)) = ~S(t) + 1 = s(t + 1) (mod N).
Now we specify the output function gpRAG- Code the elements of ~/(IV) as binary coded integers of fixed length exceeding m. It is required that m <
log2(N). For ~ /(N) define Projm(:Z~) to be the last m bits of 2~ in this coding. We now describe an algorithm to compute gpRAG(~(t)). All arithmetic is performed in the ring ~/(N).
Step 1. Compute b = max{bl, , bm } -Step 2. Compute the b-element vector ~t) = (~(t)2, 5(t)4, ..., .S(t)2 ) .
Step 3. Apply Projm to each component of ~t) obt~ining (PrOim (5(t)2)~ Proim (~(t)2 )) -Step 4. Create the dynamic array Dl(t) of b rows and m columns where the jth row is the vector Projm (~(t)2j ) .
Step 5. Shape a new array D2(t) which has b rows but whose column lengths vary. ~or 1 < j ~ m, the jLh column of D2(t) will consist of bj elements, namely, the first bj elem.onts of the jth column of Dl(t).
This describes the output function 9PRAG at time t. In this example encrypt _ decrypt 9MUsE gMUSE
because addition and subtraction are the same in E`2, the finite field of two elements.
~ WO95/10148 ~ 2 1 t3. ~3.2 PCTlus94/lll99
5. Example [2]
As a second example of MUSE, we describe an extremely rapid encryption system which can be implemented in software. From the user's point of view, the system runs as follows. The user chooses a password which internally leads to a certain configuration of finite fields. The password is not in memory!
Every time the user opens MUSE he must type in his password. If the user wants to encrypt a specific file he can either use his password (default choice)or choose a special key for that file. At this point MUSE encrypts the file and erases the key, password, and original file. All that r~m~in~ is an encrypted copy of the file. To decrypt the file, the user opens MUSE, chooses the file, types in the same password and key, and MUSE decrypts the file. If the wrong password or key is chosen, the file will not decrypt.
We now describe the principle of operation for this example of MUSE using concrete numbers. First, we choose 4 successive primes Po,Pl,P2,P3 of the same approxim~te bit length (see example [1] for the definition of successive prime). For example, we may choose-pO = 7247, Pl = 7559, P2 = 7607, p3 = 7727.
We assign Pk with the binary expansion of k, i.e. pO is assigned to 00, Pl isassigned to 01, P2 is assigned to 10, and p3 is assigned to 11.
po = 7247 ~ 00 Pl = 7559 ~ 01 P2 = 7607 ~ 10 p3 = 7727 ~ 11 Table 1: Prime Assignrnent Table ~ 3 WO 95/10148 ~`~ 7 7 2 PCT/USg4 e now describe a Prime Configuration ~hine which converts a password = 16-bit number into a list of 8 primes {pl, p2, p3, p4, p5, p6, p7, p8} where each pi (for l < i < 8) is one of the four primes 7247, 7559, 7607, 7727. The 16-bit password is simply broken up into 8 two-bit pieces and the Prime Assignment Table is then used to configure the primes. For example, if the password is 11 11 01 10 00 01 00 00, (the first 16 significant bits in the binary expansion of ~) then the prime configuration would be {P3, P3, Pl, P2~ Po, Pl, Pl, Po}-The block diagram for the Prime Configuration M~rhine is shown in figure 1.
The system may include an input pas~wold 10. The illustrated embodiment shows a 16-bit input password. The password or a user selected special key should not be retained in memory or stored after the encryption process is complete. The password itself may not be suitable for use as a seed key for pseudorandom array generation. The prime configuration block 11 maps the password into a series Qf primes for use in generating a series of keys. The mapping may be done by any ~ariety of me~ . According to the preferred embodiment, a prime assignment table 12, in the form of a look-up table, is utilized. Alternatively, the mapping may be accomplished by hardware logic gating or by calculating successive primes based on a default1 user input or a pseudorandom input.
Next we describe a Pseudorandom Vector Key Generator, shown in figure 2, which from a single seed key s(0) (13-bit number) 20, generates a vector ~ WO95/10148 ~ E ~ 2 1 i37-32 PCT/US94/11199 or list of 8 keys:
{s(1), s(2), s(3), s(4), s(5), s(6), s(7), s(8)}.
The seed key s(0) is either the first 13 bits of the password (default choice) or another user optional 13-bit number. The recipe for generating the keys s(k) (for k = 1,2,3, . . .8)is given by the next state function:
s(k) = s(k--1)2 + 1 (mod P~
For ~x~rnple, if we use the first 13 bits of the pas~wor.l, we have:
s(0) = 11 11 01 10 00 01 0 = 7874.
The Pseudorandom Vector Key Generator 21, computes the eight keys as follows:
s(l) = s(o)2 + 1 (mod p3) = 78742 + 1 (mod 7727) = 6156 s(2) = 61562 + 1 (mod 7727) = 3129 s(3) = 31292 + 1 (mod 7559) = 1737 s(4) = 17372 + 1 (mod 7607) = 4798 s(5) = 47982 + 1 (mod 7247) = 4333 s(6) = 43332 + 1 (mod 7559) = 5893 s(7) = 58932 + 1 (mod 7559) = 1404 s(8) = 14042 + 1 (mod 7247) = 33.
