CN107070637A - A kind of data encryption/decryption method of overlapping packet - Google Patents

Abstract

The invention discloses a method for encrypting and decrypting overlapping packet data, which is characterized in that the overlapping method is used to perform two-layer encryption on each packet in plain text. The key steps are: (1) the data encryption and decryption parties share two existing symmetric encryption algorithms and related encryption and decryption materials in advance; (2) divide the data plaintext into several fixed-length groups; (3) the encryption party The two plaintext groups implement joint encryption to generate the first-layer ciphertext group; (4) the encryption party implements joint encryption on two first-layer ciphertext groups to generate the second-layer ciphertext group as the final ciphertext; (5) The decryption party implements joint decryption on pairs of second-layer ciphertext packets to generate first-layer ciphertext packets; (6) the decryption party performs joint decryption on pairwise first-layer ciphertext packets, and uses the decryption result as the final plaintext. The effect of adopting this method is that even if the key required by this method is obtained, without knowing this method, the plaintext cannot be obtained through brute force cracking.

Description

A Data Encryption and Decryption Method with Overlapping Groups

technical field

The invention belongs to the field of information security, and in particular relates to the technology of data confidentiality within a system or between systems.

Background technique

Block cipher has the characteristics of fast encryption speed, high security, and easy standardization. Especially in today's increasingly popular network, it has become a mainstream encryption and decryption method to ensure the confidentiality of sensitive data, so it is widely used in secure data transmission and In many applications such as confidential storage. However, the existing block ciphers still have a common defect, that is, the analyst can take advantage of the fact that the encrypted block has only a few lengths, and it is possible to crack the plaintext by combining the enumerated block length size with brute force cracking. . The present invention proposes a block cipher that is impossible to break by brute force methods.

Contents of the invention

The purpose of the present invention is to provide a data encryption and decryption method of overlapping blocks, which is to solve the problem that the ciphertext output by the existing block cipher may be cracked by force. Two-layer encryption is performed on each plaintext group by overlapping groups, including: (1) encrypting two plaintext groups to form the first layer of ciphertext grouping; Encrypt to form a layer 2 ciphertext group, and use the layer 2 ciphertext group as the final data ciphertext.

The technical solution of the present invention is to adopt the overlapping method to carry out two-layer encryption to each packet in the data plaintext, and its steps are as follows;

(1) Encrypt two plaintext blocks to form the first layer of ciphertext blocks;

(2) Encrypt the first-layer ciphertext group to form the second-layer ciphertext group in the way of capping the boundary, and use the second-layer ciphertext group as the final data ciphertext.

For the above overlapping method, the steps of performing two-layer encryption on each group in the data plaintext are as follows:

(1) The data encryption and decryption parties share two existing symmetric encryption algorithms and encryption and decryption related materials in advance;

(2) Divide the data plaintext into several fixed-length packets according to the single-length packet length;

(3) The encryption party implements joint encryption on two plaintext groups to generate the first-layer ciphertext group;

(4) The encryption party implements joint encryption on the first-layer ciphertext group in pairs by covering the group boundary, and generates the second-layer ciphertext group as the final ciphertext;

(5) The decryption party performs joint decryption on the second-layer ciphertext packets to generate the first-layer ciphertext packets;

(6) The decryption party implements joint decryption on pairs of first-layer ciphertext groups, and uses the decryption result as the final data plaintext.

For the above step (1), select DES, 3DES, IDEA, AES, RC5, Blowfish, or Rijadeal.

In the above step (2), "capping" refers to performing the following operations on two adjacent plaintext groups: jointly encrypt the second half of the previous group and the first half of the next group to generate a layer 1 Ciphertext grouping, or, perform the following operations on two adjacent layer 1 ciphertext groups: jointly encrypt the second half of the previous grouping and the first half of the next grouping to generate a layer 2 ciphertext grouping .

For the above step (1), there are multiple types of encryption and decryption materials required, including link operation mode, initial vector, and symmetric key. Before using this method, both encryption and decryption parties should choose an existing method to share the required Encryption and decryption materials.

