WO2010070336A2

WO2010070336A2 - Cryptography

Info

Publication number: WO2010070336A2
Application number: PCT/GB2009/051717
Authority: WO
Inventors: Leslie Hatton
Original assignee: Leslie Hatton
Priority date: 2008-12-16
Filing date: 2009-12-15
Publication date: 2010-06-24
Also published as: GB201112117D0; GB2478685A; GB0822870D0; WO2010070336A3

Abstract

A method of encrypting or decrypting a message comprising carrying out a discrete convolution given by Formula (I), where m is the message to be encrypted or decrypted comprising an array of L_m elements, h is a key or an inverse of a key comprising an array of L_h elements and e is the resulting encrypted or decrypted message comprising an array of L_e elements.

Description

CRYPTOGRAPHY

This invention relates to a method and apparatus for encrypting and/or decrypting a message such that the message can be exchanged between a sender and a receiver without being acquired by an eavesdropper.

Background

Conventionally, messages are exchanged secretly using Public Key Cryptography, where an encoded message is encrypted by a sender using a public key and decrypted by a receiver using their private key. The method relies on a mathematical relation of the public key to the private key, with the degree of security depending on the difficulty in obtaining the private key from the public key. Current techniques use mathematical relations containing large prime numbers where the level of security is connected to the presumed difficulty of factorizing large integers, a problem for which there is no known efficient general technique.

However, a problem with Public Key Cryptography is that, in theory, it is possible to derive the private key from the public key with the creation of either an algorithm with a sufficiently high efficiency or a computer processor with a sufficiently high processing power. The method is therefore always under threat from advances in these fields. Efforts have been made to increase the difficulty in solving the mathematical relation by increasing the numerical size of the public and private keys. However, larger key sizes require more computer processing power, leading to a reduction in the encryption/decryption processing rates.

Summary

According to a first aspect of the invention there is provided a method of transmitting a message comprising a sender encrypting the message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, the receiver encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, the sender decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message and sending the third encrypted message to the receiver and the receiver decrypting the third encrypted message using an inverse of the second private key.

According to a second aspect of the invention there is provided a method of transmitting a true message comprising a sender encrypting a false message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, the receiver encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, the sender encrypting the true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, to result in a third encrypted message and sending the third encrypted message to the receiver, the receiver decrypting the third encrypted message using an inverse of the second private key.

An advantage of both aspects of the above invention is that neither method requires the use of a public key (the first private key of the sender and the second private key of the receiver are kept private) and the private keys can be changed for the transmission of different messages without requiring an agreement protocol. This may increase the security of transmitting and receiving the message.

A further advantage of the second aspect of the invention is that the true message is only transferred once between the sender and receiver, instead of twice in the case of the first aspect of the invention, thus decreasing the risk of the true message being obtained by an eavesdropper.

According to a third aspect of the invention there is provided a method for sending a message comprising encrypting the message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, receiving a second encrypted message from the receiver, the second encrypted message resulting from an encryption of the first encrypted message with a second private key, decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message and sending the third encrypted message to the receiver. According to a fourth aspect there is provided a method for sending a message comprising encrypting a false message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, receiving a second encrypted message from the receiver, the second encrypted message resulting from an encryption of the first encrypted message with a second private key, encrypting a true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, to result in a third encrypted message and sending the third encrypted message to the receiver.

According to a fifth aspect of the invention there is provided a method for receiving a message comprising receiving a first encrypted message from a sender, the first encrypted message resulting from an encryption using a first private key, encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, receiving a third encrypted message from a sender, the third encrypted message resulting from a decryption of the second encrypted message using an inverse of the first private key or an encryption of a true message using a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, and decrypting the third encrypted message using an inverse of the second private key.

According to a sixth aspect of the invention there is provided a transmitter device for transmitting a message comprising an input for receiving a message, a processor arranged to encrypt the message using a first private key to result in a first encrypted message, a transceiver for transmitting the first encrypted message to a receiver device and receiving a second encrypted message from the receiver device, the second encrypted message being a result of an encryption of the first encrypted message using a second private key, the processor further arranged to decrypt the second encrypted message using an inverse of the first private key to result in a third encrypted message and cause the transceiver to transmit the third encrypted message to the receiver device.

It will be understood that the use of the term "transceiver" in relation to the invention is a device comprising a transmitter and receiver that is not limited to transmitter and receiver devices that share the same circuitry.

According to a seventh aspect of the invention there is provided a transmitter device for transmitting a message comprising an input for receiving a true message, a processor arranged to encrypt a false message using a first private key to result in a first encrypted message, a transceiver for transmitting the first encrypted message to a receiver device and receiving a second encrypted message from the receiver device, the second encrypted message being a result of an encryption of the first encrypted message using a second private key, where the processor is further arranged to encrypt the true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, to result in a third encrypted message and cause the transceiver to transmit the third encrypted message to the receiver device. According to an eighth aspect of the invention there is a receiver device for receiving a message comprising a transceiver for receiving a first encrypted message from a transmitter device, the first encryption being a result of encrypting a message using a first private key, a processor arranged to encrypt the first encrypted message using a second private key to result in a second encrypted message and cause the transceiver to transmit the second encrypted message to the transmitter device and receive a third encrypted message from the transmitter device, the third encrypted message being a result of a decryption of the second encrypted message using an inverse of the first private key or an encryption of a true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, the processor further arranged to decrypt the third encrypted message using an inverse of the second private key.