We have thus obtained the key vector {6156,3129,1737,4789,4333,5893,1404,33}.
This process can be repeated by setting the new s(0) = ~(8). The Pseudo-random Vector Key Generator is advantageously implemented in software.
r WO95/10148 ~ 21 i3732 PCTIUS94/11199 Alternatively, in order to maximize speed, the Generator may be hard~,vare implemented.
Next, we describe a Pseudorandom Column Generator, shown in figure 3, which for each seed key ~(k) (with 1 < k < 8) 31, generates a column vector of 8 two-bit binary numbers. The Colllmn Generator 32 uses a projection operator which we now ll.ofine. The projection operator Projm(2) picks ofl~
the last m digits in the binary ~xp~ ion of 2~.
F'.~r~mples:
Projl(llO10010110) = O
Proj2(11010010110) = 10 Proj3(11010010110) = 110 Proj4(11010010110) = 0110 Proj5(11010010110) = 10110 Proj6(11010010110) = 010110.
The Column Generator can be succinctly described as a two step process:
Step (1) Compute (s(k)2l,~(k)22,~(k)2~ ~(k)2a) (mod P~) Step (2) Apply Proj2 to each element in the above list to obtain the column ~ WO95/10148 ~ 21 73732 PCT/US94/11199 vector Proj2 (s(k)2l ) \
i2 ( ( ) ) Proj2 (s(k)2 ) Proj2 (~(k)2 ) Proj2 (s(k)2 ) Proj2 (.5(k)26) Proj2 (s(k)2 ) ~Proj2 (~(k)28) In our exalnple, we have:
s(1) = 6156 = 3128 = 110000111000 ~(1)4 = 2002= 11111010010 s(1)8 = 5418 = 1010100101010 s(1)l6 = 7578= 1110110011010 s(1)32 = 6747 = 1101001011011 s(1)64 = 2252 = 10001100100 - s(1)l28 = 2592 = 101000100000 . ~(1)256 = 3701 = 111001110101.
WO 95110148 ~ 3 i 32 PCT/US94/11199 ~
After applying Proj2 we obtain the column ~ector:
~0 0\
O O
O O
~ O ~
Repeating this calculation for ~(2) = 3129 we obtain (~(2)2 ,~(2)2 ,~(2)2 ,... ,~(2) ) (mod 7727) =
= (532,4852,5462,7224,5745,3008,7474,2193), which, after applying Proj2 yields ~0 0\
O O
O O
O O
~O 1~.
~ WO 95110148 ~ ,. t~; ~ 2 1 7`3 732 PCT/USg4/lll99 Repeating this calculation for ~(3) = 1737 we obtain ~(3)22 s(3)23,~ (3)28) (mod 7559) =
= (1128,2472,3112,1465, 7028,2278,3810,2820), which, after applying Proj2 yields /0 0\
O O
O O
, O O
~O 0).
Repeating this calculation for ~(4) = 4798 we obtain (3(4)21 s(4)22 ~(4)2~, .. ,~(4)2 ) (mod 7607) =
= (2022,3525,3394,2238,3238,2198,759,5556), WO95/10148 ~ . f. '~ 2~dit'r3?32 PCT/US94/11199 ~
which, after applying Proj2 yields ~O O~.
Repeating this calculation for s(5) = 4333 we obtain (S(5)2 ,S(5)22,s(5)23 ~3(5)28) ( = (5159,4297,6100,3902,6904,1697,2750,3879), which, after applying Proj2 yields O O
O O
~1 1).
~ WO 95/10148 ~ 2 1 7 3 7 3 2 PCT/US94/11199 Repeating this calculation for s(6) = 5893 we obtain (s(6)2 , s(6)22, S(6)23 (6)28) = (1403, 3069, 247, 537, 1127, 217, 1735, 1743), which, after applying Proj2 yields Repeating this calculation for s(7) = 1404 we obtain (5(7)2 ,5(7)2 ,5(7)23 s(7)2~) (m d 7559) = (5876, 5423, 4419, 2664, 6554, 4678, 379, 20), WO9S/10148 ~ ,S ? ~I t~ 7~2 PCT/USg4/lll99 ~
which, after applying Proj2 yields /0 O~
O O
~O 0~.
Repeating this calculation for s(8) = 33 we obtain (s(8)2 ,s(8)22,s(8)2~ s(8)2a) (m d 7247) = (1089,4660,3588,3072,1590,6144,6360,4093), which, after applying Proj2 yields O O
O O
O O
O O
O O
~O 1~.
Finally, the 8 columns can be put together to form a~ 8 by 8 array of 2-bit WO 95/10148 ~ 5 2 1 7 3 7 3 2 PCT~US94/11199 numbers:
00 00 00 10 11 11 00 01 \
~ 01 01 00 00 11 11 00 01 ~ .
