General Encryption Enhancement

Abstract

A computerized process is described for improving a computer's asymmetric and symmetric encryption capabilities that results in up to eight times larger effective key size, higher data confidentiality, substantially greater security level, and increased data protection without encrypting any data bit more than once. This is accomplished by padding plaintext, transforming padded plaintext bytes into eight partitions, where each partition holds the bits from a common bit position in padded plaintext bytes, independently encrypting each partition using a cipher, key, key size, and padding all of which may differ between partitions and other cipher parameters required for the cipher to operate and/or necessary to meet encryption objectives. The encrypted partitions are combined to form ciphertext. Decryption essentially reverses the process, where the ciphertext is partitioned, each partition decrypted, decrypted partitions reverse transformed to create an array of padded plaintext, and padding is removed to form plaintext.

Claims

1. A process for data encryption, the process utilizing: computing resources; eight asymmetric or symmetric encryption ciphers that may be same or different from one another; eight public asymmetric keys or symmetric encryption keys that may be same or different from one another; cipher parameters for each said cipher; and plaintext to be encrypted; the process for data encryption comprising: padding plaintext bytes to form padded plaintext bytes; transforming said padded plaintext bytes to transformed bytes and grouping the transformed bytes in eight partitions; encrypting said transformed bytes in each partition independently to form eight partitions of encrypted bytes; and combining said eight partitions of encrypted bytes to form ciphertext.

2. The process of claim 1, wherein said encryption ciphers are limited to: a) asymmetric ciphers whose ciphertext length is same as encryption key length for the key used by the cipher for encryption; and b) symmetric ciphers that are a block or stream cipher.

3. The process of claim 1, wherein padding plaintext bytes includes: a) considering the ciphers to be utilized in the process are symmetric ciphers that never pad their input or asymmetric ciphers, prepending smallest number of padding bytes to plaintext so that the resulting padded plaintext byte length is a multiple of eight; b) considering any of the symmetric ciphers to be utilized in the process are block ciphers that can pad their input, prepending smallest number of padding bytes to plaintext so that the resulting padded plaintext byte length is a multiple of largest cipher's block size measured in bits; and c) a first padding byte of the padding bytes holds said number of padding bytes prepended to the plaintext.

4. The process of claim 3, wherein a zero-based indexed array of padded plaintext bytes is transformed and grouped into eight equal-length zero-based indexed partitions, which include: a) operating on eight sequential padded plaintext bytes (“eight bytes”) at a time from an offset index that is the padded plaintext's byte index (“byte index”) multiplied by eight and the byte index range is from zero to the padded plaintext byte length divided by eight, minus one inclusively; b) reading a bit from a first bit position, which is the least significant bit, from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a first partition at the partition's index that is equal to the byte index; c) reading a bit from a second bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a second partition at the partition's index that is equal to the byte index; d) reading a bit from a third bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a third partition at the partition's index that is equal to the byte index; e) reading a bit from a fourth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a fourth partition at the partition's index that is equal to the byte index; f) reading a bit from a fifth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a fifth partition at the partition's index that is equal to the byte index; g) reading a bit from a sixth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a sixth partition at the partition's index that is equal to the byte index; h) reading a bit from a seventh bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a seventh partition at the partition's index that is equal to the byte index; and i) reading a bit from an eighth bit position, which is the most significant bit, from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to an eighth partition at the partition's index that is equal to the byte index.

5. The process of claim 4, wherein said transformed bytes grouped in eight partitions are encrypted with asymmetric or symmetric encryption, which includes: a) independently encrypting said transformed bytes in each of the eight partitions using a cipher that may be different between partitions; b) independently encrypting said transformed bytes in each of said eight partitions using an encryption key that may be different between partitions; c) independently encrypting said transformed bytes in each of the eight partitions using an encryption key length that may be different between partitions; d) independently encrypting said transformed bytes in each of the eight partitions using an encryption padding type that may be different between partitions; and e) independently encrypting said transformed bytes in each of said eight partitions using or generating cipher parameters that are required to accomplish encryption objectives, including data confidentiality, data integrity, authentication of communicating entities, and/or non-repudiation.

6. The process of claim 5, wherein said encrypted bytes from each partition are combined in sequential order from the first partition to the eighth partition to form ciphertext.

7. The process of claim 1, wherein padding plaintext bytes includes: a) considering the ciphers to be utilized in the process are symmetric ciphers that can't pad their input or asymmetric ciphers, appending smallest number of padding bytes to plaintext so that the resulting padded plaintext byte length is a multiple of eight; b) considering any of the symmetric ciphers to be utilized in the process are block ciphers that can pad their input, appending smallest number of padding bytes to plaintext so that the resulting padded plaintext byte length is a multiple of largest cipher's block size measured in bits; and c) a last padding byte of the padding bytes holds said number of padding bytes appended to the plaintext.

8. The process of claim 7, wherein a zero-based indexed array of padded plaintext bytes is transformed and grouped into eight equal-length zero-based indexed partitions, which include: a) operating on eight sequential padded plaintext bytes (“eight bytes”) at a time from an offset index that is the padded plaintext's byte index (“byte index”) multiplied by eight, and the byte index range is from zero to the padded plaintext byte length divided by eight, minus one inclusively; b) reading a bit from a first bit position, which is the least significant bit, from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a first partition at the partition's index that is equal to the byte index; c) reading a bit from a second bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a second partition at the partition's index that is equal to the byte index; d) reading a bit from a third bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a third partition at the partition's index that is equal to the byte index; e) reading a bit from a fourth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a fourth partition at the partition's index that is equal to the byte index; f) reading a bit from a fifth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a fifth partition at the partition's index that is equal to the byte index; g) reading a bit from a sixth bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a sixth partition at the partition's index that is equal to the byte index; h) reading a bit from a seventh bit position from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to a seventh partition at the partition's index that is equal to the byte index; and i) reading a bit from an eighth bit position, which is the most significant bit, from each of eight bytes in sequential order to form a transformed byte and adding the transformed byte to an eighth partition at the partition's index that is equal to the byte index.

