WO2008034971A2

WO2008034971A2 - Method for encrypting messages for at least two receivers and related encryption device and decryption device

Info

Publication number: WO2008034971A2
Application number: PCT/FR2007/001510
Authority: WO
Inventors: Abdelkader Nimour
Original assignee: Abdelkader Nimour
Priority date: 2006-09-19
Filing date: 2007-09-18
Publication date: 2008-03-27
Also published as: FR2906095A1; FR2906095B1; WO2008034971A3

Abstract

The present invention pertains to the field of cryptography, and relates to an encryption device that comprises an initialisation step (101), an encryption step (102), and an decryption step (103); the device allows a transmitter provided with secret encryption data Ke unknown to receivers, to encrypt messages for at least two receivers each comprising decryption data Fdi made of partial secrets selected so that a partial secret composition function can be used for obtaining the transmitter encryption data Ke from said partial secrets, said partial secret composition function being unknown to the receivers. The invention also relates to an encryption device and to a decryption device for encrypting and decrypting messages according to the method of the present invention.

Description

Method for encrypting messages to at least two receivers, encryption device and associated decryption device

Technical Field The field of the invention is that of cryptography.

Prior art

Cryptography finds application in securing exchanges between two or more entities. Among these applications are message encryption schemes. The encryption of a message consists in transforming it, for example by applying a function to this message, so as to make it unintelligible to any entity other than the legitimate recipient or the legitimate recipients of the message. The encryption can be represented by a function E which takes as argument a message M, an encryption key k and which returns an encrypted message C:

C = E (M, k)

Conversely, the decryption of a message consists in transforming an encrypted message so as to obtain the original message. Decryption can be represented by a function D which takes as argument an encrypted message C, a decryption key k 'and which returns the original message M:

M = D (C, k ')

A message encryption scheme is said to be symmetrical if the key used to decrypt a message is the same as that used to encrypt it (k = k '). This key must remain secret.

In an asymmetric encryption scheme, the key used to decrypt a message may be different from that used for its encryption (k ≠ k '). In this case, only the decryption key k 'must be secret. The encryption of the same message destined for several receivers, each having a secret decryption key kj ', the index i designating the receiver concerned, requires the transmitter to make as many ciphers as there are receivers. This solution quickly becomes impractical in the case where the number of receivers is important. To overcome this problem of multiplication of ciphers, one solution is to make available to all receivers the same secret decryption key k In this case, the sender can be content to encrypt his message only once, but it is no longer possible to identify a traitor, that is, a legitimate receiver who has unlawfully disclosed the secret secret decryption key k '.

More specifically, the field of the invention is that of traitor tracing (in English). Traitor hunt finds application in securing the sending of messages from a transmitter to at least two receivers. In a traitor tracking scheme, the transmitter encrypts only once the message to be sent to receivers which each have different decryption data to decrypt the received message. In the traitor tracking scheme, encrypting is the operation of making a message unintelligible to any entity other than the receivers who are the legitimate recipients of the message. The encrypted message will be called the result of encrypting a message. In the traitor tracking scheme, decrypting is the operation of transforming an encrypted message to obtain the original message.

The main difference between encrypting and decrypting on the one hand and encrypting and decrypting on the other hand is that an encrypted message can only be decrypted with a single decryption key while an encrypted message can be decrypted with data of different decryption.

A traitor is a legitimate receiver who has disclosed all or part of his decryption data so as to allow one or more non-addressee entities legitimate messages can decrypt messages without the knowledge of the issuer. A traitor can act alone and in this case he discloses all or part of his decryption data to one or more entities. Traitors can also coalesce to build an illegitimate decryption data (possibly different from the decryption data of each of the traitors of the coalition) that can decrypt the messages of the issuer. A process of tracking traitors is said to be "resilient" if the knowledge of an illegitimate decryption data allows the identification of at least one member of the coalition of traitors that allowed the construction of this illegitimate decryption data, provided that this coalition does not include more mtragers. A traitor acting alone can be seen as a particular case of coalition with only one member.

