WO2009068658A1

WO2009068658A1 - Methods and devices for encrypting and decrypting a data message with random secret key

Info

Publication number: WO2009068658A1
Application number: PCT/EP2008/066454
Authority: WO
Inventors: Pascal Manet; Olivier Faurax; Jean-Baptiste Rigaud
Original assignee: Commissariat A L'energie Atomique
Priority date: 2007-11-30
Filing date: 2008-11-28
Publication date: 2009-06-04
Also published as: FR2924550A1

Abstract

Method of encrypting a data message S comprising at least one step (102) for the calculation of at least one random key Ka1,0 on the basis of at least one random number Nba1 and of at least one secret key Ksecret/ an enciphering (105) of the data S on the basis of the random key Ka1,0 and of a plurality of diversified random keys Ka1,1 to Ka1,N calculated on the basis of the random key Ka1,0 delivering encrypted data Z, and a transmitting of the encrypted data Z and of an item of information produced on the basis of the random number Nba1 and/or of the secret key Ksecret.

Description

METHODS AND DEVICES FOR ENCRYPTING AND DECRYPTING A DATA MESSAGE WITH A RANDOM SECRET KEY

DESCRIPTION

TECHNICAL AREA

The invention relates to the field of secret key data cryptography. The invention may especially be used in any type of information processing processor, for example a smart card.

STATE OF THE PRIOR ART

Encryption algorithms are used in information processing processors, for example to protect confidential information (medical record), to allow access to particular services (pay-TV) or to identify individuals. (electronic passport). These processors are the subject of fraudulent manipulation, commonly called attacks, to obtain the keys used by the encryption algorithms, to know and / or corrupt confidential information, to access services for free or to pretend to be a third party . To achieve data encryption, it is known to use an algorithm called AES ("Advanced Encryption Standard"). FIG. 1 schematically represents the data coding steps implemented by an AES algorithm. The data to be encrypted is first cut into blocks of 128 bits, represented as a 4 × 4 matrix (reference 2 in FIG. 1) of 8-bit words. The AES algorithm uses a secret key 4 whose size can be equal to 128 bits, 192 bits or even 256 bits. In the example of FIG. 1, the key 4 comprises 128 bits represented in the form of a 4 × 4 matrix. During this coding, the algorithm executes several sets of steps, called rounds, whose number N _r depends on the size of the key used

(N _r = 10 for a 128-bit key, N _r = 12 for a 192-bit key and N _r = 14 for a 256-bit key). Whatever the size of the key used, the algorithm performs an initial round consisting of a step 6 of adding a round key, which is the secret key 4, with data 2. This addition step 6 is called "AddRoundKey" and is performed by an Exclusive OR.

Then we execute (N _r -1) rounds performing the following four functions:

"SubBytes" (step 8 in FIG. 1): each word of the data matrix obtained in the previous step is replaced by another word of similar size given by a correspondence table. It is a non-linear transformation.

"ShiftRows" (step 10 in FIG. 1): this is a transposition that cyclically shifts the words of the lines of the data matrix obtained at the output of "SubBytes". The words of rows of the matrix are shifted in a left circular shift, the number of squares in the line-dependent shift: the words in the first row of the matrix are not shifted, the words in the second row are shifted one square to the left, the words in the third line are shifted two squares to the left and the words in the fourth line are shifted three squares to the left.

"MixColumns" (step 12 in FIG. 1): this is a matrix multiplication between a constant matrix and the data matrix obtained at the output of "ShiftRows".

"AddRoundKey" (step 14 in FIG. 1): this is an addition (exclusive OR) between the data matrix obtained at the output of "MixColumns" and a diversified key 16, or round key, obtained after a diversification operation of the previous round key, called "KeySchedule" and carried out in each round. The "key schedule" directs diversification of operation from a key which is either the secret key 4 after the initial round, an (il) ^th round key 16 when executing the ^ith round, with i natural number between 2 and (Nr-I).

After repeating (N _r -1) both these functions, the algorithm performs a last final round (10 ^th round in the case of a 4 128-bit secret key) consisting of the implementation of a function "SubBytes (Reference 18 in FIG. 1), a function "ShiftRows" (reference 20 in FIG. 1) and an "AddRoundKey" function (reference 22 in FIG. 1).

At the output of the function 22 is obtained a matrix 24, of size equal to 4 × 4 of words of a size similar to the words of the matrix 2, encrypted data.

The decryption of these data can then be performed from the coded data by performing functions that are opposite to those performed for encryption. Knowledge of the secret key is therefore necessary to achieve the decryption of the data.

Various solutions, called countermeasures, have been proposed to render inoperative different types of attacks on such an algorithm. For example, to counter hidden channel type attacks, it is known to artificially add noise to the signals emitted by the chip, thus reducing their correlation with the manipulated data. Ad hoc software countermeasures are also introduced to make the analysis of the various extracted signals more complex. Against fault attacks, error detection and correction techniques as well as data redundancy are also known. Physical countermeasures, found on the electronic component implementing the algorithm, to guard against invasive attacks or faults are also known. These physical countermeasures, for example light sensors, are capable of detecting abnormal operation of the chip. In case of intrusion or fault injection, different actions can be taken ranging from a simple reset of the chip to a partial or full erasure of all information stored in the memory of the chip. Devices more specific to circuit protection against a reverse engineering phase can also be integrated (metal shield, dummy lines, etc.).

However, these solutions generally involve significant additional costs both at the hardware level (many additional logical functions necessary for the implementation of encryption and decryption) and at the time of execution of the algorithm, both for the encryption and decryption.

STATEMENT OF THE INVENTION

An object of the present invention is to propose a new method and a new encryption / decryption device offering better data protection, rendering ineffective attacks such as those carried out on an AES algorithm, and involving no or little additional costs to the user. hardware level and execution time compared to the countermeasures of the prior art. For this purpose, the present invention proposes a method of encrypting a data message S comprising at least one step of calculating at least one random key K _a i, ₀ from at least one random number Nb _ai and d at least one secret key K _seC ret and an encryption of the data S from the random key K _a i, o and a plurality of diversified random keys K _{al, 1} to K _a i, _N calculated from the random key K _a i, ₀ with, for example, at least one non-linear step.

The encryption method may also deliver encrypted data Z, and transmit encrypted data Z and information produced from the random number Nb _ai and / or the secret key K _seC ret.

By adding to the secret key K _seC ret a number, or variable, random Nb _ai , all the information is encrypted with a different key, which renders ineffective the attacks known from the prior art. This method therefore makes it possible to improve the security of the electronic device in which this method is implanted. By random number is meant, here and throughout the rest of the document, a completely random number or a pseudo-random number generated from a generator, or generation method, pseudo-random, realizing for example the generation of sequences encoding of the linear, nonlinear or hybrid transition type. This number is called "random" for its non-deterministic and not necessarily known character.

Thus, by applying a random element in the diversification of keys, the keys that are used for the encryption of the data are masked, which makes it possible to mask the data throughout the encryption process.