9. The process of claim 8, wherein said transformed bytes grouped in eight partitions are encrypted with asymmetric or symmetric encryption, which includes: a) independently encrypting said transformed bytes in each of the eight partitions using a cipher that may be different between partitions; b) independently encrypting said transformed bytes in each of said eight partitions using an encryption key that may be different between partitions; c) independently encrypting said transformed bytes in each of the eight partitions using an encryption key length that may be different between partitions; d) independently encrypting said transformed bytes in each of the eight partitions using an encryption padding type that may be different between partitions; and e) independently encrypting said transformed bytes in each of said eight partitions using or generating cipher parameters that are required to accomplish encryption objectives, including data confidentiality, data integrity, authentication of communicating entities, and/or non-repudiation.

10. The process of claim 9, wherein said encrypted bytes from each partition are combined in sequential order from the first partition to the eighth partition to form ciphertext.

11. A process for data decryption, the process utilizing: computing resources; eight asymmetric or symmetric encryption ciphers; eight private asymmetric keys or symmetric encryption keys; cipher parameters for each said cipher; and ciphertext to be decrypted; the process for data decryption comprises: partitioning ciphertext bytes into eight partitions, considering said cipher parameters; independently decrypting said ciphertext bytes in each said partition to form eight decrypted partitions; reverse transforming and grouping the bytes from said decrypted partitions to form padded plaintext; and removing the padding from said padded plaintext to form plaintext.

12. The process of claim 11, wherein partitioning ciphertext bytes includes sequentially reading the ciphertext bytes and allotting the ciphertext bytes to eight zero-based indexed partitions, considering the cipher parameters.

13. The process of claim 12, wherein said ciphertext bytes in each of said eight partitions are decrypted to eight corresponding zero-based indexed decrypted partitions using asymmetric decryption, includes: a) decrypting the ciphertext bytes in each partition using the cipher that was used in the process for encrypting the partition of transformed bytes; b) decrypting the ciphertext bytes in each partition using the private key that corresponds to the public key that was used in the process for encrypting the partition of transformed bytes; and c) decrypting the ciphertext bytes in each partition using the padding type that was used in the process for encrypting the partition of transformed bytes.

14. The process of claim 13, wherein the bytes in said eight decrypted partitions are reverse transformed and grouped to form padded plaintext in a zero-based indexed array includes: a) operating on eight bytes (“eight bytes”) at a time, one byte from each of the eight decrypted partitions, sequentially from the first decrypted partition to the eighth decrypted partition at a byte index (“byte index”) within each decrypted partition that ranges from zero to the byte length of a decrypted partition, minus one inclusively; b) reading a bit from the first bit position, which is the least significant bit, from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight; c) reading a bit from the second bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus one; d) reading a bit from the third bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus two; e) reading a bit from the fourth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus three; f) reading a bit from the fifth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus four; g) reading a bit from the sixth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus five; h) reading a bit from the seventh bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus six; and i) reading a bit from the eighth bit position which is the most significant bit, from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus seven.

15. The process of claim 14, wherein the padding bytes of said padded plaintext are removed from the padded plaintext to form plaintext includes: a) reading the value of the first byte of the padded plaintext array, which is the number of padding bytes in the padded plaintext array; and b) removing said number of padding bytes from the beginning of the padded plaintext array to form plaintext.

16. The process of claim 14, wherein the padding bytes of said padded plaintext are removed from the padded plaintext to form plaintext includes: a) reading the value of the last byte of the padded plaintext array, which is the number of padding bytes in the padded plaintext array; and b) removing said number of padding bytes from the end of the padded plaintext array to form plaintext.

17. The process of claim 12, wherein said ciphertext bytes in each of eight partitions are decrypted to eight corresponding zero-based indexed decrypted partitions using symmetric decryption includes: a) decrypting the ciphertext bytes in each partition using the cipher that was used in the process for encrypting the partition of transformed bytes; b) decrypting the ciphertext bytes in each partition using the key that was used in the process for encrypting the partition of transformed bytes; c) decrypting the ciphertext bytes in each partition using the padding type that was used in the process for encrypting the partition of transformed bytes; d) decrypting the ciphertext bytes in each partition using any cipher parameters that were generated in the process for encrypting the partition of transformed bytes and are necessary for decryption of the partition; and e) decrypting the ciphertext bytes in each partition using any cipher parameters that were used in the process for encrypting the partition of transformed bytes and are necessary for decryption of the partition.

18. The process of claim 17, wherein the bytes in said eight decrypted partitions are reverse transformed and grouped to form padded plaintext in a zero-based indexed array includes: a) operating on eight bytes (“eight bytes”) at a time, one byte from each of the eight decrypted partitions, sequentially from the first decrypted partition to the eighth decrypted partition at a byte index (“byte index”) within each decrypted partition that ranges from zero to the byte length of a decrypted partition, minus one inclusively; b) reading a bit from the first bit position, which is the least significant bit, from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight; c) reading a bit from the second bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus one; d) reading a bit from the third bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus two; e) reading a bit from the fourth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus three; f) reading a bit from the fifth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus four; g) reading a bit from the sixth bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus five; h) reading a bit from the seventh bit position from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus six; and i) reading a bit from the eighth bit position which is the most significant bit, from each of the eight bytes to form a reversed transformed byte and adding the reversed transformed byte to the padded plaintext array at the array index that is the byte index multiplied by eight, plus seven.