In the traitor tracking scheme, the transmitter has an encryption data Ke and each receiver i has a different decryption data Kdj for each receiver. The traitor tracking scheme includes two distinct processes:

• a method of encrypting messages;

A process for identifying traitors from the knowledge of at least one illegitimate decryption data item.

We describe, more particularly, in what follows the method of encrypting messages.

A message encryption method has three steps: initialization, encryption, and decryption.

The initialization consists in determining the parameters of the method and, in particular, in determining the encryption data item Ke of the transmitter and for each receiver i, its decryption data item Kdi. The encryption of a message M consists of constructing an encrypted message <H, where:

C denotes the encrypted message result of the encryption of the message M with an encryption key k: C = E (M, k);

• H denotes a header which is a function of the encryption data Ke of the broadcaster and the encryption key k.

A new decryption key can be advantageously used with each new encryption.

The form of the encrypted message does not matter. In particular, the header can be indifferently placed in front of or behind the encrypted message in an encrypted message.

The decryption of a message consists, for the receiver i, in obtaining the message M from an encrypted message <H, C> by: • computing a secret decryption key k 'from the decryption data Kdi of receiver i and header H;

Reconstructing the message M by decrypting the encrypted message C using the decryption key k ': M = D (C, k').

In the traitor tracking schemes proposed in the literature (see "Tracing Traitors", Benny Chor, Amos Fiat & Moni Naor, Lecture Notes in Computer Science, Volume 839, pages 257-270, 1994), the encryption data Ke of the transmitter is a set of keys (used for both encryption and decryption) and each decryption data Kdj is a separate subset of the encryption data Ke. Encrypting a message M gives the encrypted message <H, C> where:

The encrypted message C is the result of the encryption of the message M with an encryption key k composed of several parts; The header H consists of the results of the ciphers of the parts of the encryption key k with each of the keys constituting the encryption data Ke of the transmitter.

In an "m-resilient" scheme, the number of keys constituting the encryption data of the transmitter and the number of keys constituting the decryption data of each receiver are dependent on m. For a given number of receivers, the more one will want to resist large coalitions of hackers (plus m is large) and the number of keys constituting the encryption data of the sender and the number of keys constituting the decryption data of each receiver are great.

The main drawback of existing traitor trapping schemes is that they only withstand trailing coalitions of limited size and whose size will be all the more constrained by the size of the transmitter's encryption data. size of the header of an encrypted message or the size of the decryption data of each receiver will be constrained. The size of a coalition is the number of traitors it has. The size of the encryption data of the transmitter or the size of a decryption data of a receiver is the number of keys that it contains. The size of the header is, in general, equal to the size of the encryption data of the transmitter.

One of the objectives of the present invention is to define a new method of encrypting messages intended for at least two receivers that resists arbitrarily large coalitions of trajectories, that is to say that even if all the receivers coalesced , they would not be able to generate an illegitimate decryption data different from the decryption data of the receivers of the coalition making it possible to decipher the messages of the transmitter.

Summary of the invention

According to a first aspect, the present invention proposes an encryption method enabling a transmitter, having encryption data Ke, to encrypt messages destined for at least two receivers, each receiver having a decryption data Kdj. The encryption method comprises the following steps:

An initialization, which consists in determining the encryption data Ke of the transmitter and in determining for each receiver i its decryption data

Kd ₁ ;

An encryption of a message M, which consists in constructing an encrypted message consisting of a header H and an encrypted message C resulting from the encryption of the message M with an encryption key k; A decryption of an encrypted message, which consists of decrypting the encrypted message C with a decryption key k 'obtained from the header H and the decryption data Kdj of the receiver i. In the process

• the encryption data Ke of the transmitter is secret information unknown to the receivers;

The decryption data Kd; of the receiver i consists of selected partial secrets so that there exists a partial secret composition function which makes it possible to obtain the encryption data item Ke of the sender from said partial secrets and that this function of composition of partial secrets is unknown to the receptors; and

The encryption key k depends on the encryption data Ke of the transmitter and on a randomness r.