The fact of using additional information to the secret key, here produced from the random number and / or the secret key, allows that the information manipulated, both during the generation of diversified random keys and during encryption, has a random character. Thanks to the invention, this advantage is obtained with few additional elements on the global circuit implementing the encryption method, and in particular no additional element on the part of the circuit implementing the encryption.

This additional information can be generated in such a way that it is impossible to find the random number without knowing the secret key.

The present invention may also relate to a cryptographic method for an electronic device, for protecting data against attacks performed on the device, comprising calculating at least one random key K _a i, ₀ from at least one random number Nb _a i and at least one secret key K _seC ret, and to perform an encryption of the data S from the random key K _a i, ₀ and a plurality of diversified random keys K _ai , i to K _ai , _N calculated from random key K _a i, ₀ .

The electronic device may comprise a central unit equipped with at least one working memory used to perform the cryptographic process calculations and encryption, and a rewritable memory used to store device-specific and / or command-specific data. to execute to implement the cryptographic method. The cryptographic method can also be implemented in a hardware way by programming directly in an FPGA, an ASIC (application specific integrated circuit) or in a smart card, or in a crypto-processor dedicated to data encryption. The encrypted data obtained can therefore be a signal that can be transmitted securely over a network to another electronic device to be decrypted.

The calculation of each of the diversified random keys K _ai , i to K _ai , _N may comprise at least one non-linear operation. The use of one or more non-linear operations during the diversification of the keys makes it possible to increase the compatibility of the process with the existing processes, for example the AES type processes requiring a non-linear operation. The encryption method according to the invention is in this case compliant with the current symmetric encryption standard (AES) and can also be applied to other types of algorithms (Snake, Twofish, ...)

But in general, the calculation of each of the diversified random keys can be achieved by any type of key diversification operations, linear or not. The encryption method can calculate N diversified random keys K _ai , i to K _ai , _N , N being a natural number strictly greater than 1 equal to the number of rounds of the encryption method.

The N diversified random keys K _ai , i to K _a i, _N can be obtained at least by the following steps: calculating a first diversified random key K _ai , i from the random key K _a i, ₀ ;

calculating each of the NI diversified random keys K _alιl _, with i natural number such that 2 ≤ i ≤ N, from a previous diversified random key K _alιl _-ι.

The encryption of the data S can be achieved at least by the following steps:

calculation of coded data S _CO d, o from the random key K _a i, ₀ and data S to be encrypted;

calculation of N coded data S _CO d, i to S _CO d, N, each of the N coded data S _CO d, i / with i such that 1 ≤ i ≤ N, being calculated from previous coded data S _CO d , ii and the i ^th diversified random key K _a i ,! ; the N ^th coded data S _CO d, N can be encrypted data Z.

The encryption method may further comprise the following steps: calculating at least a first diversified key K _dlv , i from the secret key K _seC ret;

calculating NI diversified keys K _d i _V , 2 to Kdiv, N, each of the various diversified keys K _d i _V , i, with i such that 2 ≤ i ≤ N, being calculated from a previous diversified key K _dlVil- i;

- calculating a difference between a Dif _Km ^mth diverse random key _K i, _m and m ^th diversified key K _dlv, _m, where m is natural number such that 1 ≤ m ≤ N. The encryption method may comprise in addition the following steps: calculating at least a first diversified key K _dlv , i from the secret key K _seC ret;

- calculating a diversified key K ^m-th _dlv, _m from a (ml) ^-th diversified key K _dlv _{(_i m),} with m natural integer such that 2 <m ≤ N;

- calculating a difference between a Dif _Km ^mth diverse random key _K i, _m and m ^th diversified key K _dlv, _m, where m is natural number such that 1 <m <N; said information produced from the random number Nb _ai and / or the secret key K _seC ret may include the difference Dif _Km .

In this case, advantageously, the calculation of each of the diversified random keys K _ai , i to K _a i, _N can comprise at least one non-linear operation.

Said information produced from the random number Nb _ai and / or the secret key K _seC ret may furthermore comprise the number m which is chosen randomly.

In a variant, the random number Nb _ai may be of the pseudo-random type and the said information produced from the random number Nb _ai and / or the secret key K _seC ret may comprise an initial value from which the random number Nb _ai is generated.

The data encryption S can be achieved by: a) a step of adding the random key K _a i, o to a matrix formed by the data S to be encrypted, forming encoded data S _cod , o; then b) NI executions of the following steps:

substituting each word of a matrix formed by (he) ^th coded data S _CO d, ii _/ with i such that 1 ≤ i ≤ NI by another word of similar size;

cyclic transposition of the words of a matrix formed by the data obtained after the preceding substitution step;

matrix multiplication between a constant matrix and a matrix formed by the data obtained after the previous transposition step;

- addition between a matrix formed by the data obtained after the previous multiplication step and an ^i-th diverse random key K _alιlr with i such that 1 ≤ i ≤ NI, the data obtained being the i ^th encoded data _COd S, i; then c) the following steps:

substituting each word of a matrix formed by (NI) ^th coded data S _CO d, <ND by another word of similar size;

cyclic transposition of the words of a matrix formed by the data obtained after the preceding substitution step; adding between a matrix formed by the data obtained after the previous transposition step and the N ^th diversified random key K _ai , _N , the data obtained being the encrypted data Z.

The present invention also relates to a device for encrypting a data message S comprising at least calculation means of at least one random key K _a i, ₀ from at least one random number Nb _ai and at least one secret key K _seC ret, and means for encrypting the data S from a plurality of diversified random keys K _ai , i to K _ai , _N calculated from the random key K _a i, ₀ , with N natural number strictly greater than 1. N may be equal to the number of rounds performed by the encryption device.

The invention also relates to a device for encrypting a data message S comprising at least means for calculating at least one random key K _ai , ₀ from at least one random number Nb _ai and at least one a secret key K _seC ret, means for encrypting the data S from the random key K _ai , ₀ and a plurality of diversified random keys K _ai , i to K _ai , _N calculated from the random key K _ai , o, with N natural number strictly greater than 1, delivering encrypted data Z, and means for transmitting the encrypted data Z and information produced from the random number Nb _ai and / or the secret key K _seC ret •

The encryption device may further comprise:

means for calculating at least a first diversified random key K _ai , i from the random key K _a i, ₀ ;

means for calculating each of the NI diversified random keys K _alılr with i natural integer such that 2 ≤ i ≤ N, from a previous diversified random key K ₃ I ₁₁ -I. The means for calculating each of the diversified random keys K _ai , i to K _ai , _N can perform at least one non-linear operation.

The data encryption means S may comprise at least:

means for calculating coded data S _C od, o from the random key K _a i, ₀ and data S to be encrypted;

means for calculating N coded data S _CO d, S to S _CO d, N / each of the N coded data S _CO d, i / with i such that 1 ≤ i ≤ N, being calculated from previous coded data S _CO d, ii and the i ^th diversified random key K _a i ,! ; the N ^th coded data S _CO d, N can be the encrypted data Z.