For the above step (2), the length of the single-length packet can be defined as 32 bits, 64 bits or 128 bits, and the length of the corresponding double-length packet is 64 bits, 128 bits or 256 bits.

In the above step (3), the encryption party implements joint encryption on two adjacent plaintext groups to generate a layer 1 ciphertext group, and operates in the same way for subsequent plaintext groups until all plaintexts are encrypted.

In the above step (4), the encryption party encrypts two adjacent first-level ciphertext groups in the following manner to generate a second-level ciphertext group: making the second-level ciphertext group overwrite the first-level ciphertext group As a result, the midpoint of the layer 2 ciphertext block is aligned with the boundary between the two layer 1 ciphertext blocks.

In the above step (5), the decryption party performs joint decryption on two adjacent layer 2 ciphertext groups to generate a layer 1 ciphertext group, and operates in the same way for subsequent layer 2 ciphertext groups until All layer 2 ciphertext blocks are decrypted.

In the above step (6), the decryption party implements joint decryption on two adjacent first-level ciphertext groups to generate a plaintext group, and operates in the same way for subsequent first-level ciphertext groups until all first-level ciphertext groups The ciphertext block is decrypted.

The following describes the present invention from four aspects: premise, concept symbol, core method and method summary.

1. Prerequisites

(1) The present invention is a composite block encryption algorithm, which uses two existing encryption algorithms for single-length block and double-length block (see the concept symbol section for the meaning of single-length block and double-length block).

(2) The encrypting party and the decrypting party share two keys K ^s and K ^d through a secure channel in advance, where K ^s and K ^d are keys for single-length blocks and double-length blocks.

(3) The encrypting party and the decrypting party share two initial vectors IV ^s and IV ^d through a secure channel in advance, where IV ^s and IV ^d are initial vectors for single-length packets and double-length packets.

(4) The encrypting party and the decrypting party agree in advance on a link operation mode between ciphertext packets.

(5) When using the present invention, the minimum length of data plaintext is 64 bits. When the data plaintext length is 64 bits, the lengths of the corresponding single-length packets and double-length packets are 32 bits and 64 bits respectively.

(6) When the length of the data plaintext is not an integer multiple of the length of a single-length packet, the plaintext shall be filled with the filling method agreed upon by the encryption and decryption parties, so that the length of the filled data plaintext is equal to the multiple of the single-length packet.

2. Concept symbols

(1) concept

Group size: The present invention adopts a two-layer encryption method, wherein each ciphertext group generated by the second layer of encryption must cover the boundary of two adjacent ciphertext groups in the first layer, thereby achieving high-strength confidentiality. Two-layer and overlapping encryption need to introduce two packet lengths, namely, single-length packets and double-length packets. If the single-length packet is m bits, the double-length packet is 2m bits.

Layers: The present invention requires two layers of encryption, and the data packets are divided into three layers accordingly, namely the 0th layer grouping, the first layer ciphertext grouping, and the second group ciphertext grouping. The group generated after encrypting all layer 0 plaintext groups is called layer 1 ciphertext group, and the ciphertext group generated after encrypting all layer 1 ciphertext groups is called layer 2 ciphertext group.

Overlap: Refers to the layer 2 ciphertext block covering the boundary between the first layer two ciphertext blocks, specifically, making the midpoint of the second layer ciphertext block align with the first layer two ciphertext blocks borders.

(2) Symbol

Table 1 Symbol convention table

(3) Core method

The present invention includes four core contents of determining the size and length of the group and the encryption algorithm, determining the operation mode of the ciphertext group link, two-layer group encryption and two-layer group decryption.

① Determine the size and length of single-length blocks and double-length blocks and the corresponding cryptographic algorithms.

Single-length packets can choose 32-bit, 64-bit or 128-bit. When the size of the single-length packet is determined, the size of the double-length packet is also determined, that is, the size of the double-length packet is twice that of the single-length packet. For single-length blocks and double-length blocks, any cryptographic algorithm that meets the requirements can be selected, as shown in Table 2.

For example, when the single-length/double-length block size is 64/128, DES/AES can be selected as the encryption algorithm for the single-length/double-length block respectively. If the single-length/double-length block size is 128/256, AES/Rijadeal can be selected as the encryption algorithm for the single-length/double-length block respectively.