19. The process of claim 18, wherein the padding bytes of said padded plaintext are removed from the padded plaintext to form plaintext includes: a) reading the value of the first byte of the padded plaintext array, which is the number of padding bytes in the padded plaintext array; and b) removing said number of padding bytes from the beginning of the padded plaintext array to form plaintext.

20. The process of claim 18, wherein the padding bytes of said padded plaintext are removed from the padded plaintext to form plaintext includes: c) reading the value of the last byte of the padded plaintext array, which is the number of padding bytes in the padded plaintext array; and d) removing said number of padding bytes from the end of the padded plaintext array to form plaintext.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The present invention is described with respect to particular exemplary embodiments thereof, and reference is accordingly made to the drawings in which:

[0017] FIG. 1 shows an illustration of eight data bytes being transformed and partitioned by collecting the data bits from common bit positions in the eight data bytes to form eight new bytes and adding each new byte to a separate partition.

[0018] FIG. 2 shows an illustration of eight data bytes being padded, transformed, and partitioned before encryption.

[0019] FIG. 3 shows an illustration of partitioned data bytes after decryption, reverse transformed, and padding removed.

[0020] FIG. 4 shows an illustration of the data padding divisor for various asymmetric and symmetric ciphers and some of the characteristics of each cipher.

[0021] FIG. 5 shows an illustration of the highest data padding divisor for groups of eight asymmetric or symmetric ciphers, where each cipher in each group has been assigned to a partition.

[0022] FIG. 6 shows an illustration of GEE limitations, where GEE requires (i) key-based asymmetric or symmetric cipher algorithms; (ii) eight partitions; (iii) the cipher, key value, key size, and padding type associated with encrypting/decrypting each partition are different or the same as another partition; (iv) asymmetric ciphers that produce ciphertext whose length is equal to the cipher's key length; and (v) symmetric ciphers that are block or stream ciphers.

[0023] FIG. 7 shows an illustration of the security level (measured in bits), maximum operations to break encryption, and maximum message size achieved by an RSA asymmetric encryption cipher using a 1024 bit key size and various padding types compared to the security level, maximum operations to break encryption, and maximum message size achieved by GEE using the same RSA cipher, key size and padding type for each partition and an example of GEE using the RSA cipher, various key sizes and OAEP w/SHA-256 padding type for the partitions.

[0024] FIG. 8 shows an illustration of the security level (measured in bits) and maximum operations to break encryption achieved by various symmetric encryption ciphers and key sizes compared to the security level bits and maximum operations to break encryption achieved by GEE using the same cipher and key size for each partition and an example of GEE using various ciphers and key sizes for the partitions.

[0025] FIG. 9 depicts an embodiment of the GEE encryption process, where input data is padded considering encryption parameters (“E.sub.0-7”); padded data is transformed and partitioned; each partition is encrypted using the partition's encryption parameters (“E.sub.partition index”); each partition's decryption parameters (“D.sub.partition index”) are output; and encrypted partitions are combined and output to form encrypted data, where the method of the invention may be implemented according to a preferred embodiment.

[0026] FIG. 10 depicts an embodiment of the GEE decryption process, where priorly GEE encrypted data is partitioned considering decryption parameters (“D.sub.0-7”); partitions are decrypted using each decrypter's decryption parameters (“D.sub.partition index”); decrypted partitions are reverse transformed to form padded plaintext; and padding removed to output plaintext, where the method of the invention may be implemented according to a preferred embodiment.

[0027] FIG. 11 shows a flowchart of the data encryption process starting, where the length of the data to be encrypted is determined; the encryption parameters (“E.sub.0-7”) are retrieved and the highest data padding divisor is determined; the data to be encrypted is retrieved and padded with a calculated number of padding bytes to form zero-based indexed padded data; and the number of padding bytes is stored in the first byte of the padded data with a continuation on FIG. 12.

[0028] FIG. 12 shows a continuation of the flowchart depicted in FIG. 11 designation A and the parallelized operation of inputting a byte index and eight sequential bytes at a time from padded data, starting at the padded data index that is equal to the byte index multiplied by eight, to a transform, where the byte index is from 0 to the padded data length divided by eight, minus 1 inclusively, with a continuation on FIGS. 13 and continuations from the flowchart depicted in FIG. 13 designation A, resulting in transformed bytes in eight equal length partitions with a continuation on FIG. 14.

[0029] FIG. 13 shows a continuation of the flowchart depicted in FIG. 12 designation A and transforming eight padded data bytes into eight new bytes with each new byte added to a separate partition, where each partition holds the bits from a common bit position in padded data bytes with a continuation on FIG. 12.

[0030] FIG. 14 shows a continuation of the flowchart depicted in FIG. 12 designation B and the parallelized operation of inputting a partition's index to an encrypter, where the partition's index is from zero to seven inclusively with a continuation on FIGS. 15 and continuations from the flowchart depicted in FIG. 15 designation A, and outputting the (i) decryption parameters associated with each encrypted partition in partition order from zero to seven; and (ii) encrypted data partitions in partition order from zero to seven to form encrypted data (ciphertext) and the GEE encryption process is done.

[0031] FIG. 15 shows a continuation of the flowchart depicted in FIG. 14 designation A, where a partition of transformed bytes and encryption parameters associated with the partition's index (“E.sub.partition index”) are retrieved and input to the encrypter, which generates an encrypted partition and the decryption parameters (“D.sub.partition index”) necessary to decrypt the encrypted partition and also associated with the partition's index with a continuation on FIG. 14.

[0032] FIG. 16 shows a flowchart of the encrypted data decryption process starting, where the decryption parameters associated with each encrypted partition (“D.sub.0-7”) are retrieved; each encrypted partition length is calculated considering appropriate decryption parameters; the encrypted data is retrieved and partitioned successively into eight encrypted partitions according to each encrypted partition's length with a continuation on FIG. 17.