The encryption device may further comprise:

means for calculating at least a first diversified key K _dlv , i from the secret key K _seC ret;

- means for calculating a diversified key K ^m-th _dlv, _m from a (ml) ^-th diversified key k div, (mi), where m is natural number such that 2 ≤ m ≤ N; - means for calculating a difference

Dif _Km between ^mth diversified random key K _I, _m and m ^th diversified key K _dlv, _m.

In this case, said information produced from the random number Nb _ai and / or the secret key Kgecret can include the difference Dif _Km . Said information produced from the random number Nb _ai and / or the secret key K _seC ret may furthermore comprise the number m which is chosen randomly. In one variant, the random number Nb _ai may be of the pseudo-random type and the said information produced from the random number Nb _ai and / or from the secret key K _seC ret may comprise an initial value from which the random number Nb _ai is generated.

The data encryption means S may comprise:

means for adding the random key K _a i, o and diversified random keys K _ai , i to K _ai , _N to data matrices;

means for substituting each word of a data matrix with another word of similar size;

means for cyclically transposing the words of a data matrix;

- Matrix multiplication means between a data matrix and a constant matrix.

The present invention also relates to a decoding method of an encrypted data message Z comprising at least a step of calculating an ^Nth diverse random key K _ai, _N from a secret key K _S ecret and a Dif _Km difference between an ^mth diversified random key _K i, _m and m ^th diversified key _Kd iv m or information generated from a random number Nb _have and / or the secret key K _seC ret, a reverse diversification step carried out from the N ^th diversified random key K _ai , _N computing NI diversified random keys K _a i, _N _i to K _ai , i and a random key K _a i, ₀ , and a decryption of the data Z from the N diversified random keys K _ai , i to K _ai , _N and the random key K _a i, ₀ , with N a natural number strictly greater than 1, m possibly being a natural number such that 1 ≤ m ≤ N.

The present invention may also relate to a cryptographic method for an electronic device, for decrypting protected data against attacks made on the device, of calculating an ^Nth diverse random key K _ai, _N from a secret key K _seC ret and a _Km Dif difference between an ^m-th diverse random key K _I, _m and m ^th diversified key K _dlv, _m or information generated from a random number Nb _have and / or the key secret K _seC ret, perform an inverse diversification from the N ^th diversified random key K _ai , _N calculating NI diversified random keys K _a i, _N _i to K _ai , i and a random key K _ai , o, and realize a decryption of the Z data from the N diversified random keys K _{al, 1} to K _a i, _N and the random key K _ai , o, with N natural integer strictly greater than 1, m possibly being a natural whole number such that 1 ≤ m ≤ N.

N can be the number of rounds of the decryption process.

The inverse diversification step calculating the NI diversified random keys K _a i, _N _i to K _{al, 1} and the random key K _a i, ₀ can comprise at least one non-linear operation. The information generated from a random number Nb _have and / or the secret key K _seC ret may include a difference between a Dif _Km ^mth diversified random key K _I, _m and m ^th diversified key K _dlv, _m , with m natural integer such that 1 ≤ m ≤ N.

The information produced from a random number Nb _ai and / or the secret key K _seC ret may furthermore comprise the number m.

The calculation of the N ^th diversified random key K _ai , _N can be obtained at least by the following steps:

calculating at least a first diversified key K _dlv , i from the secret key K _seC ret;

calculation of m-1 diversified keys K _dlv , ₂ to K _dlv , _m , each of the diversified m-1 keys K _d1 V,!, with i natural number such that 2 ≤ i ≤ m, being calculated from a previous diversified key K _dlVil- i;

- addition of the ^m-th diversified key K _dlv, _m previously calculated and difference Dif between the ^m-th _Km diverse random key _K i, _m and m ^th diversified key K _dlv, _m;

calculation of (N-m + 1) diversified random keys K _a i, _{m +} 1 to K _ai , _N , each of these diversified random keys K _ai , _D , with j natural integer such that m + 1 ≤ j ≤ N , being calculated from a previous diversified random key K _a i, _D _i.

In one variant, the random number Nb _ai may be of the pseudo-random type and the information produced from a random number Nb _ai and / or from the secret key K _seC ret may comprise an initial value from which the random number Nb _ai is generated. The inverse diversification can realize the computation of NI diversified random keys K _a i, _N _i to K _ai , i and the random key K _a i, ₀ , each of these keys K _alιlr with i natural number such that 0 ≤ i ≤ NI, being calculated from a previous diversified random key K _a i, ₁₊ i.

The decryption of encrypted data Z can be achieved at least by the following steps:

calculation of decoded data S _deC od, o from the N ^th diversified random key K _ai , _N and encrypted data Z;

calculating N decoded data S of _C od, i to Sdecod, N, each of N decoded data S of _C od, i, with i such that 1 ≤ i ≤ N, being calculated from previous decoded data S _deC od, ii and the (N-i + 1) ^th diversified random key K _a i, _N _ ₁₊ i; the N ^th decoded data S _deC od, N can be decrypted data S.

The decryption of data can be achieved by: a) the following steps:

adding the N ^th diversified random key K _ai , _N to a matrix formed by the encrypted data Z, thereby forming decoded data S _deC od, o; cyclic transposition of the words of a matrix formed by the data obtained after the preceding step of addition;

replacing each word of a matrix formed by the data obtained after the preceding cyclic transposition step with another word of similar size, thus forming first decoded data S _deC od, i; then b) NI executions of the following steps:

- addition between a matrix formed by the (il) ^th decoded data S _deC od, ii and i ^th diverse random key K _alιl _, with i such that 2 ≤ i ≤ N;

matrix multiplication between a matrix formed by the data obtained after the preceding step of addition and a constant matrix; cyclic transposition of the words of a matrix formed by the data obtained after the preceding multiplication step;

- substitution of each word in a matrix formed by the data obtained after the previous step of cyclic transposition, the data obtained being the i ^th decoded data _SCD S, i; then c) a step of adding between a matrix formed by the N ^th decoded data S _deC od, N and the random key K _a i, ₀ , the data obtained being decrypted data S.

The present invention also relates to a deciphering device a message encrypted data comprising at least means for calculating a ^Nth diverse random key K _ai, _N from a secret key K _seC ret and a difference dif _Km between ^mth diversified random key K _I, _m and m ^th diversified key K _dlv, _m or information generated from a random number Nb _have and / or the secret key K _S ecret _/ of means of inverse diversification from the N ^th diversified random key K _ai , _N calculating NI diversified random keys K _a i, _N _i to K _ai , i and the key random K _a i, ₀ , and means for decrypting the data Z from the N diversified random keys K _{al, 1} to K _a i, _N and the random key K _a i, ₀ , with N natural number strictly greater at 1, m possibly being a natural number such that 1 ≤ m ≤ N.