In the following, a single-length packet is 64 bits, and a double-length packet is 128 bits as an example for illustration.

Table 2 Encryption Algorithm Selection Table

②Ciphertext group link operation mode

The present invention can adopt any one grouping link operation mode among CBC, OFB, CFB and CTR. Since there are two ciphertext blocks with different lengths, it is necessary to perform matching transformation on the link vectors of two adjacent ciphertext blocks with different lengths. The following takes the CBC operation mode as an example to illustrate the matching transformation of the link vectors of two ciphertext groups, which can be divided into two cases:

Case 1: Single-length packets come first, followed by double-length packets.

At this time, the "simple extension" method is used to expand the previous single-length ciphertext block to a double-length block, and use it as the link vector required for encryption and decryption of the subsequent double-length block The specific operation is: copy a single-length ciphertext group, and then merge it, that is:

Case 2: Double-length packets come first, followed by single-length packets.

At this time, the "simple compression" method is used to compress the previous double-length ciphertext block into a single-length block, and use it as the link vector required for encryption and decryption of the subsequent single-length block The specific operation is: XOR the first half [0..63] and the second half [64..127] of a double-length ciphertext group, namely:

③Two layers of block encryption

The plaintext packet sequence generated by dividing the data plaintext according to the single-length packet length is denoted as p=<p ₀ ,p ₁ ,p ₂ ,…>, where p _i is the i-th single-length plaintext packet in the plaintext sequence. The encryption process of p is divided into two layers. Firstly, use the key K=(K ^s , K ^d ) and the initial vector IV=(IV ^s , IV ^d ) to perform layer 1 encryption on the layer 0 plaintext block sequence p to generate the layer 1 ciphertext block sequence Then perform overlapping encryption on the first-layer ciphertext block sequence c to generate the final second-layer ciphertext block sequence

After the plaintext is grouped, the number of plaintext groups is divided into two cases of even number and odd number, and the two cases will be described respectively below.

Case 1 - the number of plaintext packets is even

Assume that the plaintext packet sequence is p=<p ₀ ,p ₁ ,p ₂ ,...,p _n-1 >, and n is an even number at this time. After the first encryption of the plaintext sequence in pairs, a layer 1 ciphertext block sequence is generated Then perform overlapping encryption on the first-layer ciphertext block sequence to generate the second-layer ciphertext block sequence

The encryption of the first layer is for plaintext packets, specifically, two adjacent single-length plaintext packets <p _j ,p _j+1 |j=0,2,4,…,n-2> are used as double-length packets The input of the cryptographic algorithm, and finally get the first layer ciphertext block sequence in Calculate according to the following steps: first, juxtapose the single-length plaintext group p ₀ and p ₁ , then XOR with the initial vector IV ^d , and finally encrypt with the double-length encryption algorithm, namely:

Follow this method for the subsequent plaintext grouping to obtain the corresponding layer 1 ciphertext grouping which is:

Layer 2 encryption uses overlapping grouping, specifically, first The first half of [0..63] is XORed with the initial vector IV ^s , and then encrypted with a single-length encryption algorithm, that is

Follow this method for the subsequent plaintext grouping to obtain the corresponding layer 2 ciphertext grouping which is:

1≤i≤n/2-1

The last secret block of layer 2 calculate:

If the method of the present invention is used in communication occasions, the method of "adding and sending" can be adopted. Specifically, as long as the conditions for generating the second layer of ciphertext are established, the second layer of ciphertext grouping is immediately generated, and then immediately sent to the decryption The party sends the encrypted layer 2 ciphertext. This method can significantly improve the efficiency of data transmission.

