Self authentication ciphertext chaining
View Patent ↗Existing key encryption approaches are extended by using overlapping portions of encrypted information. Another provision inserts one or more bits of data to ensure correct encryption/decryption. The inserted data can also be used for authentication.
1. A method for encrypting information in a message that can be authenticated, the method comprising:
adding a first authentication block to the information to be encrypted to form a concatenated field;
logically subdividing the concatenated field into predetermined block lengths, including a residual field when the concatenated field is not sized as an even multiple of the predetermined block length;
encrypting the subdivided fields using a first key to form cipher blocks;
designating one of the cipher blocks as a designated cipher block, the other cipher blocks being nondesignated cipher blocks;
subdividing the designated cipher block into a first cipher subblock and a second cipher subblock, such that a combined length of the second cipher subblock and the residual field and a second authentication block is the predetermined block length;
encrypting the second cipher subblock and the residual portion together with the second authentication block using a second key to form a cipher residual block; and
providing at least the first cipher subblock of the designated cipher block, the nondesignated cipher blocks and the cipher residual block as the message such that the message can be authenticated by decryption of a valid authentication block of either the first authentication block or the second authentication block.
2. The method of the claim 1 , wherein the second authentication block comprises one or more bits and the second cipher subblock is less than 128 bits.
3. The method of claim 1 , wherein the second authentication block comprises one or more bits forming a null value.
4. A method for encrypting and decrypting information in a message that can be authenticated, the method comprising:
adding a first authentication block to the information to be encrypted to form a concatenated field;
logically subdividing the concatenated field into predetermined block lengths, including a residual field when the concatenated field is not sized as an even multiple of the predetermined block length;
encrypting the subdivided fields using a first key to form cipher blocks;
designating one of the cipher blocks as a designated cipher block, the other cipher blocks being nondesignated cipher blocks;
subdividing the designated cipher block into a first cipher subblock and a second cipher subblock, such that a combined length of the second cipher subblock and the residual field and a second authentication block is the predetermined block length;
encrypting the second cipher subblock and the residual portion together with the second authentication block using a second key to form a cipher residual block;
providing at least the first cipher subblock of the designated cipher block, the nondesignated cipher blocks and the cipher residual block as the message such that the message can be authenticated by decryption of a valid authentication block of either the first authentication block or the second authentication block;
decrypting at least the cipher residual block to obtain a representation of the second authentication block;
authenticating the message by comparing the representation of the second authentication block to an expected value for the second authentication block;
decrypting the cipher blocks to obtain at least a representation of the first authentication block; and
further authenticating the message by comparing the representation of the first authentication block to an expected value for the first authentication block.
5. A method for encrypting information in a message that can be authenticated, the method comprising:
adding a first authentication block to the information to be encrypted to form a concatenated field;
logically subdividing the concatenated field to include a residual field;
encrypting the subdivided fields using a first key to form cipher blocks;
designating one of the cipher blocks as a designated cipher block, the other cipher blocks being nondesignated cipher blocks;
subdividing the designated cipher block into a first cipher subblock and a second cipher subblock;
encrypting the second cipher subblock and the residual portion together with a second authentication block using a second key to form a cipher residual block; and
providing at least the first cipher subblock of the designated cipher block, the nondesignated cipher blocks and the cipher residual block as the message such that the message can be authenticated by decryption of a valid authentication block of either the first authentication block or the second authentication block.
6. The method of the claim 5 , wherein the second authentication block comprises one or more bits and the second cipher subblock is less than 128 bits.
7. The method of claim 5 , wherein the second authentication block comprises one or more bits forming a null value.