France Telecom

Orange

France Telecom Establissement Autonome De Droit Public

Koninklijke Philips Corporation N.v.

Henri Gilbert

Matthew Robshaw

David Arditti

Marc Girault

Olivier Billet

Mireille Campana

Côme Berbain

Olivier Ondet

Gilles Macario-Rat

Yannick Seurin

Jean-Claude Pailles

Dimitri Mouton

Jacques Patarin

Patrick Battistello

Thierry Leclercq

Jacques Stern

David Arditti Modiano

Pascal Chauvaud

Michel Milhau

Jacques Burger

Nicolas Bontron

Loic Juniot

David Pointcheval

Frederic Cherbonnier

Matt Robshaw

Oliver Billet

Loïc Juniot

A method and apparatus are provided for identifying and authenticating a radio tag by a radio reader. The tag forms part of a set of tags in a radio range of the reader and has selected a time slot from a set of available time slots. The method includes: a step of the reader sending a query message during the selected time slot; and a step of the reader receiving a reply message from the tag that selected the time slot. The reply message includes a random value selected by the tag. The tag stores authentication coupons and the reply from the tag received by the reader during the time slot contains, as a random value selected by the tag, a value that is a function of one of the coupons.

Method of identifying and authenticating a radio tag by a reader

A method and apparatus are provided for mutually authenticating a reader and a radio tag. The method includes: a step of the tag sending data to the reader, the data enabling an index to be determined for identifying an authentication coupon of the reader, the index being selected by the tag; a step of the reader obtaining the coupon from the determined index and of the reader sending the coupon to the tag; a step of the tag obtaining an authentication value from the selected index and of the tag verifying that the coupon received from the reader corresponds to the authentication value that is obtained, if the verification is positive, then a step of finalizing the authentication of the tag by the reader; and if the verification is negative, interrupting the mutual authentication method.

Method of mutually authenticating a reader and a radio tag

A method for converting, by means of a conversion entity, a first digit into a second digit, the first cipher corresponding to the result of a symmetric probabilistic encryption of an plain message element using a first secret matrix parameterized by a random vector, the second digit corresponding to the result of a symmetric probabilistic encryption of the plain message element using a second secret matrix that is parameterized by the random vector, characterized in that the method includes a step of: calculating the second digit by encrypting the first digit using a secret conversion matrix which is a function of the first and second secret matrices, and which is parameterized by the random vector.

Method for conversion of a first encryption into a second encryption

A method and apparatus are provided to perform a cryptographic task on at least one numerical datum in an electronic hardware component. The method includes a step of at least partial use of an encryption function. This encryption function includes a basic encryption function obtained by the addition between an intermediate function arising from composition of a coding function with a first function, and a second function. This method can be applied to the encryption of a datum or to the decryption of a datum. Also, a method is provided for generating a public key and a device able to implement one of these methods.

Method for performing a cryptographic task in an electronic hardware component

The invention relates to a method of probabilistic symmetric encryption of a plaintext message element with the aid of a secret key that can be represented in the form of a matrix. It comprises an operation of encrypting the plaintext message element, with the aid of the matrix parametrized by a random vector, so as to obtain an encrypted message element coupled to the random vector. Furthermore, there is envisaged a step of encoding the plaintext message element as a code word with the aid of an error correcting code having a given correction capacity and a step of adding a noise vector. The error correcting code and the noise vector are adapted so that the Hamming weight of the noise vector is less than or equal to the correction capacity of the correcting code.

Method and entity for probabilistic symmetrical encryption

A secure communications method is provided for use in a telecommunications network, wherein a transaction between an entity A and an entity B of the network comprises: entity A sending an authorization request to an Authorization Server S, in which request the entity A identifies itself and authenticates itself; the entity A declares to the Authorization Server its intention to communicate with a certain entity B; the Authorization Server determines a secret key that it shares with the entity B; the Authorization Server generates a session key and sends it to the entity A; the session key being a one-way function of the secret key and also being a function of an integer (transaction number) allocated to the transaction; the Authorization Server also generates a transaction identifier that is a function depending at least on the transaction number in non-invertible manner.

Method and devices for secure communications in a telecommunications network

A method of generating a pseudorandom sequence of terms belonging to a finite body K of cardinal q&#x2267;2 intended to be used in a cryptographic procedure, said method comprising the iterative calculation, from an initialization n-tuple X=(X, X, . . . , X), where n&#x2267;2, of elements of K, of n-tuples X=(X, X, . . . , X) of elements of K (where i=1, 2, . . . ), each n-tuple Xbeing obtained on iteration number i in a predetermined manner at least from certain components Yof an m-tuple Y=(Y, Y, . . . , Y), where m&#x2267;n, of elements of K and the terms of said pseudorandom sequence being extracted in a predetermined manner from the n-tuples X and/or the m-tuples Y. For at least one value of i, among said components Yof the m-tuple Ythat are used to obtain the multiplet X, at least E(n/2) of them are each represented by a predetermined second degree polynomial function, with coefficients in K, of the components of the n-tuple X.