Case 2 - the number of plaintext packets is odd

Assume that the plaintext packet sequence is p=<p ₀ , p ₁ , p ₂ ,..., p _n-1 , p _n >, and n is an even number at this time. After the first encryption of the plaintext sequence in pairs, a layer 1 ciphertext block sequence is generated Then perform overlapping encryption on the first-layer ciphertext block sequence to generate the second-layer ciphertext block sequence

The encryption of the first layer is for plaintext packets, specifically, two adjacent single-length plaintext packets <p _j ,p _j+1 |j=0,2,4,…,n-2> are used as double-length packets The input of the cipher algorithm, and finally get the first layer ciphertext block sequence in Calculate according to the following steps: First, juxtapose the single-length plaintext group p ₀ and p ₁ , then XOR with the initial vector IV ^d , and finally encrypt with the double-length encryption algorithm, namely:

Follow this method for the subsequent plaintext grouping to obtain the corresponding layer 1 ciphertext grouping which is:

Layer 2 encryption uses overlapping grouping, specifically, first The first half of [0..63] is XORed with the initial vector IV ^s , and then encrypted with a single-length encryption algorithm, that is

Follow this method for the subsequent plaintext grouping to obtain the corresponding layer 2 ciphertext grouping which is:

in,

④ Two-layer packet decryption

The sequence of the final ciphertext grouping (i.e. the second layer of ciphertext grouping) obtained by the present invention is denoted as Corresponding to the two-layer encryption process, the decryption process for U is also divided into two layers. First, use the key K=(K ^s ,K ^d ) and the initial vector IV=(IV ^s ,IV ^d ) to encrypt the second layer. The text packet sequence U is decrypted at the first layer to generate the first layer ciphertext block sequence Then perform second-layer decryption on the first-layer ciphertext block sequence u to generate the final block sequence q=<q ₀ , q ₁ , q ₂ , . . . >. Under normal circumstances, the packet sequence q decrypted by the decryption party should be equal to the plaintext packet sequence p before encryption by the encryption party.

Before decryption, the first block of the ciphertext block sequence U is a single-length block, followed by several double-length blocks, and the last block has two different cases of single-length and double-length. The following two cases are respectively Be explained.

Case 1 - the last packet of U is a single-length packet

Note that all ciphertext block sequences after the first layer decryption operation are each of them Calculate as follows:

Note that the single-length packet sequence after layer 2 decryption operation is q=<q ₀ ,q ₁ ,q ₂ ,…,q _n-1 >, and each q _i in it is calculated as follows:

Since the above two layers of decryption are all for double-length packets, the lengths of the initial vector and each link vector are equal to the length of the double-length packet, and there is no problem of switching the length of link vectors.

Case 2 - the last packet of U is a double-length packet

Note that all ciphertext block sequences after the first layer decryption operation are each of them Calculate as follows:

Since the above decryption is all for double-length packets, there is no problem of switching the length of the link vector.

The last ciphertext block in u Calculate as follows:

because is a single-length packet, therefore, the calculation The required length of the link vector is also the length of a single-length packet, so it is necessary to switch the length of the link vector.

Note that the single-length packet sequence after the second-layer decryption operation is q=<q ₀ , q ₁ , q ₂ ,...q _n >, and each q _i in it is calculated as follows:

Since q _n is a single-length packet, the length of the link vector required for calculating q _n is also the length of the single-length packet, and therefore, the length of the link vector needs to be switched.

(4) Method summary

① Features of the present invention.

The present invention has the following three characteristics.

First, two layers of overlapping encryption are used for the packet. As a result, without knowing this method, even if the cryptanalyst obtains the key K=(K ^s , K ^d ) obtained by encryption and decryption, only It is impossible to obtain the final data plaintext if the first layer of ciphertext grouping can be obtained by brute force.

Second, the method of adding and sending is adopted, as a result, the efficiency of communication is improved.

③ Applicable occasions

The present invention is applicable to occasions that have the following confidentiality requirements for data:

First, confidential communication with strong security. For example, secure communications between headquarters and divisions, secure communications between headquarters and partners, and of course communications between individuals through secure channels.

Second, sensitive data storage with strong security. For example, data storage devices such as U disk encryption, hard disk encryption, and cloud storage encryption are safe.

④ Implementation Tips

When the selected single-length block and double-length block cipher algorithms have keys of various lengths, longer keys should be selected as the two keys K ^s and K ^d of the present invention to enhance security.

Secondly, two keys K ^s and K ^d and two initial vectors IV ^s and IV ^d must be shared by both parties through a secure channel. However, the method of sharing through the secure channel does not belong to the content of the present invention.