The inverse diversification means calculating the NI diversified random keys K _a i, _N _i to K _{al, 1} and the random key K _a i, ₀ can perform at least one non-linear operation. When the information produced from a random number Nb _ai and / or from the secret key K _seC ret comprises a difference Dif _Km between a m ^th diversified random key K _ai , _m and a diversified m ^th key Kdiv, m, with m natural integer such that 1 ≤ m ≤ N, the means for calculating the N ^th diversified random key K _a i, N may comprise at least:

means for calculating at least a first diversified key K _dlv , i from the secret key K _seC ret; means for calculating diversified key m-1 K _dlv , ₂ to K _dlv , _m , each of the diversified key m-1 K _dlVιl , with i natural number such that 2 ≤ i ≤ m, being calculated from a previous diversified key K ^ v ^ -i; - means for adding the ^m-th diversified key K _dlv, _m previously calculated and difference Dif between the ^m-th _Km diverse random key _K i, _m and m ^th diversified key K _dlv, _m;

means for calculating (N-m + 1) diversified random keys K _a i, _{m +} i at K _ai , _N , each of these diversified random keys K _ai , _D , with j integer natural as m + 1 ≤ j ≤ N, being calculated from a previous diversified random key K _a i, _D _i.

The inverse diversification means can calculate NI diversified random keys K _a i, _N _i K _{al, 1} and the random key K _a i, ₀ , each of these keys K _a i,!, With i natural number such that 0 ≤ i ≤ NI, being calculated from a previous diversified random key K _a i, ₁₊ i.

The means for decrypting the data may comprise at least:

- data calculating means _decod decoded S o from the ^Nth diverse random key K _I, _N and Z encrypted data;

means for calculating N decoded data S _deC od, i to S _deC od, N, each of the N decoded data

Sdecod, i / with i such that 1 ≤ i ≤ N, being calculated from previous decoded data S _of cod, ii and the (N-i + l) ^th diversified random key K _a i, _N _ _{1 + 1} ; N ^th decoded data _S cod, N that can be decrypted data S.

The data decryption means may comprise:

means for cyclically transposing the words of a data matrix;

means for substituting each word of a data matrix with another word of similar size; - Matrix multiplication means between a data matrix and a constant matrix.

The invention also relates to a signal processing device for implementing a method of encrypting a data message and / or a method for decrypting an encrypted data message as described above.

The invention also relates to a smart card comprising at least one device for encrypting a data message and / or a device for decrypting an encrypted data message as described above.

The invention also relates to a data support, readable by a computer system, comprising data in coded form, for implementing an encryption method and / or a decryption method as described above.

Finally, the invention relates to a software product comprising a data medium that can be read by a computer system, making it possible to implement an encryption method and / or a decryption method as described above.

The invention applies in particular for an AES type algorithm. However, the principles of the invention can be applied to other types of algorithms, for example any encryption and / or decryption algorithm using a "non-trivial" key calculation, comprising for example at least one non-linear substitution step and / or a permutation step on calculated keys. BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be better understood on reading the description of exemplary embodiments given purely by way of indication and in no way limiting, with reference to the appended drawings in which:

FIG. 1 diagrammatically represents the data coding steps implemented by an AES algorithm according to the prior art; FIG. 2 represents the steps performed during the implementation of an exemplary embodiment of a method of data encryption according to the invention,

FIG. 3 schematically represents the steps implemented during a data encryption performed during an exemplary embodiment of a data encryption method according to the invention,

FIG. 4 represents a correspondence table used during a substitution operation executed during an exemplary embodiment of a data encryption method according to the invention,

FIG. 5 represents the steps performed during the implementation of an exemplary embodiment of a method for decrypting encrypted data according to the invention,

FIG. 6 schematically represents the steps implemented during a data decryption performed during an exemplary embodiment of a method for decrypting encrypted data according to the invention, FIG. 7 represents a correspondence table used during a substitution operation executed during an exemplary embodiment of a method for decrypting encrypted data according to the invention,

FIG. 8 represents an example of a circuit intended to implement a data encryption method according to the invention,

FIG. 9 represents an example of a circuit intended to implement a data decryption method according to the invention.

Identical, similar or equivalent parts of the different figures described below bear the same numerical references so as to facilitate the passage from one figure to another.

The different possibilities (variants and embodiments) must be understood as not being exclusive of each other and can be combined with one another.

DETAILED PRESENTATION OF PARTICULAR EMBODIMENTS

Referring to Figure 2 which shows the steps performed during the implementation of an exemplary embodiment of a random secret key data encryption method. The data message to encrypt, referenced

"S" in Figure 2, is first cut into 128-bit blocks represented as a 4 x 4 matrix whose inputs are respectively 8-bit words (bytes). These blocks are then encrypted independently of each other to obtain the end of the process of encrypting the encrypted data blocks, referenced "Z" in Figure 2, which can then be concatenated and form an encrypted data message.

In the exemplary embodiment of the method described, all the arithmetic operations are performed on 8-bit words arranged in a matrix.

4 x 4. We can thus place ourselves, for the calculations, in a finite field called extended Galois field denoted GF ( ²⁸ ), having as primitive polynomial: P (x) = x ⁸ + x ⁴ + x ³ + x + 1.

A first set of functions, called the initial round, is first made, comprising firstly the calculation of a random key K _ai , o from a random number Nb _a i, for example non-zero, and of the entirely random or pseudo type. -random, and a secret key K _seC ret, for example also non-zero.

The random key K _ai , o is obtained by an addition 102 between the secret key K _seC ret and the random number Nb _ai . The size of the secret key K _seC ret can be equal to 128 bits, 192 bits or even 256 bits, and is here chosen equal to the size of the data blocks

5 to encrypt. In the example of FIG. 2, the secret key K _seC ret comprises 128 bits represented in the form of a 4 × 4 matrix whose inputs are 8-bit words. The size of the random number Nb _ai is chosen equal to the size of the secret key K _seC ret • This addition 102 is performed by an exclusive OR between the secret key K _seC ret and the random number Nb _ai . We obtain at the output of the addition 102 the random key

K _to l, 0 • During the initial round, the random key K _a i, o is used. In the next round, the calculation is made of a first diversified random key K _{al, 1} , or first random round key, obtained from the random key K _a i, ₀ by a diversification operation 103, called "KeySchedule From this random key K _a i, o. So we have K _{al, 1} = KeySchedule (K _a i, ₀ ).

This function 103 "KeySchedule" makes it possible to calculate N diversified random keys K _{al, 1} to K _ai , _N , where N is the number of rounds realized during the encryption process. The value of N is a function of the size of the secret key K _seC ret used: for a secret key K _S 128 bit write, we have N = 10; N = 12 for a 192-bit key; and N = 14 for a 256-bit key. The "KeySchedule" function will be detailed later in the description.

These diversified random keys K _{al, 1} to K _ai , _N and the random key K _a i, o are used to perform an encryption 105 of the data S detailed below in connection with FIG. 3. In this embodiment, the keys K _a i, o to K _ai , _N are computed parallel to the execution of the cipher 105. In a variant, it is possible for the diversified random keys K _{al, 1} to K _ai , _N and the random key K _a i , o be calculated before executing the encryption 105.