According to a ninth aspect of the invention there is a communication system comprising a transmitter device according to the sixth or seventh aspects of the invention arranged to communicate across a network path with a receiver device according to the eighth aspect of the invention.

According to a tenth aspect of the invention there is provided a data carrier having stored thereon instructions which when executed by processors of a communication system causes the communication system to carry out the method of either the first or the second aspects of the invention. According to an eleventh aspect of the invention there is provided a data carrier having stored thereon instructions which when executed by a processor of a communication device causes the communication device to carry out the method of any one of the third to the fifth aspects of the invention.

In one embodiment the steps of encrypting and decrypting is commutative, in that each of the encrypted messages is independent of the order in which the steps of encrypting and/or decrypting, that result in that encrypted message, is carried out.

A private key,/, and an inverse of the private key, g, may be chosen such that/*g ~ /, where / is an identity operator such that w*I = w, wherein * is an operator used in the steps of encrypting and decrypting and w is a message.

It will be understood that the use of the term "~" may mean the approximation f*g ~ / is defined such that the original message is recovered after the encrypting and decrypting steps have been carried out. For example, the message may comprise different numerical values representing different text characters and the accuracy of f*g ~ / may be such that the numerical elements of a final decrypted message are close enough to the numerical values of the original message that the original message can be recovered. The step of encrypting or decrypting a message may comprise a discrete convolution, wherein the process of encrypting or decrypting the message is given by,

L - \ ,

where m is an array of L_n, elements to be encrypted or decrypted, h is one of the private keys or one of the inverses of one of the private keys comprising an array of Lh elements, and e is the resulting encrypted or decrypted message comprising an array of L_e elements.

An advantage of using the discrete convolution to encrypt and decrypt a message is that it is very sensitive to errors in the private key, as during the decryption stage this error is spread over many adjacent elements. The method is thus very secure against attempts by an eavesdropper to decrypt and understand the message fully as the eavesdropper would have to obtain the private key very precisely.

In one embodiment, the method for determining an inverse, g, of a private key, f, may be approximated, wherein a Wiener-Hopf equation as follows is solved for g,

∑ g_t ∑ f_k- _tf_k-_j= ∑ d_kf_k t=0 k=0 k=0 for j = 0, 1..., Lg - 1, wherein L_g is a number of elements of g and the desired output d is chosen to be equal to an isolated unit value such that g*f ~ I.

Accordingly, the method for determining an inverse, g, of a private key,/, may be approximated by solving Wiener-Hopf equation using an algorithm due to Norman Levinson quoted in the Appendix of "N. Wiener. The Extrapolation, Interpolation and Smoothing of Stationary Time Series, MIT Press, 1942".

An advantage of using the algorithm due to Norman Levinson is that this is a very fast way of solving the Wiener-Hopf equation.

In one embodiment the method steps according to the first to the fifth aspects of the invention comprises determining the first and/or the second private key(s). In a further embodiment, the first and/or the second private key(s) are predetermined, for example retrieved from memory.

The number of elements of the private key Lf and the number of elements of an inverse of a private key L_g are suitably large such that a message can be recovered after the encrypting and decrypting steps have been carried out.

The number of elements of a private key Lf is suitably large such that an encryption of a message has a desired level of protection. In one embodiment, the method comprises identifying the desired level of protection and determining the number of elements of a private key Lf based on the identified desired level of protection. The desired level of protection may be the probability of an encrypted message being decrypted by a brute force attack, i.e. an eavesdropper guessing the private key by systematically trying a large number of number sequences as possible private keys. The number of elements of the private key is one of the factors that determine the probability of an encrypted message being decrypted by a brute force attack. For example, the probability P may be equal to 1 in 10²ⁱ^, and therefore for an identified desired level of protection, the number of elements of the private key may be calculated using Lf = -Vi log (P).

The step of encrypting a message comprising a discrete convolution in one embodiment may comprise determining the Fourier transform of the message, determining the Fourier transform of a private key, determining a product of the Fourier transform of the message and the Fourier transform of the private key and determining the inverse Fourier transform of the product.

The step of decrypting a message comprising a discrete convolution in one embodiment may comprise determining the Fourier transform of the message, determining the Fourier transform of an inverse of a private key, determining a product of the Fourier transform of the message and the Fourier transform of an inverse of the private key and determining the inverse Fourier transform of the product. In one embodiment the Fourier transforms can take the form of Fast Fourier

Transforms (FFTs).

An advantage of the invention is for a particularly long message the Fourier Transform in the form of the FFT is particularly efficient requiring n log n operations for n numbers.