A plurality of column generators 32 can be combined using parallel com-puting structures to obtain a pseudorandom array generator 41, shown in figure 4. This completes the description of the pseudorandom array genera-tor PRAG for this particular ex~ nple of MUSE. The schematic for PRAG is illustrated in figure 5.
Finally, we complete the description of MUSE for this ex~n~ple. There will be 2 buffers. Each buffer will consist of an 8 by 16 array. At each discrete time instance (state), PRAG will fill the first array with pseudorandomly chosen zeroes and ones while the other buffer will fill with incoming data. The bits in each array are added componentwise (mod 2) yielding the encrypted data which is then shipped. The buffers are erased and ready for the next state.
For example, if the incoming data is a large X, and the output of PRAG is the array (*) previously computed, then the buffers will be filled as follows:
WO95/10148 ~ 2~i 73~3-~ PCT~Us94,lll99 ~
00 00 00 10 11 11 00 01 \/ 11 00 00 00 00 00 00 11 01 01 00 00 11 11 00 01 ~~ 11 00 00 00 00 00 00 11 PRAG output Incoming Data After componentvvise addition (mod 2), the configuration changes to-~00 00 00 00 00 00 00 ' 00\ /11 00 00 10 11 11 00 10 ~ oo 00 00 00 00 00 00 00 ~~ 10 01 00 00 11 11 00 10 where the right hand buffer contains the encrypted data and the left handbuffer is cleared. The encrypted data is now shipped and the buffers are completely erased and ready for the next state s WO 95/10148 r ~ S t ~ ^ 2 1 7 3 ~3 2 PCT/US94/11199 / 00 00 00 00 00 00 00 00 \~ 00 00 00 00 00 00 00 00 00 00 ~0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~~ 00 00 00 00 00 00 00 00 Since addition is performed (mod 2) it is easily seen that if encryption is performed twice in succession then we will obtain our original data back Hence, the processes of encryption and decryption are the same.
F~r~rnple 2 (with 4 primes of bit length 16) was implemented in C pro-gr~rnming language and run on a 50 MHZ personal computer. To increase computational speed, table look-up was used with regard to squaring mod-ulo each of the four primes. The program was tested on a 1 Megabit input data file which was set as a 1000 by 1000 two dimensional array. The program spends more than 99~o of its time in a tight loop executing the Pseudorandom Column Generator (see figure 4).
This loop has the following Intel 486 instructions: 4 MOVE(1) instructions,
As a second example of MUSE, we describe an extremely rapid encryption system which can be implemented in software. From the user's point of view, the system runs as follows. The user chooses a password which internally leads to a certain configuration of finite fields. The password is not in memory!
Every time the user opens MUSE he must type in his password. If the user wants to encrypt a specific file he can either use his password (default choice)or choose a special key for that file. At this point MUSE encrypts the file and erases the key, password, and original file. All that r~m~in~ is an encrypted copy of the file. To decrypt the file, the user opens MUSE, chooses the file, types in the same password and key, and MUSE decrypts the file. If the wrong password or key is chosen, the file will not decrypt.
We now describe the principle of operation for this example of MUSE using concrete numbers. First, we choose 4 successive primes Po,Pl,P2,P3 of the same approxim~te bit length (see example [1] for the definition of successive prime). For example, we may choose-pO = 7247, Pl = 7559, P2 = 7607, p3 = 7727.
We assign Pk with the binary expansion of k, i.e. pO is assigned to 00, Pl isassigned to 01, P2 is assigned to 10, and p3 is assigned to 11.
po = 7247 ~ 00 Pl = 7559 ~ 01 P2 = 7607 ~ 10 p3 = 7727 ~ 11 Table 1: Prime Assignrnent Table ~ 3 WO 95/10148 ~`~ 7 7 2 PCT/USg4 e now describe a Prime Configuration ~hine which converts a password = 16-bit number into a list of 8 primes {pl, p2, p3, p4, p5, p6, p7, p8} where each pi (for l < i < 8) is one of the four primes 7247, 7559, 7607, 7727. The 16-bit password is simply broken up into 8 two-bit pieces and the Prime Assignment Table is then used to configure the primes. For example, if the password is 11 11 01 10 00 01 00 00, (the first 16 significant bits in the binary expansion of ~) then the prime configuration would be {P3, P3, Pl, P2~ Po, Pl, Pl, Po}-The block diagram for the Prime Configuration M~rhine is shown in figure 1.
The system may include an input pas~wold 10. The illustrated embodiment shows a 16-bit input password. The password or a user selected special key should not be retained in memory or stored after the encryption process is complete. The password itself may not be suitable for use as a seed key for pseudorandom array generation. The prime configuration block 11 maps the password into a series Qf primes for use in generating a series of keys. The mapping may be done by any ~ariety of me~ . According to the preferred embodiment, a prime assignment table 12, in the form of a look-up table, is utilized. Alternatively, the mapping may be accomplished by hardware logic gating or by calculating successive primes based on a default1 user input or a pseudorandom input.