[0033] FIG. 17 shows a continuation of the flowchart depicted in FIG. 16 designation A and the parallelized operation of inputting an encrypted partition's index to a decrypter, where the partition's index is from zero to seven inclusively with a continuation on FIG. 18 and continuations from the flowchart depicted in FIG. 18 designation A, resulting in decrypted data in eight equal length decrypted partitions with a continuation on FIG. 19.

[0034] FIG. 18 shows a continuation of the flowchart depicted in FIG. 17 designation A, where the decryption parameters and the encrypted partition associated with the encrypted partition's index are retrieved and input to the decrypter; and the decrypter, governed by the decryption parameters, decrypts the encrypted partition and stores the decrypted data in a zero-based indexed decrypted partition where the decrypted partition's index is equal to the encrypted partition's index with a continuation on FIG. 17.

[0035] FIG. 19 shows a continuation of the flowchart depicted in FIG. 17 designation B and the parallelized operation of inputting a byte index ranging from zero to a decrypted partition's length minus one inclusively and a byte from each of eight decrypted partitions, in order of the partitions, at byte index in each decrypted partition to a reverse transform with a continuation on FIG. 20 and continuations from the flowchart depicted in FIG. 20 designation A, resulting in an array of padded data with a continuation on FIG. 21.

[0036] FIG. 20 shows a continuation of the flowchart depicted in FIG. 19 designation A and reverse transforming eight bytes, such that the bits from each of the common bit positions of the eight bytes form eight new bytes that are added sequentially to a zero-based indexed array starting at the array index that is equal to the byte index multiplied by eight with a continuation on FIG. 19.

[0037] FIG. 21 shows a continuation of the flowchart depicted in FIG. 19 designation B and reading the data padding length from the first byte in the padded data array and outputting the array, starting at the array index that is equal to the data padding length, to form plaintext and the GEE decryption process is done.

[0038] FIG. 22 depicts an embodiment of the digital signature creation process, where input data is padded; padded data is transformed and partitioned; each partition is hashed and signed by a digital signature algorithm using its digital signature parameters (“P.sub.partition index”) thereby creating a digital signature for each partition; and each partition's digital signature is output (“S.sub.partition index”), where the method of the invention may be implemented according to a preferred embodiment.

[0039] FIG. 23 depicts an embodiment of the digital signature verification process, where data is padded; padded data is transformed and partitioned; each partition's digital signature algorithm verifier using its digital signature parameters (“P.sub.partition index”), hashes and signs the partition's data creating a digital signature for the partition, which is compared to the original digital signature for the partition (“S.sub.partition index”); and each result of the verifier function is ANDed together to verify that all partition digital signatures match the original digital signatures or indicate a failure to match, where the method of the invention may be implemented according to a preferred embodiment.

[0040] FIG. 24 shows a graph of the Security Level achieved by RSA encryption for various key sizes compared to the Security Level achieved by GEE with RSA encryption and a Super Key.

[0041] FIG. 25 shows a graph of the Security Level achieved by AES encryption for various key sizes compared to the Security Level achieved by GEE with AES encryption and a Super Key.

DETAILED DESCRIPTION

Summary

Notations and Nomenclature

[0042] Byte/byte—means a unit of digital information that consists of eight bits. [0043] Key—is a sequence of digital bits that is an input to a Cipher. [0044] Cipher—means a Key-based algorithm that performs encryption and decryption. [0045] Mode—means a Symmetric Encryption block Cipher mode of operation. [0046] AES—in cryptography is the Advanced Encryption Standard that is a Symmetric Encryption algorithm. [0047] DES—in cryptography is the Data Encryption Standard that is a Symmetric Encryption block algorithm. [0048] 3DES—in cryptography is the Triple Data Encryption Standard algorithm, where the DES algorithm is applied three times to each Data block. [0049] CCM—in cryptography is counter with cipher block chaining message authentication code Mode and never pads its input. [0050] GCM—in cryptography is Galois/Counter Mode and never pads its input. [0051] CBC—in cryptography is cipher block chaining Mode. [0052] CFB—in cryptography is cipher feedback Mode. [0053] ChaCha20—in cryptography is a Symmetric Encryption stream algorithm developed by Daniel J. Bernstein. [0054] Serpent—in cryptography is a Symmetric Encryption block algorithm that was designed by Ross Anderson, Eli Biham, and Lars Knudsen. [0055] Twofish—in cryptography is a Symmetric Encryption block algorithm that was designed by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson. [0056] RSA—in cryptography is an Asymmetric Encryption algorithm described by Ron Rivest, Adi Shamir, and Leonard Adleman; and for the purposes considered herein, the implementations of RSA include padding. [0057] Data—is a sequence of one or more bytes. [0058] PKCS#1—in cryptography is the padding associated with the Public-Key Cryptography Standards. [0059] SHA—in cryptography means Secure Hash Algorithms developed by NIST that are a family of cryptographic hash functions. [0060] OAEP with SHA-1/256/384/512—in cryptography is Optimal Asymmetric Encryption Padding standard with a SHA-1/256/384/512 hash algorithm. [0061] Plaintext—in cryptography is Data that is not encrypted. [0062] Ciphertext—in cryptography is Data that has been encrypted. [0063] Objectives—means Data confidentiality, Data integrity, authentication of communicating entities, and/or non-repudiation. [0064] Encryption Parameters or E.sub.partition index—are those input parameters, including a Cipher and Key, to an encrypter that enable the encrypter to perform its task, which varies depending on Objectives. [0065] Decryption Parameters or D.sub.partition index—are those input parameters, including a Cipher and Key, to a decrypter that enable the decrypter to perform its task, which may include particular parameters generated or used by an encrypter during encryption. [0066] Super Key—a concatenation of eight Keys. [0067] Asymmetric Encryption—means a type of digital Data encryption that uses a pair of mathematically related Keys, a public Key and a private Key, where input Data that has been encrypted using the public Key can only be decrypted using the related private Key; and the Ciphertext length is equal to the Key length. [0068] Symmetric Encryption—means a type of digital Data encryption that uses a block or stream Cipher with the same Key to encrypt and decrypt Data. [0069] Cascade/Multiple Encryption—means encrypting Data multiple times to achieve higher Data protection and may use multiple ciphers and/or multiple encryption keys. [0070] NIST—means National Institute of Standards and Technology. [0071] Security Level—means a measure of the strength that a Cipher achieves expressed in bits. For Asymmetric Encryption Ciphers it is calculated per the formula provided in NIST publication, “Implementation Guidance for FIPS 140-2 and the Cryptographic Module Validation Program,” last updated Nov. 5, 2021, page 122, and for Symmetric Encryption Ciphers it is the number of bits actually used by a Cipher from its encryption Key for encryption. [0072] DPD—means Data padding divisor which is (i) eight for Asymmetric Encryption Ciphers, Symmetric Encryption stream Ciphers, and Symmetric Encryption Cipher-Modes where Data padding is not an option and never pad their input; and (ii) the Cipher's block size measured in bits for Symmetric Encryption Cipher-Modes where Data padding is an option. [0073] HDPD—means the highest DPD from a group of eight Ciphers. [0074] DSA—means Digital Signature Algorithm that is an algorithm or combination of algorithms, which is governed by Digital Signature Parameters, that creates and/or verifies a Digital Signature. [0075] Digital Signature Parameters or P.sub.partition index—are those DSA parameters that enable the DSA to perform its task. [0076] Digital Signature or S.sub.partition index—Means the encrypted hash of Data, which is created by a DSA. [0077] FIPS—means Federal Information Processing Standards.