First, the encryption 105 completes the initial round by computing coded data S _CO d, o from the random key K _a i, o and data S. A function 104, called "AddRoundKey", performs this calculation. So we have :

S _cod , o = AddRoundKey (K _a i, o, S). The "AddRoundKey" calculation of the coded data S _COd , o is here an addition operation, performed by an "exclusive OR", between the initial data S and the random key K _a i, ₀ .

The initial round being completed, we execute N rounds. Each j_ ^th round, with natural number i such that 1 ≤ i ≤ NI, has four functions which are detailed below.

During each of these rounds, the method first executes a function 106, called "SubBytes", during which each word of the coded data matrix obtained in the preceding step (the coded data S _COd , o when one has completed the execution of the initial round, or (ii) ^th encoded data S _CO d, ii when an ^i-th round is performed with 2 ≤ i ≤ NI) is replaced by another word. For this, an elementary transformation called "sub" is applied to each word S _CO d (c, d) of the coded data S _CO d such that: od (c, d)) = -1

SUb (Sc S _C od (c, cd) b if Scod (c, cd) is non-zero, or sub (S _C od (c, d)) = b if S _C od (c, d) is zero, with c and d natural integers, b = {63} (hexadecimal notation), and

The operator "*" represents the multiplication of the matrices in the Galois field GF ( ²⁸ ), and ScQd ( _C d) ^'1 represents a inverse word of the encoded data S _CO d- The function "SubBytes" is therefore a function non-linear substitution. This substitution function can also be represented in the form of a table comprising the substitution values of the words of the coded data S _COd - A word S _CO d (c, d) (here a byte) whose value is denoted by "x , y ", where x and y represent respectively the most significant and least significant bits, is therefore substituted by the word whose value is in the table represented in FIG. 4, at the intersection of the line x and the column y corresponding. For example, if the word S _C odi (i, i) has the value {04}, then we have:

SubBytes (Scodid, D) = {F2}.

A function 108 called "ShiftRows" is then executed on the data obtained at the output of "SubBytes" 106. This function 108 consists of a transposition cyclically shifting the words of the rows of the matrix obtained at the output of "SubBytes". The words of the lines are shifted with a left circular shift, the number of squares of the shift depends on the line: the words of the first line of the matrix are not shifted, the words of the second line are shifted by one square to the left, the words in the third line are shifted two squares to the left and the words in the fourth line are shifted three squares to the left. For example, if we have in input of the function "ShiftRows" a matrix M such that:

we then obtain at the output the matrix

A function 110, called "MixColumns" then performs a matrix multiplication in GF ( ²⁸ ) between the matrix obtained at the output of "ShiftRows" and a constant matrix A ₀ such that:

This calculation is done by column, that is, each column depends on the entire input column.

Next, the "KeySchedule" function 103 (shown in FIG. 2) is executed, performing a diversification operation of the key previously used, which is either the random key K _ai , o when the initial round is performed, or a (il) ^th diverse random key _K ^ ₁ -I when performing the other rounds. By writing the: (i-1) th diversified random key K _{al, i-1} in the form

the diversified random key K _{al, i} obtained is then of the form

With:

"Sub" corresponds to the nonlinear transformation function previously described for the "SubBytes" function. R _con is a one-dimensional array of constants (in hexadecimal), indexed by the number of the current round:

So we have K _a i _,! = KeySchedule (R _a i ^ -i).

Finally, the i ^th round, with i such that 1 <i <NI, ends with the computation (function 112 called "AddRoundKey") of i ^th coded data S _COd , i from the i ^th diversified random key K _a i ,! and data obtained at the output "MixColumns" 110. This function 112 "AddRoundKey" is similar to the function 104 "AddRoundKey" performed during the initial round.

The ^Nth round is then executed. Compared to i round ^th, with i such that 1 <i <NI, this last round N contains only three functions 114, 116, 118 respectively similar to functions 106 "SubBytes" 108 "ShiftRows" and 112 "AddRoundKey". At the end of this last round, the Z encrypted data is output.

These steps are repeated for each of the data blocks. Thus, the encryption performed makes it possible to encrypt each block of information by a different key. Moreover, since this key is random for each block of data, the known attacks used against the AES algorithm are ineffective here. The random key must, however, be known for decrypting the encrypted data. For this, in parallel with the steps described above, the method also performs, during the first round, a function 107 "KeySchedule", represented in FIG. 2, from the secret key K _seC ret, thus delivering a first diversified key K _dlv , i. This function "KeySchedule" is also repeated during the following rounds using each time the diversified key K _dlv calculated previously. By calculating the difference between an ^m-th diversified random key _K i, _m and m ^th diversified key K _dlv, _m (operation 109 in Figure 2), where m is natural number such that 1 ≤ m ≤ N, there is obtained a Dif _Km information usable to perform the decryption of the data. It is then possible to perform the decryption from this information Dif _Km and the secret key K _seC ret • It is preferable to perform the calculation of this difference Dif _Km during a round located substantially in the middle of the set of rounds. In the example described above, the encryption being performed on 10 rounds, so we choose to achieve this difference during the fifth round (m = 5), that is to say, to calculate the difference Dif _K s = K _a i , ₅ - K _dlv , ₅ . However, it is possible to choose another value of m.

In general, any information chosen according to the random number Nb _ai and / or the secret key K _seC ret can be transmitted to find the random number Nbal or the random key K _a i, ₀ . When the random number Nb _ai is obtained from a pseudo-random generator, this information transmitted may be the seed or the initial number from which the pseudo-random number is generated.

A method of decrypting the previously encrypted data will now be described with reference to FIG.

Firstly, a "KeySchedule" function 202, similar to the "KeySchedule" function performed during the data encryption method, is realized, thus realizing a diversification of the secret key K _seC ret • "KeySchedule" is executed N times, N corresponding to the number of rounds made during the encryption process.

When the function "KeySchedule" calculates the m ^th diversified key K _dlv , _m , the information Dif _Km = K _a i, _m - K _dlv , _m is added to the m ^th diversified key

Kdiv, m- We obtain then the m ^th diverse random key

K _a l, m •

The function "KeySchedule" 202 is then continued from the m ^th diversified random key K _a i, _m , thus making it possible to obtain the last diversified random key K _ai , _N.

A reverse key diversification function 204, called "InvKeySchedule", then makes it possible to output the N diversified random keys K _{al, 1} to K _a i, _N used during the encryption of the data. This "InvKeySchedule" function performs the inverse matrix operation of the "KeySchedule" function

The (il) ^th diversified random key _K i - i obtained by the "InvKeySchedule" Then K form _a i, ii = InvKeySchedule _(K i, i), that is to say, if :

then the (i-1) ^th random key K -al, l-1 is written in the form:

From the N diversified random keys obtained, a decryption 206 of the Z data is then carried out. This decryption will be detailed with reference to FIG. 6. A function "AddRoundKey" which is similar to the function "AddRoundKey" 118 is implemented. This step is similar for encryption and decryption because the OR addition operation is also its own inverse operation. An exclusive OR is thus realized between the encrypted data Z and the last (N ^th ) diversified random key.