Next we describe a Pseudorandom Vector Key Generator, shown in figure 2, which from a single seed key s(0) (13-bit number) 20, generates a vector ~ WO95/10148 ~ E ~ 2 1 i37-32 PCT/US94/11199 or list of 8 keys:
{s(1), s(2), s(3), s(4), s(5), s(6), s(7), s(8)}.
The seed key s(0) is either the first 13 bits of the password (default choice) or another user optional 13-bit number. The recipe for generating the keys s(k) (for k = 1,2,3, . . .8)is given by the next state function:
s(k) = s(k--1)2 + 1 (mod P~
For ~x~rnple, if we use the first 13 bits of the pas~wor.l, we have:
s(0) = 11 11 01 10 00 01 0 = 7874.
The Pseudorandom Vector Key Generator 21, computes the eight keys as follows:
s(l) = s(o)2 + 1 (mod p3) = 78742 + 1 (mod 7727) = 6156 s(2) = 61562 + 1 (mod 7727) = 3129 s(3) = 31292 + 1 (mod 7559) = 1737 s(4) = 17372 + 1 (mod 7607) = 4798 s(5) = 47982 + 1 (mod 7247) = 4333 s(6) = 43332 + 1 (mod 7559) = 5893 s(7) = 58932 + 1 (mod 7559) = 1404 s(8) = 14042 + 1 (mod 7247) = 33.
We have thus obtained the key vector {6156,3129,1737,4789,4333,5893,1404,33}.
This process can be repeated by setting the new s(0) = ~(8). The Pseudo-random Vector Key Generator is advantageously implemented in software.
r WO95/10148 ~ 21 i3732 PCTIUS94/11199 Alternatively, in order to maximize speed, the Generator may be hard~,vare implemented.
Next, we describe a Pseudorandom Column Generator, shown in figure 3, which for each seed key ~(k) (with 1 < k < 8) 31, generates a column vector of 8 two-bit binary numbers. The Colllmn Generator 32 uses a projection operator which we now ll.ofine. The projection operator Projm(2) picks ofl~
the last m digits in the binary ~xp~ ion of 2~.
F'.~r~mples:
Projl(llO10010110) = O
Proj2(11010010110) = 10 Proj3(11010010110) = 110 Proj4(11010010110) = 0110 Proj5(11010010110) = 10110 Proj6(11010010110) = 010110.
The Column Generator can be succinctly described as a two step process:
Step (1) Compute (s(k)2l,~(k)22,~(k)2~ ~(k)2a) (mod P~) Step (2) Apply Proj2 to each element in the above list to obtain the column ~ WO95/10148 ~ 21 73732 PCT/US94/11199 vector Proj2 (s(k)2l ) \
i2 ( ( ) ) Proj2 (s(k)2 ) Proj2 (~(k)2 ) Proj2 (s(k)2 ) Proj2 (.5(k)26) Proj2 (s(k)2 ) ~Proj2 (~(k)28) In our exalnple, we have:
s(1) = 6156 = 3128 = 110000111000 ~(1)4 = 2002= 11111010010 s(1)8 = 5418 = 1010100101010 s(1)l6 = 7578= 1110110011010 s(1)32 = 6747 = 1101001011011 s(1)64 = 2252 = 10001100100 - s(1)l28 = 2592 = 101000100000 . ~(1)256 = 3701 = 111001110101.
WO 95110148 ~ 3 i 32 PCT/US94/11199 ~
After applying Proj2 we obtain the column ~ector:
~0 0\
O O
O O
~ O ~
Repeating this calculation for ~(2) = 3129 we obtain (~(2)2 ,~(2)2 ,~(2)2 ,... ,~(2) ) (mod 7727) =
= (532,4852,5462,7224,5745,3008,7474,2193), which, after applying Proj2 yields ~0 0\
O O
O O
O O
~O 1~.
~ WO 95110148 ~ ,. t~; ~ 2 1 7`3 732 PCT/USg4/lll99 Repeating this calculation for ~(3) = 1737 we obtain ~(3)22 s(3)23,~ (3)28) (mod 7559) =
= (1128,2472,3112,1465, 7028,2278,3810,2820), which, after applying Proj2 yields /0 0\
O O
O O
, O O
~O 0).
Repeating this calculation for ~(4) = 4798 we obtain (3(4)21 s(4)22 ~(4)2~, .. ,~(4)2 ) (mod 7607) =
= (2022,3525,3394,2238,3238,2198,759,5556), WO95/10148 ~ . f. '~ 2~dit'r3?32 PCT/US94/11199 ~
which, after applying Proj2 yields ~O O~.
Repeating this calculation for s(5) = 4333 we obtain (S(5)2 ,S(5)22,s(5)23 ~3(5)28) ( = (5159,4297,6100,3902,6904,1697,2750,3879), which, after applying Proj2 yields O O
O O
~1 1).