[0078] The current/prior art for encryption security level enhancements typically falls into requiring/using larger key sizes for existing ciphers, cascading ciphers, and new ciphers.

[0079] Requiring longer key lengths is the standard approach to increasing encryption security levels. But there are limits on the size of the keys, due to either the cipher architecture or the time it takes to generate large key sizes. The popular AES cipher only supports 128/192/256-bit keys. There is not an upgrade path to go beyond a 256-bit security level (256-bit key size). The RSA cipher, by comparison, supports a larger range of keys, but larger keys take a longer time to generate and RSA can only encrypt small amounts of Data. If the goal was to upgrade from an RSA security level of 79 bits (1024 bit key size) to a security level of 269 bits (16,384-bit key size) to ensure security for the long term, it would take 1,000s of times longer to generate a 16,384 bit key compared to a 1,024-bit key.

[0080] The GEE invention takes a Super Key approach, where a Super Key is eight times longer than an asymmetric/symmetric encryption key and formed from the concatenation of eight individual asymmetric/symmetric encryption keys. The resulting encryption security level is dramatically raised, even though the current art encryption algorithm is utilized. This means that today's AES encryption with a 256-bit key and 256-bit security level, would be raised effectively by GEE to AES encryption with a 2048 bit key and 2048 bit security level. RSA encryption with a 2048-bit key and 110-bit security level, would be raised effectively by GEE to RSA encryption with a 16,384-bit key and 269-bit security level. The Super Key approach future-proofs encryption against major technology developments, such as quantum computing, as the security level and the corresponding number of operations to break the encryption are exceedingly high. GEE with AES ciphers and a 2048 bit Super Key would require up to 3.23 E+616 operations to break encryption, and GEE with RSA ciphers and a 16,384-bit Super Key would require up to 9.48 E+80 operations to break encryption.

[0081] Current/prior art for encryption may also use cascading ciphers to enlarge the keyspace and provide protection against a cipher in the cascade being broken. Encryption software, like VeraCrypt, offers encryption with two and three cipher cascades, such as AES-Twofish-Serpent for a three cipher cascade. Ciphers like the 3DES-3 key cipher have an internal triple cascade of DES ciphers and partition the input key to three smaller keys of equal length. A 3DES-3 key cipher presented with a 192-bit key is divided into three 64 bit keys. Each 64-bit key is applied to its own DES cipher. Each DES cipher uses 56 of 64 key bits for encryption. Cascade ciphers have the downside of processing Data more than once, as the output of one cipher feeds the next cipher in the cascade. Therefore, for a two/three cipher cascade, the input Data is processed two/three times. Cascade encryption processing time puts a hard limit on how long a cascade can reasonably be and therefore limits the security level that can be achieved.

[0082] GEE's innovation is that, in one embodiment, it operates on each bit of Data only one time, unlike prior art approaches such as cascade encryption. GEE's partitioning process creates eight partitions, each holding one-eighth of the transformed Data. In this way, the embodiment of the invention relates to data in a specific order and relates to data in specific physical locations in computer memory. These partitions can be encrypted in parallel, each with a different key and/or cipher. Where typical cascade encryption may use two or three ciphers, GEE can use up to eight ciphers. This offers protection against ciphers being broken and a much higher security level than cascade encryption.

[0083] New encryption algorithms are being developed for the post-quantum cryptography era. To embrace these new algorithms and revamp the encryption space will be no small undertaking in terms of time, cost, and resources. But there hasn't been a choice to use current, well-established, FIPS compliant encryption algorithms to achieve the security level necessary to protect Data when quantum computers are mainstream.

[0084] GEE is a practical invention that doesn't require new encryption algorithms or any modifications to well-established, FIPS-compliant encryption algorithms. GEE can use current encryption algorithms, asymmetric or symmetric, to provide the security level necessary to protect Data in a post-quantum cryptography era.