The fact that the function of composition of partial secrets is a function unknown to the receivers makes the possible knowledge of the decryption data of a receiver (or all receivers) does not allow to deduce the encryption data Ke of the transmitter by the use of this function.

The features described above of the method according to the invention make it resistant to coalitions of arbitrarily large hackers. Indeed, even if all the receivers were coalescing, they would not be able to generate valid partial secrets, that is to say that allow to decrypt the encrypted messages, and new, that is to say different from the partial secrets constituting the data of deciphering the traitors of the coalition. Indeed, to determine such partial secrets requires at least knowledge of the encryption data Ke of the issuer or the knowledge of the composition function of partial secrets. However, the function of composition of partial secrets and the encryption data Ke of the transmitter are unknown to the receivers.

According to a second aspect, the invention proposes an encryption device for encrypting messages according to the method described above, and comprising:

Means for storing the encryption data Ke of the transmitter;

• random generation means;

Calculating means arranged for: calculating the encryption key k according to the encryption data Ke of the transmitter and a randomness r; encrypt a message with the encryption key k; calculate the H header according to the same hazard r;

• means of communication.

According to a third aspect, the invention proposes a decryption device for decrypting encrypted messages consisting of an H header and an encrypted message C according to the method described above, and comprising:

Means for storing the partial secrets constituting the decryption data Kdi of the receiver i; Calculating means arranged to: calculate the decryption key k 'as a function of the decryption data Kdj of the receiver i and of the header H; decrypting the encrypted message C using the decryption key k ';

• means of communication.

Brief description of the figures The invention as well as the advantages that it provides will be better understood in the light of the following description given with reference to the appended figures in which:

FIG. 1 represents an encryption method according to the invention in an example of a specific embodiment;

FIG. 2 illustrates an encryption device according to an exemplary embodiment of the invention;

FIG. 3 illustrates a decryption device according to an exemplary embodiment of the invention.

Example of embodiments of the invention

Referring to FIG. 1, the method according to the invention is described on the basis of an example where a transmitter wishes to transmit in confidence to a large number of receivers a series of messages M, MM, etc.

Initialization step (101).

The transmitter chooses secret encryption data Ke then chooses for each receiver i the partial secrets that will constitute its decryption data Kdj. These partial secrets are chosen so that there exists a partial secret composition function which makes it possible to calculate the encryption data Ke of the transmitter according to the partial secrets of each receiver.

Advantageously, the decryption data is unique per receiver, that is to say that two different receivers have different decryption data. The knowledge of a decryption data thus allows unambiguous identification of the receiver to whom it has been attributed.

The decryption data Kdi of the receiver i comprises two partial secrets Aj and B ₁ . If new receivers appear, it is enough to choose new partial secrets for each of these new receivers without obligation to change the decryption data of the other receivers.

The encryption data Ke of the sender and the partial secrets Aj and Bi are elements of a finite group G (see the definition of a group in chapter 2.5.1 of "Handbook of Applied Cryptography", Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, CRC Press, ISBN: 0-8493-8523-7.).

More, especially, the finite group G is the set of non-zero integers modulo n, denoted Z _n , where n is the product of two prime numbers p and q unknown to the receivers.

The encryption data Ke of the transmitter is equal to g ^{(e * s} ^ modulo n, the partial secret A; is equal to g ^{(e * (ai + 1))} modulo n and the partial secret Bj is equal to bj or :

• g is an element of Z _n ^* unknown to the receivers;

• s is an element of Z _n unknown to the receivers;

• aj and b _; are elements of Z _n ^* and ai is unknown to receivers such as modulo λ and such that the greatest common divisor of any two bj is equal to c and where λ is the smallest common multiple of p-

1 and q-1 and c an element of Z _n greater than 1;

• e is an element of Z _n unknown to the receivers and chosen together with d, another element of Z _n ^* also unknown receivers so that e * d = l modulo λ.