~ WO 95/10148 ~ 2 1 7 3 7 3 2 PCT/US94/11199 Repeating this calculation for s(6) = 5893 we obtain (s(6)2 , s(6)22, S(6)23 (6)28) = (1403, 3069, 247, 537, 1127, 217, 1735, 1743), which, after applying Proj2 yields Repeating this calculation for s(7) = 1404 we obtain (5(7)2 ,5(7)2 ,5(7)23 s(7)2~) (m d 7559) = (5876, 5423, 4419, 2664, 6554, 4678, 379, 20), WO9S/10148 ~ ,S ? ~I t~ 7~2 PCT/USg4/lll99 ~
which, after applying Proj2 yields /0 O~
O O
~O 0~.
Repeating this calculation for s(8) = 33 we obtain (s(8)2 ,s(8)22,s(8)2~ s(8)2a) (m d 7247) = (1089,4660,3588,3072,1590,6144,6360,4093), which, after applying Proj2 yields O O
O O
O O
O O
O O
~O 1~.
Finally, the 8 columns can be put together to form a~ 8 by 8 array of 2-bit WO 95/10148 ~ 5 2 1 7 3 7 3 2 PCT~US94/11199 numbers:
00 00 00 10 11 11 00 01 \
~ 01 01 00 00 11 11 00 01 ~ .
A plurality of column generators 32 can be combined using parallel com-puting structures to obtain a pseudorandom array generator 41, shown in figure 4. This completes the description of the pseudorandom array genera-tor PRAG for this particular ex~ nple of MUSE. The schematic for PRAG is illustrated in figure 5.
Finally, we complete the description of MUSE for this ex~n~ple. There will be 2 buffers. Each buffer will consist of an 8 by 16 array. At each discrete time instance (state), PRAG will fill the first array with pseudorandomly chosen zeroes and ones while the other buffer will fill with incoming data. The bits in each array are added componentwise (mod 2) yielding the encrypted data which is then shipped. The buffers are erased and ready for the next state.
For example, if the incoming data is a large X, and the output of PRAG is the array (*) previously computed, then the buffers will be filled as follows:
WO95/10148 ~ 2~i 73~3-~ PCT~Us94,lll99 ~
00 00 00 10 11 11 00 01 \/ 11 00 00 00 00 00 00 11 01 01 00 00 11 11 00 01 ~~ 11 00 00 00 00 00 00 11 PRAG output Incoming Data After componentvvise addition (mod 2), the configuration changes to-~00 00 00 00 00 00 00 ' 00\ /11 00 00 10 11 11 00 10 ~ oo 00 00 00 00 00 00 00 ~~ 10 01 00 00 11 11 00 10 where the right hand buffer contains the encrypted data and the left handbuffer is cleared. The encrypted data is now shipped and the buffers are completely erased and ready for the next state s WO 95/10148 r ~ S t ~ ^ 2 1 7 3 ~3 2 PCT/US94/11199 / 00 00 00 00 00 00 00 00 \~ 00 00 00 00 00 00 00 00 00 00 ~0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ~~ 00 00 00 00 00 00 00 00 Since addition is performed (mod 2) it is easily seen that if encryption is performed twice in succession then we will obtain our original data back Hence, the processes of encryption and decryption are the same.
F~r~rnple 2 (with 4 primes of bit length 16) was implemented in C pro-gr~rnming language and run on a 50 MHZ personal computer. To increase computational speed, table look-up was used with regard to squaring mod-ulo each of the four primes. The program was tested on a 1 Megabit input data file which was set as a 1000 by 1000 two dimensional array. The program spends more than 99~o of its time in a tight loop executing the Pseudorandom Column Generator (see figure 4).
This loop has the following Intel 486 instructions: 4 MOVE(1) instructions,
6 Shift(6) instructions, 1 ADD(1) instruction, one AND(1) instruction, one ADD(1) instruction and 3 OR(3) instructions. The number of clock cycles needed to execute an instruction are given in parenthesis. The result code can be further optimized in assembly language.
WO95/10148 ~ ~ ~ ;i ' ? ~ PCT/US94/11199 The sum of the clock cycles for this loop is approximately 50. It takes 1 microsecond to execute this loop on a 50 MHZ (50,000,000 clock cycles per second) computer. The projection operator is of length 2, therefore, the ap-prnxim~te time needed to encode a 1 Megabit input file is 500,000 microsec-onds or 0.5 seconds. The latter, of course, does not include the operating system overhead.
To give a concrete ~ nple, a low resolution page of fax (which is a 1 Megabit uncompressed file) will be encrypted in about half of a second. A
high resolution page of fax (200x200 dots per square inch = 4 Megabit file) will be encrypted in approxim~tely 2 seconds which is negligible compared to fax tr~ mi~ion. If encryption is performed after file compression, then the file will shrink by a factor of 20 and encryption will be of the order of 1/10 of one second. If encryption is performed on an ASCII text file where each symbol is represented by 8 bits, then encryption of 1,000,000 text symbols (one megabyte file) will require apprn~im~tely 4 seconds.