Invention Features

First, two layers of overlapping encryption are used for the packet. As a result, without knowing this method, even if the cryptanalyst obtains the encryption and decryption keys, it is impossible to obtain the final data plaintext through brute force cracking.

Second, the method of adding and sending is adopted, as a result, the efficiency of communication is improved.

Description of drawings

Fig. 1 is security model of the present invention;

Fig. 2 is encryption flowchart;

Figure 3 is a flow chart of decryption.

detailed description

1. Encryption process and implementation method

The specific encryption process is shown in Figure 2. For the plaintext packet p, the number of packets n is calculated in units of the length of the single-length packet, and three variables are initialized, i=0, and c stores the ciphertext packet of the first layer , C stores the ciphertext grouping of the second layer. The variable i is the subscript variable of the array used for ciphertext grouping, because the first element of the array and the number of the first grouping start from 0, so the initial value is 0. Array p is an array storing plaintext groups, each element in the array stores a single-length group of plaintext, and c stores an array of ciphertext groups of the first layer, and each element stores a ciphertext of the first layer The ciphertext group, C stores the array of the ciphertext group of the second layer, and each element stores a ciphertext group of the second layer ciphertext.

Regardless of whether the number of single-length blocks is odd or even, the entire encryption process is the same as the previous block encryption process, only the last encryption is different. Therefore, the entire encryption process can be divided into two parts. Distinguish by i, if i<n/2, then enter the encryption of the previous part of the packet, otherwise enter the final plaintext packet encryption.

First process the encryption of the two plaintext packets p ₀ and p _1. First, you need to judge whether i is 0. If the judgment condition is true, you need to encrypt the two plaintext packets p ₀ and p _1. The specific process is as follows: It is obtained from the previous two single-length plaintext packets p ₀ and p ₁ through the double-length encryption algorithm after XOR with the initial vector IV ^d of the double-length encryption algorithm, namely:

Then carry out the ciphertext encryption of the second layer, and calculate By The first 64 bits of are first XORed with the initial vector IV ^s and then encrypted using a single-length encryption algorithm, namely:

When the encryption of all single-length plaintext blocks of i<n/2 is the same, the specific operation of encrypting the 2i-th and 2i+1-th single-length plaintext blocks is as follows: first, encrypt the ciphertext of the first layer, and then Layer 1 subsequent ciphertext grouping They are all encrypted in the same way, namely:

Layer 2 encrypted ciphertext are grouped using layer 1 ciphertext The last 64 bits with The first 64 bits are merged first with XOR and then encrypted by a double-length encryption algorithm, namely:

When the variable i=n/2, the last single-length packet or the last encryption is entered at this time. The process is whether the number n of packets can be divisible by 2. If it can be divisible, it means that the encryption is now An even number of single-length plaintext packets, otherwise, an odd number of single-length plaintext packets. If it is an even number of packets, use the single-length encryption algorithm to calculate which is:

If it is an odd single-length packet, the last layer 1 ciphertext packet It is obtained by encrypting the last single-length plaintext packet p _n through a single-length block encryption algorithm, namely:

And the end of layer 2 is

Thus completing all encryption operations.

2. Decryption process and implementation method

The entire decryption process is shown in Figure 3. First, several variables are initialized: i, U _i , u _i , q _i . The variable i is the serial number of the packet, the variable U _i is the received ciphertext of the other party, u _i stores the ciphertext decrypted for the first time, and q _i stores the decrypted plaintext.

First judge whether i is less than n/2. If the condition is true, the ciphertext received from the other party is not the last ciphertext group, otherwise it is the last encrypted ciphertext group.

At the beginning of decryption, i is 0, so the first thing to decrypt is to receive the first two ciphertext packets, and decrypt the first two ciphertext packets from the received first two ciphertext packets. which is:

Among them, IV ^d is the initial vector of the double-length decryption algorithm. Subsequent decryption is the same until i<n/2, ie:

When the variable i increases to n/2, it means the final decryption operation. First, judge whether the packet length of the received ciphertext U is 128 bits. If the condition is true, it means that an odd number of single-length packets is decrypted, otherwise Decryption of an even number of single-length packets. If it is the decryption of an odd number of single-length blocks, the ciphertext block is first solved which is:

then pass q _n can be decrypted, namely:

If it is the decryption of an even number of single-length packets, the first decryption operation is performed first, that is:

then pass Perform the second decryption to get the last two plaintext packets, namely:

Thereby completing the entire decryption operation.