The message may be encoded from text to numerical form using standard schemes, in one embodiment the message may be encoded using ASCII.

Such a method is vulnerable to attack if the message remains unchanged throughout the steps of encryption and decryption as an eavesdropper listening on the initial exchange of the first encrypted message and second encrypted message would in principal be able to recover the private key of the receiver (the second private key). With this knowledge, if the eavesdropper was able to listen in on the transfer of the third encrypted message, the eavesdropper could recover the original message by decrypting the third encrypted message with the private key of the receiver without the sender or receiver realising.

Accordingly, encrypting the first encrypted message may comprise adding a (first) additional message element, such as randomly generated text, to the first encrypted message and encrypting the first encrypted message together with the (first) additional message element using a second private key to result in a second encrypted message. In a preferred embodiment, the additional message element is added to the end of the first encrypted message.

Furthermore, decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message may comprise adding a (second) additional message element, such as randomly generated text, to the second encrypted message and decrypting the second encrypted message together with the

(second) additional message element with the inverse of the first private key. In a preferred embodiment, the additional message element is added to the end of the second encrypted message.

This defeats the eavesdropper because the presence of the additional message elements deprives the eavesdropper access to the necessary information to recover the first and/or second private keys.

If encryption and decryption of the message involves the addition of additional message elements, decryption of the third encrypted message using an inverse of the second private key will result in the original message plus the encoded additional message elements. The original message can be extracted based on a known location of the encoded additional message elements, for example if it is known that the encoded additional message elements will appear at the end of the message decoded by the receiver. Leakage of the encoded additional message elements into the message can be avoided by selecting the first and second private keys to be minimum phase. If first and second private keys are used that are not minimum phase then the lengths of each additional message element needs to be matched to any anticipation components in the first/second private key. An anticipation component is that part of the key that appears before time zero.

According to a twelfth aspect of the invention there is a method of encrypting or decrypting a message comprising carrying out a discrete convolution given by

e = ∑ h_km _k ,

Ar=O where m is the message to be encrypted comprising an array of L_n, elements, A is a key or an inverse of a key comprising of an array of Lh elements and e is the resulting encrypted message comprising an array of L_e elements.

Such a method of encryption and decryption can be used with the method described above as part of a Public Key Cryptography scheme. For example, the method may comprise encrypting a message, w, by convo luting the message, w, with a private key,f_s, (to obtain w*f_s), encrypting the private key with a public key of the receiver and sending the encrypted private key and the encrypted method to the receiver. The receiver can then decrypt the encrypted private key using the private key and decrypt the message, w, using the decrypted private key. Such methods are valuable because full public key encryption of large messages is resource intensive and conforms with encryption schemes, such as Zimmerman's PGP.

If an eavesdropper obtains w*f_s when it is sent to the receiver, the results of the convolution is non-unique increasing the difficulty on breaking the encryption by a brute force attack when compared to schemes with a unique inverse and message.

More specifically, the nature of the encryption means that there exists a false key/ such that v*f_v = w*f_s. In other words, if in a brute force search for a key to break the encryption, the eavesdropper comes across f_v and decrypts the encrypted message using f_v ^~' , they would get v, which is entirely reasonable but wrong. A reason that such non-uniqueness arises is because when the message is encoded, for example form ASCII, to floating point, it increases in size by typically a factor of eight. However, this manifests itself as redundancy and then non-uniqueness.

There are potentially a very large number of spurious answers/ making guessing of the actual private key very difficult.

According to a thirteenth aspect of the invention there is a method for encrypting a message comprising determining the Fourier transform of the message, determining the Fourier transform of a key, determining a product of the Fourier transform of the message and the Fourier transform of the key and determining the inverse Fourier transform of the product.

According to a fourteenth aspect of the invention there is a method for determining an inverse, g, of a key,/, where/is used for encrypting a message and g is used for decrypting a message, wherein the following Wiener-Hopf equation is solved for g,

for j = 0, 1..., Lg - 1, wherein L_g is a number of elements of g and the desired output d is chosen to be equal to an isolated unit value / = {1,0,0, ...,Oj, such that

Description

Embodiments for the invention will now be described, by example only with reference to the accompanying drawing, in which:-

Figure 1 shows a schematic view of a communication system used to send and receive messages according to an embodiment of the invention;

Figure 2 shows a flow chart of the steps of transmitting a message secretly between a sender and a receiver in accordance with a first embodiment of the invention;

Figure 3 shows a flow chart of the steps of transmitting a message secretly between a sender and a receiver in accordance with a second embodiment of the invention;

Figure 4 gives an example of a suitable choice for a first private key containing 118 elements, constructed using the Hubert transform; Figure 5 gives an example of a suitable choice for a first private key containing 64 elements, constructed using the Hubert transform;

Figure 6 shows the results of a sensitivity test of the invention; and

Figure 7 shows a flow chart of the steps of transmitting a message secretly between a sender and a receiver in accordance with a third embodiment of the invention.