[0085] Current/prior art encryption algorithms operate on Data in a serial manner at the bit/byte/byte block level. These algorithms don't consider operating on the eight bit positions in each Data byte separately and independently and encrypting the bits in each bit position with a different key. This means these algorithms don't process all bit position one bits together, all bit position two bits together . . . all bit position eight bits together. By not considering bit positions, a significant opportunity is lost to raise the encrypted Data output security level. The missed opportunity is that each bit position in all Data bytes would rely on a different key and require eight keys for decryption.

[0086] GEE transforms Data before encryption so that each bit position in all Data bytes is encrypted independently with a key and cipher. This results in each byte of Data requiring eight encryption keys for decryption, therefore significantly enlarging the keyspace and corresponding security level.

[0087] Data, in general, is organized as a collection of bytes and transferred as a serial stream of bytes. Sometimes Data is segmented into several streams of Data for transport to be later reconstituted, such as with a file-sharing application. Data can also be reorganized, modified, augmented, and formatted to allow it to be used by more than one discipline, such as files that have been formatted to an Intermediate Data Format to allow Data to be used by both electronic design automation software and solid modeling software. Portions of data may also be changed, such as an audio application that removes humming from an audio file or an image application that re-colorizes an image.

[0088] The GEE Data transformation, by comparison, does not segment, organize, augment, modify, format, and/or change portions of input Data bytes. GEE creates new Data bytes, eight at a time, derived from a stream of input Data bytes, where each of the eight new Data bytes is added to a separate partition. The result is eight partitions of new Data bytes.

[0089] GEE provides mechanisms to: [0090] (i) pad Plaintext bytes; [0091] (ii) parallelly transform and partition padded Plaintext bytes into eight partitions of transformed bytes; [0092] (iii) parallelly perform independent Asymmetric Encryption or Symmetric Encryption on eight partitions of transformed bytes using each partition's associated encryption parameters; [0093] (iv) combine encrypted output from eight independent encryptions to form Ciphertext; [0094] (v) partition Ciphertext into eight partitions considering the decryption parameters associated with the Ciphertext; [0095] (vi) parallelly perform eight independent decryptions, with each decryption being performed on a partition of the Ciphertext using the partition's decryption parameters; [0096] (vii) reverse transform the decrypted output from eight independent decryptions to form padded Plaintext; [0097] (viii) remove the padding from padded Plaintext to form Plaintext; [0098] (ix) increase the Security Level for Asymmetric Encryption or Symmetric Encryption from the Security Level associated with a single Key to eight Keys, provided each Key value is different while encrypting each bit of Plaintext only once; [0099] (x) increase the maximum Plaintext size (“M”) measured in bytes for Asymmetric Encryption using a given Cipher, Key, and padding from M to eight times M, minus 1, [“(8M)−1”], while encrypting each bit of Plaintext bytes only once.

[0100] GEE encrypts each bit of Plaintext one time. GEE utilizes eight generally available Asymmetric Encryption or Symmetric Encryption Ciphers without any Cipher or Objective modification. The invention pads Plaintext, and the padded Plaintext is transformed eight bytes at a time, taking the bits in common bit positions to create eight new transformed bytes, where each transformed byte is added successively to one of eight partitions. After all padded Plaintext bytes are transformed, the first partition holds the bits from the first bit position of padded Plaintext bytes; the second partition holds the bits from the second bit position of padded Plaintext bytes; the third partition holds the bits from the third bit position of padded Plaintext bytes; the fourth partition holds the bits from the fourth bit position of padded Plaintext bytes; the fifth partition holds the bits from the fifth bit position of padded Plaintext bytes; the sixth partition holds the bits from the sixth bit position of padded Plaintext bytes; the seventh partition holds the bits from the seventh bit position of padded Plaintext bytes; and the eighth partition holds the bits from the eighth bit position of padded Plaintext bytes. After Encryption Parameters are provided for each of the eight partitions, where each partition holds one-eighth of the transformed bytes, each partition is independently encrypted in parallel to the extent permitted by the underlying hardware. The eight encrypted partitions are combined sequentially from partitions one to eight to form Ciphertext.

[0101] If GEE used the same Key to encrypt all eight partitions, then no additional Data protection will be achieved over today's single Key encryption. However, if different Keys are used with GEE to encrypt some or all of the eight partitions, then a much higher degree of Data protection will be achieved.

[0102] If a vulnerability is discovered in a Cipher, then past or future use of the Cipher creates the risk of encrypted Data being exposed. GEE encryption, on the other hand utilizing two to eight Ciphers mitigates the risk of a Cipher being broken, as all Ciphers utilized would need to be broken to create a similar level of risk.

[0103] Unlike single Cipher and Key encryption or Cascade Encryption, GEE can encrypt each common bit position of input Data bytes using a different Cipher and/or different Key. This means that to recover any or all Plaintext bytes requires up to eight different Ciphers and/or up to eight different Keys.