WO95/10148 ~ ~ ~ ;i ' ? ~ PCT/US94/11199 The sum of the clock cycles for this loop is approximately 50. It takes 1 microsecond to execute this loop on a 50 MHZ (50,000,000 clock cycles per second) computer. The projection operator is of length 2, therefore, the ap-prnxim~te time needed to encode a 1 Megabit input file is 500,000 microsec-onds or 0.5 seconds. The latter, of course, does not include the operating system overhead.
To give a concrete ~ nple, a low resolution page of fax (which is a 1 Megabit uncompressed file) will be encrypted in about half of a second. A
high resolution page of fax (200x200 dots per square inch = 4 Megabit file) will be encrypted in approxim~tely 2 seconds which is negligible compared to fax tr~ mi~ion. If encryption is performed after file compression, then the file will shrink by a factor of 20 and encryption will be of the order of 1/10 of one second. If encryption is performed on an ASCII text file where each symbol is represented by 8 bits, then encryption of 1,000,000 text symbols (one megabyte file) will require apprn~im~tely 4 seconds.
Claims (16)
1. An apparatus for encrypting blocks of data comprising:
a first finite state machine responsive to a seed key to generate a plurality of keys from said seed key:
a second finite state machine responsive to said plurality of keys to generate a pseudorandom encryption array.
a first finite state machine responsive to a seed key to generate a plurality of keys from said seed key:
a second finite state machine responsive to said plurality of keys to generate a pseudorandom encryption array.
2. An apparatus according to claim 1, wherein said first and second finite state machines exhibit a varying output in both time and space.
3. An apparatus according to claim 1, further comprising means for combining said pseudorandom encryption array with a data array.
4. An apparatus according to claim 3, wherein said means for combining is a means for encrypting information in said data buffer.
5. An apparatus according to claim 4, wherein said means for combining is a means for decrypting information in said data buffer.
6. An apparatus for encrypting blocks of data comprising:
a key vector generator having a seed key input and at least one next-state output;
a pseudorandom array generator connected to said key vector generator;
an encryption array buffer connected to said pseudorandom array generator;
a data buffer;
means for combining information contained in said encryption array buffer with information contained in said data buffer.
a key vector generator having a seed key input and at least one next-state output;
a pseudorandom array generator connected to said key vector generator;
an encryption array buffer connected to said pseudorandom array generator;
a data buffer;
means for combining information contained in said encryption array buffer with information contained in said data buffer.
7. An apparatus according to claim 6, wherein said key vector generator and said array generator are configured to generate multiple independent pseudorandom sequences using the same quantity of non-linear operations as required to produce one independent pseudorandom sequence.
8. An apparatus according to claim 6, wherein said key vector generator is configured to generate a time parametrized key.
9. An apparatus according to claim 6, wherein said pseudorandom array generator is a pseudorandom chosen ring based generator.
10. An apparatus according to claim 6, further comprising a statistical monitor connected to said data buffer for detecting unauthorized decryption attempts.
11. An apparatus according to claim 6, wherein said pseudorandom array generator comprises a plurality of parallel processors.
12. An apparatus according to claim 6 wherein said pseudorandom array generator is an iterative real time array generator.
13. A method for encrypting blocks of data comprising the steps of:
generating a plurality of pseudorandom keys from a seed key;
generating one or more pseudorandom arrays from each key;
storing said arrays in an encryption buffer;
combining data with information in said encryption buffer.
generating a plurality of pseudorandom keys from a seed key;
generating one or more pseudorandom arrays from each key;
storing said arrays in an encryption buffer;
combining data with information in said encryption buffer.
14. A method according to claim 13, further comprising the step of:
storing information in a data buffer.
storing information in a data buffer.
15. A method according to claim 14, wherein the step of combining is an addition and operates to encrypt or decrypt data.