Referring to figure 1, a communication system used to send and receive a message secretly according to an embodiment of the invention comprises a transmitter device 1, a network path 2 and a receiver device 3. The transmitter device 1 and the receiver device 3 operate in two-way communication (as indicated by the arrows) across the network path 2.

The transmitter device 1 comprises an input 4, a processor 5, a transceiver 6 and a data carrier 10. The input 4 is arranged to receive a message, for example, the input 4 may be a keyboard of a computer. The transmitter device 1 may further comprise a display device 11 for viewing the message.

The receiver device 3 comprises a transceiver 7, a processor 8 and a data carrier 10. The receiver device 3 may further comprise a display/input device 9 for displaying and/or modifying a message, for example the display/input device 9 may comprise a computer monitor and keyboard. For example, the processors 5 and 8 may be the processors of a computer and the transceivers 6 and 7 may be modems of a computer, where the network path 2 is the Internet. The data carrier 10, which in this case is memory, stores amongst other things a computer program which when executed by the processors 5 or 8 to cause the communication system to operate in accordance with the invention, which will now be described with reference to Figure 2.

A transmitter device 1 receives a message w via the input device 4 in step 101. For example the message may be text represented in numerical form using standard schemes, such as ASCII.

On receiving the message, w, the transmitter device 1 selects a suitable first private key/j, for example /j may comprise a string of numbers between -10 and 10 with a non-zero DC component.

It will be understood that the term "DC component" of a key means the DC frequency component after the Fourier transform of the key. For the reasons explained below, the key, f, when Fourier transformed should have a non-zero DC component at all frequencies. In practice, this is trivial to achieve if filters are designed in the frequency domain.

The message is encrypted in step 102 by the processor 5 using the first private key s to result in a first encrypted message given by w*f$. The encryption and decryption operator * comprises a discrete convolution, given by

L₁,- I

where m is an array of L_n, elements, h is one of the private keys or one of the inverses of one of the private keys comprising an array of Lh elements, and e is the resulting encrypted or decrypted message comprising an array of L_e elements.

The encryption and decryption processes are carried out by taking FFTs. For the first encrypted message, the FFTs of w and/j (designated W and F) are multiplied and the inverse Fourier transform is then calculated to give the discrete convolution

In step 103, the transmitter device 1 using the transceiver 6 sends the first encrypted message across the network path 2 to the receiver device 3.

The receiver device 3 receives the first encrypted message through transceiver 7 and the processor 8 encrypts the first encrypted message in step 104 using a second private key /_R in accordance with equation 1 to result in a second encrypted message given by w*fs*fκ. In step 105, the receiver device 3 sends the second encrypted message using the transceiver 7 across the network path 2 to the transmitter device 1.

In step 106, the transmitter device 1 receives the second encrypted message through transceiver 6 and decrypts part of the second encrypted message with an inverse of the first private key using equation 1 to produce a third encrypted message. Again, this may be carried out using Fourier transforms of the second encrypted message and the inverse (the Fourier transform of the inverse denoted G).

The processor 5 calculates an inverse gs of the first private key/j, such that fs*gs ~ I, where / is an identity operator such that w*I = w. This may be done beforehand or on receiving the message.

An inverse g of a private key / may be approximated by solving the following Wiener-Hopf equation for g,

for / = 0, 1..., L_s - 1, wherein L_s is a number of elements in g and the desired output d is chosen to be equal to an isolated unit value such that g*f ~ I. For efficiency, this is done using an algorithm due to Norman Levinson quoted in the Appendix of "N. Wiener. The Extrapolation, Interpolation and Smoothing of

Stationary Time Series, MIT Press, 1942".

The unit value / contains Lj+ L_g-1 samples altogether, with the single unit value preceded by Lϊ≥O zeros. L_L is known as the lag or delay and is related to the phase spectrum of the key,/, if it is to be treated as a time series. This is an important factor in the performance of the inverse of the key, as will be discussed below.

The processor 5 decrypts the second encrypted message in step 106 using gs to result in a third encrypted message given by w*/s% *gs.

As the discrete convolution function * is commutative, the third encrypted message is independent of the order in which the steps of encrypting and/or decrypting is carried out. Therefore the third encrypted message is equivalent to the message w encrypted with the second private key, i.e. w*fs*fκ*gs = w*fs*gs*fκ ~ W*I*/R = w%.

The transmitter device 1 sends the third encrypted message using the transceiver 6, in step 107, to the receiver 3 via the network path 2.

In step 108, the receiver device 3 receives the third encrypted message through the transceiver 7. The processor 8 calculates an inverse gR of the second private key/? using the equation 2 such that fκ*gκ ~ I, which may be done beforehand or on receiving the third encrypted message. The processor 8 decrypts the third encrypted message using g_R to result in w*f_s*fκ*gs*gR ≡ w*f_s*gs*fκ*gR ~ w*I*I = w, thus recovering the original message w.