[0104] This invention decrypts Ciphertext by first sequentially partitioning Ciphertext into eight encrypted partitions, considering appropriate decryption parameters. Each of the eight encrypted partitions is independently decrypted using the Decryption Parameters associated with the encrypted partition to form eight decrypted partitions. The bytes in the decrypted partitions are reverse transformed to create padded Plaintext. For the number of times that is the byte length of a single partition, this reverse transformation is accomplished by (i) taking eight bytes at a time (“group”), one byte from each partition in partition order, the first partition to the eighth partition, and at the same zero-based byte index (“index”) within each partition; (ii) taking the bit at the first bit position (least significant bit) of each byte in the group, in the order of the bytes in the group, to form a new byte and adding the new byte to a zero-based array at index times eight; (iii) taking the bit at the second bit position of each byte in the group, in the order of the bytes in the group, to form a new byte and adding the new byte to the array at index times eight, plus one; (iv) taking the bit at the third bit position of each byte in the group, in the order of the bytes in the group, to form a new byte and adding the new byte to the array at index times eight, plus two; (v) taking the bit at the fourth bit position of each byte in the group, in the order of the bytes in the group, to form a new byte and adding the new byte to the array at index times eight, plus three; (vi) taking the bit at the fifth bit position of each byte in the group, in the order of the bytes in the group, to form a new byte and adding the new byte to the array at index times eight, plus four; (vii) taking the bit at the sixth bit position of each byte in the group, in the order of the bytes in the group to form a new byte and adding the new byte to the array at index times eight, plus five; (viii) taking the bit at the seventh bit position of each byte in the group, in the order of the bytes in the group to form a new byte and adding the new byte to the array at index times eight, plus six; (ix) taking the bit at the eighth bit position (most significant bit) of each byte in the group, in the order of the bytes in the group to form a new byte and adding the new byte to the array at index times eight, plus seven. The resulting array contains the padded Plaintext. Padding is removed from the padded Plaintext to form Plaintext.

DETAILED DESCRIPTION OF DRAWINGS

[0105] FIG. 1 shows eight sequential data bytes in binary 101 that are rotated counterclockwise and displayed right to left, which is least significant byte to most significant byte 102, where the bits in common bit positions of the eight bytes are collected with byte #1 representing the least significant bits and byte #8 representing the most significant bits to form eight new bytes 103 with each new byte added to a separate partition 104. FIG. 2 shows eight sequential data bytes in binary 201 that are padded with eight padding bytes by prepending the padding bytes to the data bytes with the number of padding bytes stored in the first padding byte 202, and the padded data bytes are transformed and partitioned with the first eight transformed bytes occupying the first position in each of eight partitions and the second eight transformed bytes occupying the second position in the partitions 203.

[0106] FIG. 3 shows sixteen partitioned data bytes after decryption 301, reverse transformed 302, and padding removed to recover plaintext 303.

[0107] FIG. 4 shows the data padding divisor 406 associated with various asymmetric and symmetric encryption 401 ciphers 402 that are block or stream ciphers 403 with a corresponding block size 404 and whether encryption padding is used by the cipher 405.

[0108] FIG. 5 shows the highest data padding divisor 502 for groups of eight asymmetric or symmetric ciphers, where each cipher and mode (if any) in each group has been assigned to a partition 501.

[0109] FIG. 6 shows that GEE is limited to using asymmetric or symmetric key-based cipher algorithms 601, 607, and eight partitions 602. A cipher and its mode (if any) 603, key-value 604, key size 605, and padding type 606 assigned to each partition may be different or the same as another partition. GEE is limited to asymmetric ciphers 608 that produce ciphertext whose length is equal to the cipher's key length or symmetric ciphers 608 that are block or stream ciphers.

[0110] FIG. 7 shows that for current single key encryption 701, the security level bits 704, the corresponding maximum number of operations to break the encryption 705, and the maximum message size 706 for the RSA asymmetric encryption cipher using a 1024 bit key size and various padding types 703 for five examples 702 compared to the security level bits 710, the corresponding maximum number of operations to break the encryption 711, and the maximum message size 712 for GEE 707 using the same RSA cipher, key size, and padding type for each partition 709 for five examples 708 and a sixth example 708 of GEE using the RSA cipher, various key sizes, and OAEP w/SHA-256 padding type for the partitions 709.

[0111] FIG. 8 shows that for current encryption 801, the security level bits 804 and corresponding maximum number of operations to break the encryption 805 by various symmetric encryption ciphers and key sizes 803 for six examples 802 compared to the security level bits 809 and corresponding maximum number of operations to break the encryption 810 for GEE 806 with six examples 807 using the same encryption cipher and key size for each partition 808 and a seventh example 807 using various ciphers and key sizes for the partitions 808.

[0112] FIG. 9 depicts an embodiment of the GEE encryption process, where input data 901 is padded 902 considering encryption parameters 903; padded data is transformed and partitioned 904, resulting in eight partitions 905-912; each partition 905-912 is encrypted by an encrypter 921-928 using the partition's encryption parameters 913-920; each partition's decryption parameters 929-936 are output; and encrypted partitions 937-944 are combined and output to form encrypted data 945, where the method of the invention may be implemented according to a preferred embodiment.

[0113] FIG. 10 depicts an embodiment of the GEE decryption process, where priorly GEE encrypted data 1001 is partitioned 1002 considering decryption parameters 1003, resulting in eight encrypted partitions 1004-1011; each encrypted partition 1004-1011 is decrypted by a decrypter 1020-1027 using the decrypter's decryption parameters 1012-1019; decrypted partitions 1028-1035 are reversed transformed 1036 to form padded plaintext; and padding is removed 1037 to output plaintext 1038, where the method of the invention may be implemented according to a preferred embodiment.

[0114] FIG. 11 shows a flowchart of the data encryption process starting, where the length of the data to be encrypted is determined 1101; the encryption parameters for each partition's encrypter are retrieved 1102; the highest data padding divisor (“HDPD”) considering the encryption parameters is determined 1103; the remainder is calculated as data length modulo HDPD 1104; the data padding length is calculated as HDPD minus remainder 1105; the data to be encrypted is retrieved and padding prepended to form zero-based indexed padded data 1106, where the length of the padding is equal to the calculated padding length; and the padding length is stored in the first byte of the padded data 1107 with a continuation on FIG. 12.

[0115] FIG. 12 shows a continuation of the flowchart depicted in FIG. 11 designation A, where a byte index and eight sequential bytes at a time from padded data, starting at the padded data index that is equal to the byte index multiplied by eight, where the byte index is from 0 to the padded data length divided by eight, minus 1 inclusively 1201, are input to a parallelized transform 1202 with a continuation on FIG. 13. There are continuations from the flowchart depicted in FIG. 13 designation A that result in transformed bytes in eight equal length partitions 1203 with a continuation on FIG. 14.