A function 210 "InvShiftRows" is then executed on the data obtained at the output of "AddRoundKey" 208. This function 210 is the inverse function of "ShiftRows". This function "InvShiftRows" consists of a transposition cyclically shifting the words of the rows of the matrix obtained at the output of "AddRoundKey" 208. The words of the lines are shifted in a right-hand circular shift, the number of squares of the line-dependent shift: the words in the first row of the matrix are not shifted, the words in the second row are shifted one square to the right, the words in the third line are shifted two squares to the right and the words in the fourth line are shifted three squares to the right.

For example, if we have at the input of the function "InvShiftRows" a matrix M such that:

we then obtain at the output the matrix

The decryption method then executes a function 212, called "InvSubBytes", in which each word of the matrix obtained in the previous step is replaced by another word. For this, an elementary transformation called "invsub" is applied to each word to transform. For that, one carries out the inverse of the affine transformation used for the elementary transformation "sub", then one applies the inverse multiplicative on the result. The "InvSubBytes" function is therefore a nonlinear substitution function. This substitution operation can also be represented in the form of a table comprising the substitution values of the words of the coded data. A word (here an octet) whose value is denoted "x, y", where x and y respectively represent the most significant and least significant bits, is therefore substituted by the word whose value is in the table represented on FIG. 7, at the intersection of the line x and the corresponding column y. For example, if the word to be substituted has the value {04}, then we have:

SubBytes ({04}) = {30}.

These functions performed above correspond to the inverse functions of those performed during the last round of the encryption process.

The four inverse functions of those corresponding to the rounds 1 to N-I of the encryption method are then performed.

We first perform a function

"AddRoundKey" 214, for example similar to the function "AddRoundKey" 208, using the h ^th diverse random key K _a i, _h corresponding to the number h round.

A function 216, called "InvMixColumns", corresponding to the inverse of the "MixColumns" function, then performs a matrix multiplication in GF (2) between the matrix obtained at the output of the function "AddRoundKey" 214 and a constant matrix B ₀ such than :

This calculation is done by column, that is, each column depends on the entire input column. We then execute a function

"InvShiftRows" 218, for example similar to the function "InvShiftRows" 210, on the data obtained at the output of "InvMixColumns" 216.

The round is terminated by a function "InvSubBytes" 220, for example similar to the function "InvSubBytes" 212.

The decryption of the data Z is then completed by performing the last round, corresponding to the inverse of the first round, or initial round, of the encryption. This last round consists of an "AddRoundKey" function 222 similar to the other "AddRoundKey" functions performed. The output of this "AddRoundKey" function 222 is the decrypted data S. FIG. 8 represents an example of an implementation of a circuit 300 implementing the random secret key encryption method described above.

The data to be encrypted is entered on a 32 bit bus 302, and the encrypted data is output from the circuit 300 on an output bus 304 also 32 bits. The secret key is entered on a bus 306 also 32 bits. Conversion means 308 converts four 32-bit words of data into a single 128-bit length S data contained in a register. Likewise, converting means 310 converts the secret key into a single 128-bit, 192-bit or 256-bit K _seC ret data. At the output of the circuit 300, converting means 312 converts the 128-bit encrypted data Z into 32-bit words on the output bus 304. A state controller 314 speeds the random key diversification "KeySchedule" performed by means of diversification 316 and the encryption of the data by encryption means 318. These encryption means 318 perform the functions "SubBytes", "ShiftRows", "MixColumns" and "AddRoundKey". The diversification of the secret key (function 107 of FIG. 2) can be achieved by the diversification means 316 if they are fast enough to carry out two distinct diversifications during a round, as is the case in FIG. 8, or by other means of diversification. In both cases, the output value of the circuit 300 will also be delivered with the value of the difference Dif _Km = K _ai , _m -K _dlv , _m making it possible to perform a subsequent decryption of the data.

Each round is performed on a cycle, with the diversified random keys being produced in parallel with the execution of the rounds. This computation synchronization is carried out by the state controller 314. Different control signals are also exchanged between the various components of the circuit 300.

At the end of the N rounds, the state controller 314 authorizes the sending of the encrypted text to the conversion means 312.

The random number Nb _have used in this encryption method can be obtained from a random number generator external to the circuit 300, or by using an internal state of said 300 implementation circuit encryption method. The random number Nb _i used by the encryption method can be directly this internal state or the number obtained at the output of the generator, or be the result of the addition of the previous random key (used for coding a previous block of data) in the internal state or the number obtained at the output of the generator. One can also choose randomly between these different possibilities for each block of data to be encrypted. FIG. 9 represents an exemplary implementation of a circuit 400 implementing the random secret key decryption method described above.

The data to be decrypted is entered on a 32 bit bus 402, and the decrypted data is output from the circuit 400 on an output bus 404 also of 32 bits. The secret key, as well as the value of the difference Dif _Km , are input on a bus 406 also of 32 bits. Conversion means 408 converts four 32-bit words of data into a single data of length 128 bits contained in a register. Likewise, converting means 410 converts the secret key and the difference Dif _Km into 128-bit, 192-bit or 256-bit data. At the output of circuit 400, converting means 412 converts the 128-bit decrypted data into 32-bit words on the output bus 404.

A state controller 414 rates the diversification of the secret key "KeySchedule" performed by means 416, making it possible to obtain the last diversified random key from the secret key and the key difference information Dif _Km . These means 416 then perform the reverse diversification to obtain diversified random keys. The state controller 414 also decrypts the data decryption by means of decryption 418. These decryption means 418 execute the functions "InvSubBytes", "InvShiftRows", "InvMixColumns" and "AddRoundKey". Each round is performed on a cycle, with the diversified random keys being produced in parallel with the execution of the rounds. This computation synchronization is carried out by the state controller 414. Different control signals are also exchanged between the various components of the circuit 400.

At the end of the N rounds, the state controller 414 authorizes the sending of the decrypted text to the conversion means 412. The fact of using the difference Dif _Km in the middle of the encryption (for example to the fifth or sixth round if the encryption is done in 10 rounds) allows to get out this number Dif _Km without losing time in the encryption (a process performing the encryption in 10 rounds on a 32-bit bus can finish extracting this value in 4 round and thus before the end of the execution of the encryption) and to limit the loss of time in the decryption level.

Claims

A method of encrypting a data message S comprising at least one calculation step (102) of at least one random key K _a i, ₀ from at least one random number Nb _ai and at least one a secret key K _S ecret / an encryption (105) of the data S from the random key K _a i, ₀ and a plurality of diversified random keys K _ai , i to K _ai , _N calculated from the key random K _a i, ₀ delivering encrypted data Z, and a transmission of the encrypted data Z and information produced from the random number Nb _ai and / or the secret key K _seC ret •

2. Encryption method according to claim 1, wherein the calculation of each of the diversified random keys K _ai , i to K _ai , _N comprises at least one non-linear operation.

3. Encryption method according to one of claims 1 or 2, calculating N diversified random keys K _ai , i to K _ai , _N , N being a natural number strictly greater than 1 equal to the number of rounds of the encryption process.