The invention may comprise a further step 109, where the processor 8 decodes the message from numerical to text form using standard schemes, such as ASCII. For an encoding step such as ASCII which produces integers in the range between 30 and 100, the accuracy of the reconstruction by the receiver must be such that, if n_e is the number representing the text before encryption and rid is the decrypted number, then: ne^{~ n}d ° - ⁵

After transmission of the message and decryption a user may read the message and/or makes alterations to the message using the display/input device 9 for displaying and/or modifying a message. The receiver device 3 may be further arranged to forward the message secretly to another receiver by carrying out the steps in figure 2.

A second embodiment of the invention will now be described with reference to figure 3.

In a second embodiment of the invention the transmitter device 1 receives a true message w_t (i.e. a message to be communicated to the receiver device 3) via the input 4 in step 201. The transmitter device 1 chooses a suitable first private key/j and encrypts a false message w/ (i.e. a message to be transmitted but not communicated to the receiver 3) in step 202 using the processor 5 with a first private key /j to result in a first encrypted message, given by w/*fs. The false message may be a predetermined false message stored on the data carrier 10 or may be an original false message received from the input 4.

Steps 203 to 205 are the same as the corresponding steps 103 to 105 in the first embodiment of the invention and will not be described again in detail.

The transmitter device 1 calculates an inverse (w/fs)^'1 of the first encrypted message using processor 5, such that w/fs* (w/fs)^'1 ~ I, where / is an identity operator such that w*I = w. This may be done beforehand or after receiving the second encrypted message. The transmitter device 1 then determines a third private key (w/fs)^'1 * w/fs*fκ , comprising of an inverse of the first encrypted message oϊ(w/fs)^'! and the second encrypted message w/fs*fκ.

In step 206 the transmitter device 1 encrypts the true message w_t with the third private key using the processor 5 to result in a third encrypted message, given by Wt*(w/fs)^'J '*w/fs*f_R ≡ w_t* w/fs* (w/fs)^'1 *f_R ~ w_t*I* f_R = w_t*fR, where the third encrypted message is equivalent to the true message encrypted with the second private key.

Step 207 is the same as step 107 in figure 2. In step 208, the receiver device 3 receives the third encrypted message through the transceiver 7. The processor 8 calculates an inverse gR of the second private key /_R, such that f_R*g_R ~ I. The processor 8 decrypts the third encrypted message using gR to result in w_t*(wf*f_s)^~' *w_f*f_s*f_R *g_R ≡ w_t* Wf*fs*(wf*fs)^~' %*gκ ~ w_t*I*I = w_t, thus recovering the true message w_t.

Step 209 is the same as step 109 in figure 2.

The determination of a private key may comprise a random aspect, where the private key is chosen randomly (or at least pseudo randomly) within the constraints of suitable choices for private keys. The choice of constraints for a suitable private key will now be described.

The performance in terms of reliable reproduction of an original message after undergoing the encryption/decryption depends on the accuracy of/*g ~ /, which depends how accurately an inverse g of a private key / can be calculated. The accuracy of the inversion of a private key/ depends on the ratio of the number of elements L_g of g and the number of elements Lf of / i.e. L_g/Lf. In practice, to make the computation of g accurate enough to recover a message, L_g is typically a factor often larger than Lf.

The inversion of a private key /may also depend on the phase of/ and the phase may affect the way in which the inversion is calculated. It will be understood that the term "phase" of a key means the phase spectrum of the Fourier transform of the key. Private key inversions are simpler to calculate if the private key is minimum phase. A minimum phase key appears front-loaded in the sense that its "energy" appears early in the key (in short, the key looks big at the start and small at the end). A maximum phase key is the minimum phase key time-reversed, so it is small at the start and big at the end.. Mixed phase keys in very trivial terms are small at each end and bigger in the middle.

For a given length key, the performance of the key varies depending on the phase of the key. A minimum phase key is best inverted with the desired output at zero delay (that is the unit value of/ is at the start). A mixed phase key is best inverted with some non-zero delay. If the phase is resolved correctly, the accuracy then depends on the length of the key. Accordingly, a suitable length L_g should be chosen long enough so that inversion errors are sufficiently small so that all of the original text in the message can be recovered.

In further regard to a suitable choice for an invertible private key, when encrypting and decrypting a message where the message has been encoded into a number sequence containing a range of decimal numbers, for example, for ASCII, decimal numbers between 32 and 100, the message will have a non-zero mean, which is equivalent to a DC (zero frequency) component in the Fourier transform of the message. If the Fourier transform of the private key, F, has a zero DC component then the product F*W will also have a zero component whatever the DC component of W, making any non-zero DC component of W unrecoverable. For this reason, F should not have a zero DC component at any frequency. In order for a successful recovery of a message the DC component of the product of the private key and an inverse of the private key should be equal to the DC component of the message. Therefore, the DC component of the private key has to be non-zero.