We can verify that (Ai / g ^e ) ^B modulo n is equal to g ^{(e * s)} modulo n. The image of the partial secrets A ₁ and Bi by the function of composition of partial secrets is therefore (A / g ⁶ ) ⁶ 'modulo n. The function of partial secret composition is unknown to the receivers because the elements g and e of the group Z _n are not known to the receivers. A receiver i, not knowing the function of composition of partial secrets, is therefore in the inability to use this function to calculate the encryption data Ke of the transmitter from its partial secrets Aj and Bj.

It is also important for a receiver coalition not to be able to deduce the transmitter's encryption data Ke from the receiver's decryption data.

Now two receivers, i and j, can by pooling their respective partial secrets calculate on the one hand the value g ^{e * s * (bj "bl)} modulo n and on the other hand the value (b _j -b;) modulo n (it is considered that b _j is greater than _b}) will be denoted by δ. to calculate the value g ^s modulo n, calculate the inverse modulo λ δ then raise g ^es ^ ^{bj "bl} ^ to the power of this inverse. But the receivers are not able to compute a modulo inverse λ because λ, being the product of two integers p and q both unknown to the receivers, is unknown to the receivers. It is therefore impossible for a coalition of two receivers to deduce the encryption data Ke from the transmitter.

A larger coalition of receivers (at least three receivers) can calculate according to the scheme described above the following values g ^{e * s * δl} modulo n, δi, g ^{es δ2} modulo n and δ ₂ where O ₁ and δ ₂ are differences of bj. The implementation of the "common modulus" attack (see the description of "Common Modulus Attack on RSA" in chapter 19.3 of "Cryptanalysis of RSA-type cryptosystems: a visit", Marc Joye & Jean-Jacques Quisquater , R. Whright and P. Neumann, Eds., Network Threats, DIMACS Series in Discrete Mathematics and Theoretical Computer Science, Vol 38, pp. 21-31, American Mathematical Society, 1998) could infer the value of g ^{(e * s)} modulo n if the largest common divisor of δi andδ ₂ was equal to 1. Now the largest common divisor of δi and δ ₂ is equal to c, the largest common divisor of all bj and is, of this fact, greater than 1. It is therefore impossible for a coalition of more than two receivers to deduce the encryption data Ke from the transmitter. At the end of this initialization step, the transmitter has its encryption data Ke and each receiver has its decryption data, the decryption data Kd ₁ of the receiver i consisting of the partial secrets Ai and Bj.

Encryption step (102).

The encryption of the first message M consists in constructing the encrypted message <H, where H is the header of the encrypted message and C is an encrypted message resulting from the encryption of the message M with an encryption key k.

The encryption key k is a function of the encryption data Ke of the transmitter and a random number r. By random we mean information chosen arbitrarily, deterministically or indeterministically, whose value is not predictable by the receivers.

The hazard r is an element of the finite group G and is, therefore, an element of the group

Z _n ^* .

The encryption key k is obtained by raising the encryption data Ke of the transmitter to the power of the product of the hazard r with d. The encryption key k is therefore equal to (Ke) ^{(d * r)} modulo n, which is equal to g ^{(s * r)} modulo n.

The header H of the encrypted message consists of a first part Hi, which is equal to d * r modulo λ, and a second part H ₂ , which is equal to g ^r modulo n.

Finally, the encryption of the message M gives the encrypted message <(Hi, H ₂ ), where O is given the hazard r:

• the first part of the header Hi is equal to d * r modulo λ;

The second part of the header H ₂ is equal to g ^r modulo n; The encrypted message C is the result of the encryption of the message M with the encryption key k, which is equal to g ^{(s * r)} modulo n.