16. A method according to claim 14, further comprising the step of storing said arrays into a plurality of buffers and storing a plurality of data streams into a plurality of corresponding data buffers.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US08/131,542 US5440640A (en) | 1993-10-05 | 1993-10-05 | Multistream encryption system for secure communication |
| US08/131,542 | 1993-10-05 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2173732A1 true CA2173732A1 (en) | 1995-04-13 |
Family
ID=22449904
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002173732A Abandoned CA2173732A1 (en) | 1993-10-05 | 1994-10-04 | Multistream encryption system for secure communication |
Country Status (6)
| Country | Link |
|---|---|
| US (1) | US5440640A (en) |
| EP (1) | EP0722642A4 (en) |
| JP (1) | JPH09505901A (en) |
| AU (1) | AU674461B2 (en) |
| CA (1) | CA2173732A1 (en) |
| WO (1) | WO1995010148A1 (en) |
Families Citing this family (30)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5799090A (en) * | 1995-09-25 | 1998-08-25 | Angert; Joseph C. | pad encryption method and software |
| JPH09162859A (en) * | 1995-12-07 | 1997-06-20 | Fujitsu Ltd | Scrambling method and device, descrambling method and device and data transmission method and system |
| US6078667A (en) * | 1996-10-10 | 2000-06-20 | Certicom Corp. | Generating unique and unpredictable values |
| US6094486A (en) * | 1997-06-19 | 2000-07-25 | Marchant; Brian E. | Security apparatus for data transmission with dynamic random encryption |
| US6236728B1 (en) | 1997-06-19 | 2001-05-22 | Brian E. Marchant | Security apparatus for data transmission with dynamic random encryption |
| US6240183B1 (en) | 1997-06-19 | 2001-05-29 | Brian E. Marchant | Security apparatus for data transmission with dynamic random encryption |
| CA2210199A1 (en) * | 1997-07-11 | 1999-01-11 | Mitel Corporation | Method and apparatus for the generation of non-linear confusion data |
| US20020002675A1 (en) | 1997-08-06 | 2002-01-03 | Ronald Roscoe Bush | Secure encryption of data packets for transmission over unsecured networks |
| US6275586B1 (en) * | 1998-09-10 | 2001-08-14 | Igt | Cryptographically secure pseudo random number generator |
| AU3324599A (en) * | 1999-03-16 | 2000-10-04 | Valentin Alexandrovich Mischenko | Method and apparatus for encoding and decoding information |
| US7006633B1 (en) | 1999-07-16 | 2006-02-28 | Global Encryption Standard Corporation | Global encryption system |
| DE69929251T2 (en) * | 1999-10-20 | 2006-07-13 | Fujitsu Ltd., Kawasaki | ENCRYPTION SYSTEM WITH A KEY OF CHANGING LENGTH |
| US7280663B1 (en) * | 2000-05-22 | 2007-10-09 | University Of Southern California | Encryption system based on crossed inverse quasigroups |
| AU2001294524A1 (en) * | 2000-09-07 | 2002-03-22 | Ivan Vesely | Cascaded stream cipher |
| US6987853B2 (en) * | 2000-11-29 | 2006-01-17 | Bodacion Technologies, Llc | Method and apparatus for generating a group of character sets that are both never repeating within certain period of time and difficult to guess |
| US20020114453A1 (en) * | 2001-02-21 | 2002-08-22 | Bartholet Thomas G. | System and method for secure cryptographic data transport and storage |
| JP4191915B2 (en) * | 2001-08-30 | 2008-12-03 | 独立行政法人情報通信研究機構 | Conversion device, encryption / decryption system, multistage conversion device, program, and information recording medium |
| ITMI20011938A1 (en) * | 2001-09-17 | 2003-03-17 | Cit Alcatel | METHOD TO ENCRYPT A FLOW OF DATA |
| DE10148415C2 (en) * | 2001-09-29 | 2003-07-31 | Univ Braunschweig Tech | Method and device for encrypting and decrypting data |
| CA2365481C (en) * | 2001-12-18 | 2006-01-03 | Ibm Canada Limited-Ibm Canada Limitee | Encryption method using synchronized continuously calculated pseudo-random key |
| US7509553B2 (en) * | 2002-11-04 | 2009-03-24 | Tandberg Telecom As | Inter-network and inter-protocol video conference privacy method, apparatus, and computer program product |
| US7474326B2 (en) * | 2002-11-04 | 2009-01-06 | Tandberg Telecom As | Inter-network and inter-protocol video conference privacy method, apparatus, and computer program product |
| US7370212B2 (en) | 2003-02-25 | 2008-05-06 | Microsoft Corporation | Issuing a publisher use license off-line in a digital rights management (DRM) system |
| CN1716852B (en) * | 2004-07-01 | 2010-05-05 | 谈子晨 | Formula cipher combined graph prompting interactive dynamic cipher checking mode |
| DE102004039899B4 (en) * | 2004-08-17 | 2010-07-22 | Dimitri Prof. Dr.-Ing. Korobkov | encryption method |
| US8438645B2 (en) | 2005-04-27 | 2013-05-07 | Microsoft Corporation | Secure clock with grace periods |
| US8725646B2 (en) | 2005-04-15 | 2014-05-13 | Microsoft Corporation | Output protection levels |
| US20060265758A1 (en) | 2005-05-20 | 2006-11-23 | Microsoft Corporation | Extensible media rights |
| WO2016102019A1 (en) * | 2014-12-23 | 2016-06-30 | Telefonaktiebolaget L M Ericsson (Publ) | Technique for generating a password |