An example of the performance of the invention is shown in figures 4 to 6. Figures 4 and 5 shows two examples of minimum phase private keys where the private keys have been constructed using the Hubert Transformation. The number of elements Lf of the private keys is shown on the horizontal axis in figures 4 and 5, where the private keys contains Lf = 118 elements and Lf = 64 elements in figures 4 and 5 respectively. The corresponding values of each element of the private keys are shown on the vertical axis. The values shown on the vertical axis of figures 4 and 5, have been specified to six significant figures in the following calculation. The DC component of figure 4 is 0.062 and that of figure 5 is 0.018, both accurate to three decimal places. An inverse private key nine times the original private key length was constructed in each case by solving equation (2) using an algorithm due to Norman Levinson quoted in the Appendix of "N. Wiener. The Extrapolation, Interpolation and Smoothing of Stationary Time Series, MIT Press, 1942".. Double precision arithmetic is used throughout the calculation.

The accuracy A of Wiener inverse private keys is computed as

where d is the desired output d={l, 0,0,0, ...} where the 1 might be delayed a few positions if the private key/ is not minimum phase, and d'=f*g is the actual output resulting from applying the inverse of the private key g to the private key/ Note that an accuracy of A=LO corresponds to perfection, where there is no difference between the actual output d' and the desired output d. For the private keys above the accuracy was typically A=O.99998 and this led to errors in the inversion of at most around 0.1%, which is well below the level necessary to give the wrong character on decoding.

The time it takes to carry out the method of the invention depends on, amongst other things, Lf, L_g and the number of elements in the message L_m..

To test the time it takes an algorithm to carry out the method of the invention, three standard texts were used and processed using the method described in reference to figure 2 programmed in C. For each of these the time to encode, encrypt, decrypt and decode was measured on a single processor AMD XP2800+ machine, (Linux Bogomips rating 4170.08). The texts were treated in one block using FFT and the private key shown in figure 4. The results are shown in Table 1.

Table 1 : Timings to encrypt and decrypt various texts with the private key of figure 4.

The sensitivity of the invention relates to the level of imprecision in guessing one of the significant figures in one element of the encrypting private key that causes the decryption to fail. An advantage of the discrete convolution given in equation (1) is that an error is spread over many adjacent elements and the algorithm is very sensitive as a result. The sensitivity will depend on, amongst other things, the number of elements L/ of the private key.

Figure 6 shows the input message w on the left and the decrypted version on the right, where the message was encrypted using the private key given in figure 4 and decrypted using an inverse of a slightly altered version of the private key, where a change of just one unit in the second significant place of one of the 118 elements has been made to the private key of figure 4. As can be seen in figure 6, after the first few characters, the error rapidly spreads and complete nonsense results for the remaining characters. In practice, some gibberish text at the beginning would render the whole of the original plain text indecipherable. It is worth noting that the imprecision of the decrypted message shown in figure 6 only relates to the inversion of the private key. It is independent of the length of the encrypted message in the first embodiment of the invention.

Figure 6 shows how the level of sensitivity of the decryption depends on the number of elements in the private key. For a private key of 118 elements, the probability of guessing 2x118 significant figures in the right order is 1 in 10²³⁶. Therefore the probability of obtaining the message by guessing the private key is very low, even when the private key length is known. Other factors such as getting the signs right give another multiplication factor of around 2¹¹⁸. The total is comparable to approximately 1 in 10²⁸⁰. When the uncertainty of the private key length and its phase are included the algorithm looks very secure to brute force attacks.

The above considerations in regards to performance, time taken and sensitivity can be equally applied to the second embodiment of the invention.

The methods of encryption using convolutional filters for the private keys described with reference to Figures 2 and 3 are vulnerable to an eavesdropper. These filters of course commute as is required by these methods, but an eavesdropper listening on the initial exchange of the first encrypted message and the exchange of the second encrypted message would in principal be able to recover the second private key ^ by applying the discrete Wiener-Hopf method of equation 2 with an input m*fs*fn and a desired output m*fs where the solution will be fa^'1. If the eavesdropper is able to listen to the final exchange of the third encrypted message the eavesdropper could then extract the message without the sender or receiver realising.

The embodiment of the invention described with reference to figures 7 solves this problem.

As with the first embodiment of the invention the sender encrypts the message with a minimum phase first private key /j 302 and sends the resultant first encrypted message to the receiver 303. However, in step 304, the receiver adds additional message element, r, in this embodiment, a randomly generated text string, to an end of the first encrypted message w*fa and encrypts the first encrypted message and its augmentation with a minimum phase second private key fa to get the second encrypted message (w*fs+r) *fa. The receiver then returns this second encrypted message to the sender 305.