Another advantage of the encryption method according to the invention is that it does not require a second initialization phase for the encryption of the following messages. To encrypt the message MM, for example, it is enough, to draw a new hazard rr and then calculate the message <(HHi, HH ₂ ), CO where:

• the first part of the HHi header is equal to d * rr modulo λ;

• the second part of the HH ₂ header is equal to ^grr modulo n; The encrypted message CC is the result of the encryption of the message MM with the encryption key kk, which is equal to g ^{(s * rr)} modulo n.

Decryption step (103).

The decryption of the encrypted message <H, C> by the receiver i consists in decrypting the encrypted message C with a decryption key k 'obtained from the header H and the decryption data Kdi of the receiver i.

As described in the encryption step, the H header consists of two parts Hi and H ₂ and the encrypted message can be represented as: <(Hi, H ₂ ), C>.

The decryption key k 'is equal to (Ai ^H 7H ₂ ) ^B modulo n where Aj and Bj are the two partial secrets constituting the decryption data Kdj of the receiver i. By replacing each element of the expression (Aj ^Hl / H ₂ ) ^B modulo n by its value, it is easy to check that the value of the decryption key k 'is g ^{(s * r)} modulo n. It can be seen that the encryption key k and the decryption key k 'are equal.

Once the decryption key k 'is known, it suffices to decrypt the encrypted message C using the decryption key k' to obtain the original message M. The decryption of the encrypted message corresponding to the encryption of the message MM and all subsequent decryptions do not require a new initialization step.

Another advantage of the method according to the invention is that the size of the encryption data of the transmitter, the size of the header and the size of the decryption data are fixed, ie they do not do not depend on the number of receivers. In addition, this size is relatively reasonable. Indeed, the encryption data Ke of the transmitter consists of a single element of the group Z _n ^* , the decryption data Kdj of a receiver i consists of two elements of the group Z _n and the header H of an encrypted message is also made up of two elements, Hi and H ₂ , of the group Z _n .

Encryption device (200)

The invention also relates to an encryption device (200) illustrated in FIG. 2, for encrypting messages according to the method described above, the device comprising:

Means for storing (201) the encryption data item Ke of the issuer;

Randomness generating means (204);

An arithmetic means (202) for calculating the encryption key k as a function of the encryption data

Ke of the transmitter and a hazard r; o encrypt a message with the encryption key k; o calculate the H header according to the same hazard r;

• communication means (203).

This encryption device (200) can be, for example, a computer, a smart card or other cryptographic apparatus.

Decryption device (300). The invention finally relates to a decryption device (300) illustrated in FIG. 3, for decrypting encrypted messages consisting of an H header and an encrypted message C according to the method described above, the device comprising:

Storage means (301) for the partial secrets that constitute the decryption data Kd ₁ of the receiver i;

• computing means arranged (302) for: calculating the decryption key k 'as a function of the decryption data Kd ₁ of the receiver i and of the header H; o decrypting the encrypted message C using the decryption key k '; • communication means (303).

This decryption device (300) may be, for example, one of the following elements:

• a computer ; • a smart card or other cryptographic device;

• a digital television decoder, a mobile phone, a personal digital assistant, and more generally any device for receiving or viewing digital media data.

The decryption device may also be a combination of the elements mentioned above. The decryption device may be, for example, constituted by a digital television decoder and a smart card. The digital television decoder stores, for example, the partial secret Aj and the smart card storing the partial secret B ₁ .

Industrial application possible.

A possible, but not exclusive, industrial application of the present invention is conditional access in a pay-TV system. A conditional access system in pay-TV ensures that audiovisual content is accessible only to subscribers who have acquired the rights. Systems conditional access channels do not use piracy tracking schemes because the congestion induced by these is incompatible with the constraints of broadcasting audiovisual content. The use of secrets common to all subscribers makes it difficult to identify the source of counterfeiting in the case of piracy. The small size (the small sizes of the encryption, decryption data and headers) generated by the method according to the present invention makes it perfectly possible to use it in a conditional access system for pay television thus making the identification more affluent pirates.

The embodiments presented are only exemplary embodiments of the invention without limiting the scope of the invention. Other embodiments are possible in variations that are within the abilities of those skilled in the art upon reading the present description. The scope of the invention is determined by the claims appended to this description.