| US10937510B2 (en) * | 2019-06-28 | 2021-03-02 | Western Digital Technologies, Inc. | Multidimensional pseudorandom binary sequence analysis for a memory device |
Family Cites Families (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4202051A (en) * | 1977-10-03 | 1980-05-06 | Wisconsin Alumni Research Foundation | Digital data enciphering and deciphering circuit and method |
| US5237615A (en) * | 1982-05-20 | 1993-08-17 | The United States Of America As Represented By The National Security Agency | Multiple independent binary bit stream generator |
| US5257282A (en) * | 1984-06-28 | 1993-10-26 | Unisys Corporation | High speed code sequence generator |
| US4747139A (en) * | 1984-08-27 | 1988-05-24 | Taaffe James L | Software security method and systems |
| US4799259A (en) * | 1986-04-10 | 1989-01-17 | Rockwell International Corporation | Monolithic random digital noise generator |
| US5008935A (en) * | 1989-06-30 | 1991-04-16 | At&T Bell Laboratories | Efficient method for encrypting superblocks of data |
| FR2656125B1 (en) * | 1989-12-19 | 1994-07-08 | Bull Cp8 | METHOD FOR GENERATING A RANDOM NUMBER IN A DATA PROCESSING SYSTEM, AND SYSTEM IMPLEMENTING SUCH A METHOD. |
| JPH03214834A (en) * | 1990-01-19 | 1991-09-20 | Canon Inc | Multi-medium network system |
| US5048086A (en) * | 1990-07-16 | 1991-09-10 | Hughes Aircraft Company | Encryption system based on chaos theory |
| US5163092A (en) * | 1990-11-28 | 1992-11-10 | Siemens Aktiengesellschaft | Parallel scrambler used in sonet data transmission |
| EP0529512A3 (en) * | 1991-08-23 | 1993-06-16 | Fujitsu Limited | Method and system for generating random number sequences |
| ES2038912B1 (en) * | 1991-09-30 | 1994-08-01 | Alcatel Standard Electrica | SYNCHRONOUS PARALLEL DATA RANDOMIZATION SYSTEM. |
| KR940009843B1 (en) * | 1992-02-07 | 1994-10-17 | 이병기 | Parallel scrambling system |
-
1993
- 1993-10-05 US US08/131,542 patent/US5440640A/en not_active Expired - Fee Related
-
1994
- 1994-10-04 WO PCT/US1994/011199 patent/WO1995010148A1/en not_active Application Discontinuation
- 1994-10-04 CA CA002173732A patent/CA2173732A1/en not_active Abandoned
- 1994-10-04 JP JP7510961A patent/JPH09505901A/en active Pending
- 1994-10-04 AU AU79268/94A patent/AU674461B2/en not_active Ceased
- 1994-10-04 EP EP94930010A patent/EP0722642A4/en not_active Withdrawn
Also Published As
| Publication number | Publication date |
|---|---|
| EP0722642A4 (en) | 1999-06-09 |
| AU674461B2 (en) | 1996-12-19 |
| WO1995010148A1 (en) | 1995-04-13 |
| JPH09505901A (en) | 1997-06-10 |
| US5440640A (en) | 1995-08-08 |
| EP0722642A1 (en) | 1996-07-24 |
| AU7926894A (en) | 1995-05-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| AU674461B2 (en) | Multistream encryption system for secure communication | |
| US5365589A (en) | Method and apparatus for encryption, decryption and authentication using dynamical systems | |
| US7359515B2 (en) | Method and apparatus for symmetric-key decryption | |
| US5539827A (en) | Device and method for data encryption | |
| US5412729A (en) | Device and method for data encryption | |
| US6069954A (en) | Cryptographic data integrity with serial bit processing and pseudo-random generators | |
| US6185304B1 (en) | Method and apparatus for a symmetric block cipher using multiple stages | |
| US6185679B1 (en) | Method and apparatus for a symmetric block cipher using multiple stages with type-1 and type-3 feistel networks | |
| EP0635956B1 (en) | Encryption apparatus, communication system using the same and method therefor | |
| US7451310B2 (en) | Parallelizable authentication tree for random access storage | |
| US6189095B1 (en) | Symmetric block cipher using multiple stages with modified type-1 and type-3 feistel networks | |
| US5696826A (en) | Method and apparatus for encrypting and decrypting information using a digital chaos signal | |
| US20020076044A1 (en) | Method of and system for encrypting messages, generating encryption keys and producing secure session keys | |
| JPH11509940A (en) | Cryptographic method and apparatus for non-linearly combining data blocks and keys | |
| AU1132199A (en) | A non-deterministic public key encryption system | |
| US8180048B2 (en) | Method and system for computational transformation | |
| Rueppel | New approaches to stream ciphers | |
| US6463150B1 (en) | Encryption device for information in binary code | |
| US6404888B1 (en) | Confusion data generator | |
| WO1994021066A1 (en) | A method and apparatus for generating a digital message authentication code | |
| JP2001308846A (en) | Stream cipher | |
| JP2001509608A (en) | Method for cryptographically converting an L-bit input block of digital data into an L-bit output block | |
| Gutowitz | Method and Apparatus for the Encryption, Decryption and Authentication of Messages Using Dynamical Systems | |
| Gazi et al. | A Novel Chaotic State Modulated Secure Communication System | |
| Bhat et al. | Image Based Data Encryption Algorithm with Dynamic Rounds (IBDEA-DR) |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| FZDE | Discontinued |