In step 306, the sender adds additional message element, s, in this embodiment, a randomly generated text string, to an end of the second encrypted message and applies the inverse of the first public key fs^'1 to the second encrypted message and its augmentation to obtain a third encrypted message, ((w*fa+r) * fa+s)* fs^{'1 '}, which since * is commutative can be written w* fs* fs^'1 * fa+r* fs^'1 * fa+s* fs^'1 ~w* fa+r* fs^~ ¹ * fa+s* fa^{'1 '}■ The third encrypted message is then sent to the receiver 307. The receiver now applies the inverse of the second public key /_R ¹ to the third encrypted message to get w*f_R*f_R ¹+r*f_s ¹*f_R*f_R ¹+s*f_s ¹*f_R ¹~ w+r ^♦//'+**// ^!* fn^'1. This will reveal the original encoded message w because r and s were chosen to start at the end of their respective messages. However, since the private keys (filters) fsf_R are minimum phase, so are their inverses fs^'1 /a^'1, so that there is no forward leakage into the message from either augmented text, r and s. In other words, r* fs ¹ starts where r used to and s* fs ¹* /_R ^'1 starts where s used to. Message, w, appears at the beginning of the whole message and can be trivially extracted and coded back into text as described above.

This defeats the eavesdropper because the presence of the unknown augmenting texts r and s deprives access to the complete transient convolutions (i.e the full range of t in equation 2, necessary to discover either the filters /j or ^ sufficiently accurately. (Unlike the first and second embodiments which have three unknowns and three eavesdrop points, the third embodiment of the invention has three eavesdrop points but five unknowns).

Furthermore, the sender has no knowledge of the private key, ^, or the additional text element, r, and the receiver has no knowledge of the private key, fs, or the additional text element, s. Accordingly, even though the system is an asymmetric system, the system still does not require any public knowledge of any key; keys/j and /_R are generated uniquely and privately by each of the sender and receiver as appropriate and do not need to be revealed to anybody. It will be understood that other embodiments of the invention may achieve all, some or none of the advantages described. Furthermore, it will be understood that the invention is not limited to the described embodiments but the invention includes modification and alterations that fall within the scope of the invention described herein

It will be understood that the processor or processors of the communication system and transmitter and receiver devices as recited in the claims may be arranged to carry out any or all of the steps recited in the method claims.

Claims

1. A method of encrypting or decrypting a message comprising carrying out a discrete convolution given by k

where m is the message to be encrypted or decrypted comprising an array of L_n, elements, A is a key or an inverse of a key comprising an array of Ly₁ elements and e is the resulting encrypted or decrypted message comprising an array of L_e elements.

2. A method of claim 1, wherein the discrete convolution is carried out by determining a Fourier transform of m, determining the Fourier transform of h, determining a product of the Fourier transform of m and h and determining an inverse Fourier transform of the product.

3. A method of claim 1 or claim 2 wherein the Fourier transforms take the form of fast Fourier Transforms (FFTs).

4. A transmitter device for transmitting a message comprising an input for receiving a message, a processor arranged to encrypt the message using the method of any one of claims 1 to 3 and a transceiver for transmitting the encrypted message to a receiver device.

5. A receiver device for receiving a message comprising an input for receiving an encrypted message and a processor arranged to decrypt the message using the method of any one of the claims 1 to 3.

6. A communication system comprising a transmitter device according to claim 4 and a receiver device according to claim 5 arranged to communicate across a network path.

7. A data carrier having stored thereon instructions which when executed by a processor of a communication device causes the communication device to carry out the method of any one of claims 1 to 3.

8. A method of transmitting a message comprising a sender encrypting the message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, the receiver encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, the sender decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message and sending the third encrypted message to the receiver and the receiver decrypting the third encrypted message using an inverse of the second private key.

9. A method of transmitting a true message comprising a sender encrypting a false message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, the receiver encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, the sender encrypting the true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, to result in a third encrypted message and sending the third encrypted message to the receiver, the receiver decrypting the third encrypted message using an inverse of the second private key.

10. A method for sending a message comprising encrypting the message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, receiving a second encrypted message from the receiver, the second encrypted message resulting from an encryption of the first encrypted message with a second private key, decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message and sending the third encrypted message to the receiver.

11. A method for sending a message comprising encrypting a false message using a first private key to result in a first encrypted message and sending the first encrypted message to a receiver, receiving a second encrypted message from the receiver, the second encrypted message resulting from an encryption of the first encrypted message with a second private key, encrypting a true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, to result in a third encrypted message and sending the third encrypted message to the receiver.

12. A method for receiving a message comprising receiving a first encrypted message from a sender, the first encrypted message resulting from an encryption using a first private key, encrypting the first encrypted message using a second private key to result in a second encrypted message and sending the second encrypted message to the sender, receiving a third encrypted message from a sender, the third encrypted message resulting from a decryption using an inverse of the first private key or an encryption of a true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, and decrypting the third encrypted message using an inverse of the second private key.

13. A method according to claim 8 or claim 12, wherein encrypting the first encrypted message comprises adding a (first) additional message element to the first encrypted message and encrypting the first encrypted message together with the (first) additional message element using the second private key to result in the second encrypted message.

14. A method according to any one of claims 8, 10 and 13, wherein decrypting the second encrypted message using an inverse of the first private key to result in a third encrypted message comprises adding a (second) additional message element to the second encrypted message and decrypting the second encrypted message together with the (second) additional message element with the inverse of the first private key.