[0116] FIG. 13 shows a continuation of the flowchart depicted in FIG. 12 designation A, where the first bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition zero at the position given by the byte index 1301; the second bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition one at the position given by the byte index 1302; the third bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition two at the position given by the byte index 1303; the fourth bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition three at the position given by the byte index 1304; the fifth bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition four at the position given by the byte index 1305; the sixth bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition five at the position given by the byte index 1306; the seventh bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition six at the position given by the byte index 1307; and the eighth bit of each of the eight bytes in sequential order is copied to form a new byte that is added to zero-based indexed partition seven at the position given by the byte index 1308 with a continuation on FIG. 12.

[0117] FIG. 14 shows a continuation of the flowchart depicted in FIG. 12 designation B, where a partition's index that is from zero to seven inclusively 1401 is input to a parallelized encrypter 1402 with a continuation on FIG. 15. There are continuations from the flowchart depicted in FIG. 15 designation A, where the decryption parameters associated with each encrypted partition in partition order from zero to seven are output 1403. The encrypted data partitions, in order from partition zero to seven, are output to form encrypted data (ciphertext) 1404, and the GEE encryption process is done.

[0118] FIG. 15 shows a continuation of the flowchart depicted in FIG. 14 designation A, where the partition of transformed bytes associated with the partition's index is retrieved and input to the encrypter 1501; the encryption parameters associated with the partition's index are retrieved, and input to the encrypter 1502; and the encrypter, governed by the encryption parameters, encrypts the partition of transformed bytes creating (i) an encrypted partition associated with the partition's index and (ii) the decryption parameters necessary to decrypt the encrypted partition and also associated with the partition's index 1503 with a continuation on FIG. 14.

[0119] FIG. 16 shows a flowchart of the encrypted data decryption process starting, where the decryption parameters for each encrypted partition are retrieved 1601. Each encrypted partition length is calculated, considering appropriate decryption parameters, and associated with each encrypted partition 1602. The encrypted data is retrieved and partitioned successively into eight encrypted partitions according to each encrypted partition's length 1603 with a continuation on FIG. 17.

[0120] FIG. 17 shows a flowchart that continues from FIG. 16 designation A, where an encrypted partition's index, that is from zero to seven inclusively 1701, is input to a parallelized decrypter 1702 with a continuation on FIG. 18. There are continuations from the flowchart depicted in FIG. 18 designation A, where the resulting decrypted data is in eight equal length decrypted partitions 1703 with a continuation on FIG. 19.

[0121] FIG. 18 shows a flowchart that continues from FIG. 17 designation A, where the decryption parameters associated with the encrypted partition's index are retrieved, and input to the decrypter 1801 and the encrypted partition associated with the encrypted partition index is retrieved and input to the decrypter 1802. The decrypter, governed by the decryption parameters, decrypts the encrypted partition to a zero-based indexed decrypted partition where the decrypted partition's index is equal to the encrypted partition's index 1803 with a continuation on FIG. 17.

[0122] FIG. 19 shows a flowchart that continues from FIG. 17 designation B, where a byte index that ranges from zero to a decrypted partition's length minus one inclusively and a byte from each of the eight decrypted partitions, in order of the partitions, at the byte index in each decrypted partition 1901 are input to a parallelized reverse transform 1902 with a continuation on FIG. 20. There are continuations from the flowchart depicted in FIG. 20 designation A that result in an array of padded data 1903 with a continuation on FIG. 21.

[0123] FIG. 20 shows a flowchart that continues from FIG. 19 designation A, where the first bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to a zero-based indexed array at the array index that is equal to the byte index multiplied by eight 2001; the second bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus one 2002; the third bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus two 2003; the fourth bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus three 2004; the fifth bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus four 2005; the sixth bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus five 2006; the seventh bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus six 2007; and the eighth bit of each of the eight bytes, in sequential order, is copied to form a new byte that is added to the array at the array index that is equal to the byte index multiplied by eight, plus seven 2008 with a continuation on FIG. 19.

[0124] FIG. 21 shows a flowchart that continues from FIG. 19 designation B, where the first byte is read from the padded data array, which is the data padding length 2101. The array is output, starting at the array index that is equal to the data padding length, to form plaintext 2102, and the GEE decryption process is done.

[0125] FIG. 22 depicts an embodiment of the digital signature creation process, where input data 2201 is padded 2202; padded data is transformed and partitioned 2203; each partition 2204-2211 is hashed and signed by a digital signature algorithm 2220-2227 using its digital signature parameters 2212-2219 thereby creating a digital signature for each partition; and each partition's digital signature is output 2228-2235, where the method of the invention may be implemented according to a preferred embodiment.

[0126] FIG. 23 depicts an embodiment of the digital signature verification process, where data 2301 is padded 2302; padded data is transformed and partitioned 2303; each partition 2304-2311 is hashed and signed by a digital signature algorithm 2320-2327 using its digital signature parameters 2312-2319, thereby creating a digital signature for each partition; each partition's digital signature is compared by its digital signature algorithm 2320-2327 verifier function to the original digital signature 2328-2335; and each result of the verifier function is ANDed together 2336 to verify that all partition digital signatures match the original digital signatures or indicate a failure to match 2337, where the method of the invention may be implemented according to a preferred embodiment.

[0127] FIG. 24 shows a graph of Security Level bits versus RSA Key sizes in bits for various Key sizes, for current RSA encryption and GEE with RSA encryption and a Super Key 2401.

[0128] FIG. 25 shows a graph of Security Level bits versus AES Key sizes in bits for various Key sizes, for current AES encryption and GEE with AES encryption and a Super Key 2501.