Claims

An encryption method enabling a transmitter, having encryption data (Ke), to encrypt messages intended for at least two receivers, each receiver (i) having a decryption data item (Kdi), the encryption method comprising the following steps:

An initialization (101), which consists of determining the encryption data (Ke) of the transmitter and determining for each receiver (i) its decryption data (Kdi); An encryption of an M message (102), which consists of constructing an encrypted message consisting of a header H and an encrypted message C resulting from the encryption of the message M with an encryption key k;

A decryption of an encrypted message (103), which consists in decrypting the encrypted message C with a decryption key k 'obtained from the header H and the decryption data (Kd;) of the receiver ( i); the encryption method being characterized in that:

• the encryption data (Ke) of the transmitter is secret information unknown to the receivers;

The decryption data (Kd) of the receiver (i) consists of partial secrets chosen so that there exists a function of partial secret composition which makes it possible to obtain the encryption data item Ke of the sender from the said secrets and that this function of partial secret composition is unknown to the receivers;

• The encryption key k depends on the encryption data (Ke) of the transmitter and a random r.

2. Method according to claim 1 characterized in that the decryption data are unique per receiver.

3. Method according to claim 2 characterized in that the decryption data (Kd;) of the receiver (i) comprises a first partial secret (Ai) and a second partial secret (Bj).

4. Method according to claim 3 characterized in that the encryption data (Ke) of the transmitter, the first and second partial secrets (A ;, Bj) and the random r are elements of a finite group (G ).

5. Method according to claim 4, characterized in that the finite group (G) is the set of non-zero integers modulo n (Z _n ^* ), where n is the product of two prime numbers p and q unknown to the receivers.

6. Method according to claim 5, characterized in that the encryption data (Ke) of the transmitter is equal to g ^{(e * s} ^ modulo n, the first partial secret (Aj) is equal to g ^{(e * (ai +1))} modulo n and the second partial secret (B;) is equal to b, where:

• g is an element of the set of non-zero integers modulo n, unknown to the receivers;

• s is an element of the set of non-zero integers modulo n, unknown to the receivers; • at; and bj are elements of the set of non-zero integers modulo n, and aj is unknown to receivers such as

modulo λ and such that the greatest common divisor of any two bj is equal to c and where λ denotes the smallest common multiple of p-1 and q-1 and c an element of the set of non-zero integers modulo n, greater than 1; • e an element of the set of non-zero integers modulo n, unknown to the receivers and chosen together with d, another element of the set of non-zero integers modulo n, also unknown to the receivers so that e * d = l modulo λ.

7. Method according to claim 6 characterized in that the encryption key k is equal to (Ke) ^{(d * r)} modulo n.

8. Method according to claim 7, characterized in that the header H of the encrypted message consists of a first part Hi, equal to d * r modulo λ, and a second part H ₂ , equal to g ^r modulo n.

9. The method of claim 8 characterized in that the decryption key k 'is equal to (Ai ^Hl / H ₂ ) ^Bi modulo n.

An encryption device (200) for encrypting messages according to any one of claims 1 to 9 and characterized in that it comprises:

Storage means (301) for the partial secrets constituting the decryption data item (Kd ₁ ) of the receiver (i); • computing means arranged (302) for: calculating the decryption key k 'as a function of the decryption data (Kdj) of the receiver (i) and of the header H; o decrypting the encrypted message C using the decryption key k ';

• communication means (303).

11. decryption device (300) for decrypting encrypted messages consisting of an H header and an encrypted message C according to any one of claims 1 to 9 characterized in that it comprises:

Storage means (301) for the partial secrets which constitute the decryption data item (Kd ₁ ) of the receiver (i);

• computing means arranged (302) for: calculating the decryption key k 'as a function of the decryption data (Kdi) of the receiver (i) and of the header H; o decrypting the encrypted message C using the decryption key k '; o communication means (303).