15. A method according to claim 13 or claim 14, wherein the first private key and the second private key are minimum phase.

16. A method according to claims 8 to 12 wherein each of the steps of encrypting and decrypting is commutative, in that each of the encrypted messages is independent of the order in which each of the steps of encrypting and/or decrypting that result in that encrypted message are carried out.

17. A method according to claims 8 to 16 wherein a private key,/, and an inverse of the private key, g, is chosen such that/*g ~ /, where / is an identity operator such that m*I = m, wherein * is an operator used in the steps of encrypting and decrypting and w is a message.

18. A method according to claims 8 to 17 wherein each step of encrypting or decrypting comprises a discrete convolution, wherein the process of encrypting or decrypting is given by,

L₁,- I

,= Σ k * h ^mj- k =0 where m is an array of L_m elements to be encrypted or decrypted, h is one of the private keys or one of the inverses of one of the private keys comprising an array of Lh elements, and e is the resulting encrypted or decrypted message comprising an array of L_e elements.

19. A method according to claims 8 to 18 wherein the step of encrypting a message comprises determining a Fourier transform of the message, determining a Fourier transform of the private key, determining a product of the Fourier transform of the message and the Fourier transform of the private key and determining the inverse Fourier transform of the product.

20. A method according to claims 8 to 19 wherein the step of decrypting a message comprise determining a Fourier transform of the message, determining a Fourier transform of an inverse of the private key, determining a product of the

Fourier transform of the message and the Fourier transform of the inverse of the private key and determining the inverse Fourier transform of the product.

21. A method according to claim 19 or 20 wherein the Fourier transforms take the form of Fast Fourier Transforms (FFTs).

22. A method according to claims 18 to 21 wherein determining an inverse, g, of a private key,/, comprises solving a Wiener-Hopf equation as follows for g,

for j = 0, 1..., Lg - 1, wherein L_g is the number of elements in g and the desired output d is chosen to be equal to an isolated unit value such that g*f ~ /.

23. A method according to claim 22 wherein g is approximated by solving the Wiener-Hopf equation using an algorithm due to Norman Levinson quoted in the Appendix of "N. Wiener. The Extrapolation, Interpolation and Smoothing of Stationary Time Series, MIT Press, 1942".

24. A transmitter device for transmitting a message comprising an input for receiving a message, a processor arranged to encrypt the message using a first private key to result in a first encrypted message, a transceiver for transmitting the first encrypted message to a receiver device and receiving a second encrypted message from the receiver device, the second encrypted message being a result of an encryption of the first encrypted message using a second private key, the processor further arranged to decrypt the second encrypted message using an inverse of the first private key to result in a third encrypted message and cause the transceiver to transmit the third encrypted message to the receiver device.

25. A transmitter device for transmitting a message comprising an input for receiving a true message, a processor arranged to encrypt a false message using a first private key to result in a first encrypted message, a transceiver for transmitting the first encrypted message to a receiver device and receiving a second encrypted message from the receiver device, the second encrypted message being a result of an encryption of the first encrypted message using a second private key, where the processor is further arranged to encrypt the true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, resulting in a third encrypted message, and cause the transceiver to transmit the third encrypted message to the receiver device.

26. A receiver device for receiving a message comprising a transceiver for receiving a first encrypted message from a transmitter device, the first encryption being a result of encrypting a message using a first private key, a processor arranged to encrypt the first encrypted message using a second private key to result in a second encrypted message and cause the transceiver to transmit the second encrypted message to the transmitter device and receive a third encrypted message from the transmitter device, the third encrypted message being a result of a decryption using an inverse of the first private key or an encryption of a true message with a third private key, the third private key comprising an inverse of the first encrypted message and the second encrypted message, the processor further arranged to decrypt the third encrypted message using an inverse of the second private key.

27. A communication system comprising a transmitter device according to claim 24 or 25 and a receiver device according to claim 26 arranged to communicate across a network path.

28. A data carrier having stored thereon instructions which when executed by processors of a communication system causes the communication system to carry out the method of claims 8 to 23.

29. A method for encrypting a message comprising determining the Fourier transform of the message, determining the Fourier transform of a key, determining a product of the Fourier transform of the message and the Fourier transform of the key and determining the inverse Fourier transform of the product.

30. A method according to claim 29 wherein the Fourier transforms takes the form of Fast Fourier Transforms (FFTs).

31. A method for determining an inverse, g, of a key, /, where / is used for encrypting a message and g is used for decrypting a message, wherein a

Wiener-Hopf equation as follows is solved for g,

L_s +L - 1 t=C

for j = 0, 1..., Lg - 1, wherein L_g is the number of elements in g and the desired output d is chosen to be equal to an isolated unit value such that g*f ~ I.

32. A method according to claim 31 for determining an inverse, g, of a private key, f, where g is approximated by solving the Wiener-Hopf equation using an algorithm due to Norman Levinson quoted in the Appendix of "N. Wiener. The

Extrapolation, Interpolation and Smoothing of Stationary Time Series, MIT Press, 1942".