Claims (10)

1. A data encryption and decryption method of overlapped packets is characterized in that an overlapped method is adopted to encrypt each packet in a data plaintext in two layers, and the steps are as follows;

(1) encrypting every two plaintext blocks to form a layer 1 ciphertext block;

(2) and encrypting the layer 1 ciphertext block in a mode of closing the boundary to form a layer 2 ciphertext block, and taking the layer 2 ciphertext block as a final data ciphertext.

2. The method of claim 1, wherein the method comprises the following steps:

(1) the two parties of data encryption and decryption share two existing symmetric encryption algorithms and encryption and decryption related materials in advance;

(2) dividing a data plaintext into a plurality of fixed-length groups according to the length of a single long group;

(3) the encryptor performs combined encryption on every two plaintext packets to generate a layer 1 ciphertext packet;

(4) the encryption party carries out combined encryption on every two layers of 1 ciphertext groups in a mode of pressing the group boundaries to generate a layer 2 ciphertext group which is used as a final ciphertext;

(5) the decryption party carries out combined decryption on every two layers of layer 2 ciphertext groups to generate a layer 1 ciphertext group;

(6) and the decryption party performs combined decryption on every two layers of 1 ciphertext blocks, and the decryption result is used as a final data plaintext.

3. The data encryption and decryption method of an overlapped packet according to claim 1, wherein in the step (1), DES, 3DES, IDEA, AES, RC5, Blowfish, or Rijadeal is selected.

4. The method according to claim 1, wherein in step (2), "capping" means performing the following operations on two adjacent plaintext blocks: jointly encrypting the content of the second half of the previous packet and the content of the first half of the next packet to generate a layer 1 ciphertext packet, or performing the following operations on two adjacent layer 1 ciphertext packets: the contents of the second half of the previous packet and the contents of the first half of the next packet are jointly encrypted to generate a layer 2 ciphertext packet.

5. The method of claim 2, wherein the method further comprises: in step (1), there are multiple types of the required encryption and decryption materials, including a link operation mode, an initial vector and a symmetric key, and before using the method, both the encryption and decryption parties select an existing method to share the required encryption and decryption materials.

6. The data encryption and decryption method for overlapped packets according to claim 2, wherein: in step (2), the length of the single-length packet may be defined as 32 bits, 64 bits or 128 bits, and the length of the corresponding multiple-length packet is 64 bits, 128 bits or 256 bits.

7. The data encryption and decryption method for overlapped packets according to claim 2, wherein: in step (3), the encryptor performs joint encryption on two adjacent plaintext blocks to generate a layer 1 ciphertext block, and the subsequent plaintext blocks are also operated according to the method until all plaintext blocks are encrypted.

8. The data encryption and decryption method for overlapped packets according to claim 2, wherein: in step (4), the encryption side encrypts two adjacent layer 1 ciphertext blocks to generate one layer 2 ciphertext block as follows: so that the layer 2 ciphertext block covers the boundary between the two layer 1 ciphertext blocks, and as a result, the midpoint of the layer 2 ciphertext block aligns with the boundary of the two layer 1 ciphertext blocks.

9. The data encryption and decryption method for overlapped packets according to claim 2, wherein: in step (5), the decryptor performs joint decryption on two adjacent layer 2 ciphertext blocks to generate a layer 1 ciphertext block, and the subsequent layer 2 ciphertext blocks are also operated according to the method until all the layer 2 ciphertext blocks are decrypted.

10. The data encryption and decryption method for overlapped packets according to claim 2, wherein: in step (6), the decryptor performs joint decryption on two adjacent layer 1 ciphertext blocks to generate a plaintext block, and the subsequent layer 1 ciphertext blocks are also operated according to the method until all the layer 1 ciphertext blocks are decrypted.