4. Encryption method according to claim 3, wherein the N diversified random keys K _ai , i to K _ai , _N are obtained at least by the following steps: - calculation of a first diversified random key K _ai , i from the random key K _a i, ₀ ; calculating each of the NI diversified random keys K _alιl _, with i natural number such that 2 ≤ i ≤ N, from a previous diversified random key K _alιl _-ι.

5. Encryption method according to claim 4, wherein the encryption (105) of the data S is performed at least by the following steps: - calculation (104) coded data S _CO d, o from the random key K _ai , o and S data to be encrypted;

calculation of N coded data S _CO d, i to S _CO d, N, each of the N coded data S _CO d, i / with i such that 1 ≤ i ≤ N, being calculated from previous coded data S _CO d , ii and the i ^th diversified random key K _{alι ±} ; the N ^th coded data S _CO d, N being the encrypted data Z.

6. Encryption method according to one of claims 4 or 5, further comprising the following steps:

calculating (107) at least a first diversified key K _dlv , i from the secret key K _seC ret;

- calculating (107) an ^m-th diversified key K _d iv, m from a (ml) ^-th diversified key K _SLD _(m -i), where m is natural number such that 2 ≤ m ≤ N;

calculating (109) a difference Dif _Km between a diversified random ^multi- key K _a i, _m and the m ^th key diversified K _dlv , _m , with m natural integer such that 1 ≤ m ≤ N; said information produced from the random number Nb _ai and / or the secret key K _seC ret including the difference Dif _Km .

7. An encryption method according to claim 6, wherein said information produced from the random number Nb _ai and / or the secret key K _seC ret further comprises the number m which is randomly selected.

8. Encryption method according to one of claims 4 or 5, wherein the random number Nb _a i is of the pseudo-random type and said information produced from the random number Nb _ai and / or the secret key K _seC ret comprises an initial value from which the random number Nb _ai is generated.

9. Encryption method according to one of claims 5 to 8, wherein the encryption (105) of data S is achieved by: a) a step of adding (104) the random key K _a i, ₀ to a matrix formed by the data S to be encrypted, forming coded data S _CO d, o; then b) NI executions of the following steps:

substituting (106) each word of a matrix formed by (il) ^th coded data

S _C od, ii _/ with i such that 1 ≤ i ≤ NI by another word of similar size; cyclic transposition (108) of the words of a matrix formed by the data obtained after the preceding substitution step (106);

matrix multiplication (110) between a constant matrix and a matrix formed by the data obtained after the preceding transposition step (108);

- adding (112) between a matrix formed by the data obtained after the previous step of multiplying (110) and an ^i-th diverse random key K _alιlr with i such that 1 ≤ i ≤ NI, the resulting data being the i ^th data coded S _COd , i; then c) the steps of: - replacing (114) of each word in a matrix formed by the (NI) ^th encoded data SCOD (N- _D by another similarly sized word;

cyclic transposition (116) of the words of a matrix formed by the data obtained after the preceding substitution step (114); addition (118) between a matrix formed by the data obtained after the previous transposition step (116) and the N ^th diversified random key K _ai , _N , the data obtained being the encrypted data Z.

10. Device for encrypting (300) a data message S comprising at least calculation means (316) of at least one random key K _a i, ₀ from at least one random number Nb _ai and d at least one secret key K _seC ret, encryption means (318) data S from the random key K _a i, ₀ and a plurality of diversified random keys K _ai , i to K _ai , _N calculated from the random key K _a i, ₀ , with N natural number strictly greater than 1, delivering encrypted data Z, and means for transmitting the encrypted data Z and information produced from the random number Nb _ai and / or the secret key K _seC ret •

The encryption device (300) of claim 10, further comprising:

calculating means (316) of at least a first diversified random key K _ai , i from the random key K _a i, ₀ ; calculation means (316) for each of the

NI diversified random keys K _{al / 1} , with i natural integer such that 2 ≤ i ≤ N, from a previous diversified random key K _alιl _-ι.

12. An encryption device (300) according to claim 11, wherein the calculation means (316) of each of the diversified random keys K _ai , i to K _a i, _N perform at least one non-linear operation.

13. An encryption device (300) according to one of claims 11 or 12, wherein the encryption means (318) of the data S comprise at least:

means for calculating coded data S _CO d, o from the random key K _a i, ₀ and data S to be encrypted; means for calculating N coded data S _C od, i to S _CO d, N / each of the N coded data S _CO d, i / with i such that 1 ≤ i ≤ N, being calculated from previous coded data S _CO d, ii and the i ^th diversified random key K _a i, i; the N ^th coded data S _CO d, N being the encrypted data Z.

14. Encrypting device (300) according to one of claims 11 to 13, further comprising:

calculating means (316) of at least one first diversified key K _dlv , i from the secret key K _seC ret;

- means for calculating (316) an ^m-th diversified key K _dlv, _m from a (ml) ^-th diversified key

Kdiv, (m-i) t with m natural integer such that 2 ≤ m ≤ N;

- means for calculating (318) a difference between a Dif _Km ^mth diverse random key _K i, _m and m ^th diversified key K _dlv, _m; said information produced from the random number Nb _ai and / or the secret key K _seC ret including the difference Dif _Km .

15. An encryption device (300) according to claim 14, wherein said information produced from the random number Nb _ai and / or the secret key K _seC ret further comprises the number m which is randomly selected.

16. Encrypting device (300) according to one of claims 11 to 13, wherein the random number Nb _ai is of the pseudo-random type and said information produced from the random number Nb _ai and / or the secret key K _seC ret has an initial value from which the random number Nb _ai is generated.

An encryption device (300) according to one of claims 13 to 16, wherein the encrypting means (318) of the data S comprises:

means for adding the random key K _a i, o and diversified random keys K _ai , i to K _ai , _N to data matrices; means for substituting each word of a data matrix with another word of similar size;

means for cyclically transposing the words of a data matrix; - Matrix multiplication means between a data matrix and a constant matrix.

18. A method of decrypting an encrypted Z data message comprising at least a step of calculating (202) a random ^Nth diversified key K _ai, _N from a secret key K _seC ret and information produced from a random number Nb _ai and / or the secret key K _seC ret, a reverse diversification step

(204) constructed from the ^Nth diversified random key K _ai , _N calculating NI diversified random keys K _a i, _N _i to K _ai , i and a random key K _ai , o, and decrypting (206) the Z data from the N random diversified keys K _ai , i to K _ai , _N and the random key K _a i, ₀ , with N natural integer strictly greater than 1.

The decryption method of claim 18, wherein N is the number of rounds of the decryption method.

20. decryption method according to one of claims 18 or 19, wherein the reverse diversification step (204) calculating the NI diversified random keys K _a i, _N _i to K _ai , i and the random key K _a i , o comprises at least one non-linear operation.

21. A decryption method according to one of claims 18 to 20, wherein the information produced from a random number Nb _ai and / or the secret key K _seC ret comprises a difference Dif _Km between a m ^th key K _have diversified random, _m and m ^th diversified key K _dlv, _m, where m is natural number such that 1 <m <N.