Method and device for generating a pseudorandom sequence

An authentication method of a prover device by a verifier device using cryptographic coupons is provided, where a coupon includes a pseudo-random number r, where i is an index for labeling the coupon, and a reduced-coupon xsuch that x=&#x192;(r), where &#x192; is a predetermined one-way function, the method including the following steps: the verifier device sends a challenge consisting of a random value c to the prover device; the prover device sends to the verifier device a response y calculated by using the pseudo-random number r, the challenge c, and a secret key s belonging to the prover device; and the verifier device checks the validity of the response y based on the challenge c, the reduced-coupon xcorresponding to the pseudo-random number r, and a public key V corresponding to the secret key s, the reduced-coupon xbeing received by the verifier device from a source external to the prover device.

Authentication system and method using electronic tags

A method of implementing a block cipher algorithm by a device storing a fixed initialization datum includes determining, before execution of a first iteration of the algorithm in the course of a session, a modified initialization datum by way of a determined function supplied as input with the fixed initialization datum and a state value specific to the session. The state value may be stored in the device. The modified initialization datum may be used to implement the first iteration of the algorithm.

Method of implementing a block cipher algorithm

A system and a method for cryptographic reduced-coupon reloading are provided, where a coupon includes a pseudo-random number r=PRF(i), where i is an index for labeling the coupon, PRF is a predetermined pseudo-random function and K is a regeneration key, and a 'reduced-coupon' x=&#x192;(r), where &#x192; is a predetermined one-way function, where: a candidate device and a second device acquire a common value of a token T, the candidate device transmits a verification value vto the second device, the second device verifies whether the verification value is equal to PRF'(T), where PRF&#x2032; is a predetermined keyed pseudo-random function identical to, or derived from, the pseudo-random function PRF, where Q is an authentication key owned by the second device and known to the candidate device provided the candidate device is a legitimate reloading device, and if the verification is positive, one or several reduced-coupon(s) provided by the candidate device are stored in the second device.

Efficient and secure cryptographic coupon reloading

A method of authenticating an entity by a verification entity, said entities sharing a pair of secret keys X and Y which are n&#xd7;m (n, m&#x3e;i) binary matrices. The method may be applied to cryptographic protocols for authenticating electronic chips at a very low cost.

Method of authenticating an entity by a verification entity

The invention relates to a secure communication between an electronic label (A) and a reader (B), in particular for the authentication of the label by the reader, in which: the reader () transmits at least one datum (Ch) to the label, the label calculates a combination comprising at least the datum from the reader (Ch)) and a secret (S) specific to the label, and the label communicates () the result (C(S, Ch)) of the combination to the reader (B) for verification purposes. The aforementioned combination (C(S, Ch)) is preferably calculated using a current secret value (S) delivered by a pseudo-random number generator (). The reader (B) is also provided with a homologous pseudo-random generator.

Secure communication between an electronic label and a reader

The invention relates to a method of generating a pseudorandom string of terms belonging to a finite body K of cardinal q&#x2267;2 intended to be used in a cryptography procedure, said method comprising the iterative calculation of a system (&#x393;) of m polynomials with n variables belonging to the finite body K. According to the invention, the coefficients of these m polynomials are regenerated at each iteration. The invention also relates to pseudorandom string generator intended to implement this method.

Method and a device for generating a pseudorandom string

A device and a method of cryptographically hashing a message M, including the following steps: forming a sequence (M, . . . , Mi, . . . , Mc) of data m-tuples M=(a, . . . , a), . . . Mi=(a, . . . , a), . . . , Mc=a, . . . , a), where m is a strictly positive integer, from said message M; iteratively calculating successive output p-tuples V, . . . , V, . . . , V, where p is a strictly positive integer, corresponding to said sequence (M, . . . , Mi, . . . , Mc) of data m-tuples as a function of at least one set of multivariate polynomials defined over a finite field; and determining a hashing value of said message M as a function of the last output p-tuple V.

Cryptographic hashing device and method

A traceable method for encrypting and/or decrypting data broadcast by at least one transmitter towards several decoders includes the steps: during encryption of broadcast data, the transmitter implements (in) at least one first secret function to transform an unencrypted message into an encrypted message; and during decryption of the broadcast data, all the decoders implement (in) at least one common second secret function, each decoder using therefor a mathematical description of the second function stored in a memory (), the mathematical description of the second function being different from one decoder to another or from one group of decoders to another such that the mathematical description used identifies exclusively the particular decoder or group of decoders.

Growing community of inventors

Bures sur Yvette, France

Henri Gilbert