22. The decryption method of claim 21, wherein the information produced from a random number Nb _ai and / or the secret key K _seC ret further comprises the number m.

23. decryption method according to one of claims 21 or 22, wherein the calculation (202) of the N ^th diversified random key K _ai , _N is obtained at least by the following steps: - calculation of at least a first diversified key K _dlv , i from the secret key K _seC ret;

calculation of m-1 diversified keys K _dlv , ₂ to Kdiv, m, each of the diversified m-1 keys Kd ₁ V ₁₁ , with i natural number such that 2 ≤ i ≤ m, being calculated from a previous diversified key K _dlv , ii;

- addition of the ^m-th diversified key K v _dl, m previously calculated and difference Dif between the ^m-th _Km diverse random key _K i, _m and m ^th diversified key K _dlv, _m; calculation of (N-m + 1) diversified random keys K _a i, _{m +} 1 to K _ai , _N , each of these diversified random keys K _ai , _D , with j natural integer such that m + 1 ≤ j ≤ N , being calculated from a previous diversified random key K _a i, _D _i.

24. decryption method according to one of claims 18 to 20, wherein the random number Nb _ai is of the pseudo-random type and the information produced from a random number Nb _ai and / or the secret key K _seC ret comprises an initial value from which the random number Nb _ai is generated.

25. A decryption method according to one of claims 18 to 24, wherein the inverse diversification (204) performs the calculation of NI diversified random keys K _a i, _N _i to K _ai , i and the random key K _ai , o each of these keys K _alılr with i natural number such that 0 ≤ i ≤ NI, being calculated from a previous diversified random key K _a i, ₁₊ i.

26. decryption method according to one of claims 18 to 25, wherein the decryption (206) encrypted data Z is performed at least by the following steps:

calculating N decoded data S of _C od, i to Sdecod, N, each of N decoded data S of _C od, i, with i such that 1 ≤ i ≤ N, being calculated from previous decoded data S _deC od, ii and the (N-i + 1) ^th diversified random key K _a i, _N _ ₁₊ i; the N ^th decoded data S _deC od, N being decrypted data S.

27. decryption method according to one of claims 18 to 26, the decryption (206) of data being achieved by: a) the following steps:

- adding (208) the N ^th diversified random key K _ai , _N to a matrix formed by the encrypted data Z, thus forming decoded data S _deC od, o;

cyclic transposition (210) of the words of a matrix formed by the data obtained after the preceding step of adding (208); substituting (212) each word of a matrix formed by the data obtained after the preceding cyclic transposition step (210) by another word of similar size, thereby forming first decoded data S _deC od, i; then b) NI executions of the following steps:

- adding (214) between a matrix formed by the (il) ^th decoded data S _deC od, ii and i ^th diverse random key K _{± alι,} with i such that 2 <i <N;

matrix multiplication (216) between a matrix formed by the data obtained after the preceding addition step (214) and a constant matrix; cyclic transposition (218) of the words of a matrix formed by the data obtained after the preceding multiplication step (216);

- replacing (220) of each word in a matrix formed by the data obtained after the previous step of cyclic transposition (218), the data obtained being the i ^th decoded data

Sdecod, i; And c) a step of adding (222) between a matrix formed by the N ^th decoded data od _deC S, N and the random key _K i, _0, the data obtained being decrypted data S.

28. decryption device (400) of an encrypted data message Z comprising at least computing means (416) to a ^Nth diverse random key K _ai, _N from a secret key K and _seC ret of information produced from a random number Nb _ai and / or the secret key K _seC ret, means (416) of inverse diversification from the N ^th diversified random key K _ai , _N calculating NI random keys diversified _K i, _N _i K _have, i and the random key _K i, _0, and decrypting means (418) data Z from diversified random keys N K _I i K _I, _N and of the random key K _a i, ₀ , with N natural integer strictly greater than 1.

29. decryption device (400) according to claim 28, wherein the means (416) of inverse diversification calculating the NI diversified random keys K _a i, _N _i K _{al, 1} and the random key K _ai , ₀ realize at less a non-linear operation.

30. Decryption device (400) according to one of claims 28 or 29, wherein, when the information produced from a random number Nb _ai and / or the secret key K _seC ret comprises a difference Dif _Km between a m ^th diversified random key K _{al, m} and a diversified m ^th key K _dlv , _m , _with m natural integer such that 1 ≤ m ≤ N, the calculation means (416) of the N ^th diversified random key K _ai , _N comprise at least:

means for calculating at least a first diversified key K _dlv , i from the secret key K _seC ret; means for calculating m-1 diversified keys K _dlv , ₂ to K _dlv , _m , each of the m-1 keys diversified K _d1 V ₁₁ , with i natural number such that

2 ≤ i ≤ m, being calculated from a previous diversified key Kdi _V , ii!

- means for adding the ^m-th diversified key K _dlv, _m previously calculated and difference Dif between the ^m-th _Km diverse random key _K i, _m and m ^th diversified key K _dlv, _m;

means for calculating (N-m + 1) diversified random keys K _a i, _{m +} i at K _ai , _N , each of these diversified random keys K _ai , _D , with j natural integer such that m + 1 ≤ j ≤ N, being calculated from a previous diversified random key K _a i, _D _i.

31. decryption device (400) according to one of claims 28 to 30, the means (416) of inverse diversification calculating NI diversified random keys K _a i, _N _i to K _ai , i and the random key K _a i, ₀ , each of these keys K _alιl _, with i natural number such that 0 ≤ i ≤ NI, being calculated from a previous diversified random key K _a i, ₁₊ i.

32. decryption device (400) according to one of claims 28 to 31, the decryption means (418) data comprising at least: - decoded data calculation means

S _decod , o from the N ^th diversified random key K _ai , _N and encrypted data Z;

means for calculating N decoded data S _deC od, i to S _deC od, N, each of the N decoded data S _deC od, i / with i such that 1 ≤ i ≤ N, being calculated at from previous decoded data S _deC od, ii and the (N-i + 1) ^th diversified random key K _a i, _N _ _{1 + 1} ; the N ^th decoded data S _deC od, N being decrypted data S.

33. decryption device (400) according to one of claims 28 to 32, the decryption means (418) of data comprising:

means for cyclically transposing the words of a data matrix;

- Matrix multiplication means between a data matrix and a constant matrix.

34. A signal processing device for implementing a method for encrypting a data message according to one of claims 1 to 9 and / or a method for decrypting an encrypted data message according to one of the Claims 18 to 27.

35. Smart card comprising at least one device (300) for encrypting a data message according to one of claims 10 to 17 and / or a device (400) for decrypting an encrypted data message according to the one of claims 28 to 33.

36. Data carrier, readable by a computer system, comprising data in coded form, for implementing a method of encrypting a data message according to one of claims 1 to 9 and / or a method of decryption of an encrypted data message according to one of claims 18 to 27.

37. Software product comprising a data medium that can be read by a computer system, enabling the implementation of a method for encrypting a data message according to one of claims 1 to 9 and / or a method decryption of an encrypted data message according to one of claims 18 to 27.