ES2613881B1 - HYBRID METHOD OF ENCRYPTING AND DEFRYING ELECTRONIC DOCUMENTS - Google Patents

Abstract

Hybrid method of encryption and decryption of electronic documents. # A key is generated with a random number generation algorithm (20); The document is encrypted using the key and a symmetric algorithm (31); The document is decrypted and its hash is obtained by comparing it with the first hash; if the product to be encrypted asymmetrically is larger than the public key, it is divided into whole blocks of bytes; the symmetric key or blocks are encrypted with an asymmetric algorithm (32) and one or more public keys; An application identifier is tagged to be encapsulated; the information to reverse the process is labeled and encapsulated in the encrypted document; the application identifier is checked; encapsulated information is extracted; the symmetric key or its blocks are decrypted with the private key pair; the blocks are united; the document is decrypted with the symmetric key.

Description

HYBRID METHOD OF ENCRYPTING AND DEFRYING ELECTRONIC DOCUMENTS

SECTOR OF THE TECHNIQUE

The present invention belongs to the IT security department. The present invention relates to a new method that makes hybrid encryption without limit of the number or size of the asymmetric keys used possible, and develops new procedures that are improvements of the current technique making it possible to: associate the processed electronic documents with the computer applications that process them; automatically generate symmetric keys with no size limit; Perform quality control of encryption by obtaining and comparing hash fingerprints; include and encapsulate in the encrypted electronic document all the information

cryptographic necessary to reverse the encryption process; securely encrypt the encrypted electronic document for online submission; use public keys that are not subject to limited periods of validity, but are associated with private keys stored in cryptographic hardware tokens of PKI systems.

BACKGROUND OF THE INVENTION

There is extensive documentation describing hybrid encryption systems, however all of them suffer from important limitations that this invention definitely resolves. The limitations are:

1.-In asymmetric cryptography the document to be encrypted cannot be larger than the public key pair to be used, in the case of this invention the document to be encrypted asymmetrically is the symmetric key. If a symmetric key is encrypted by an asymmetric one, the resulting product is of such size that it can no longer be re-encrypted by other asymmetric keys, unless the symmetric key is of such a short length that it cannot be cryptographically safe. The limitation of the current technique is evident when it is desired to encrypt with several public keys a symmetric key of a size that can be considered cryptographically secure. For example, a 256-bit symmetric key when encrypted

With a 2048-bit public key, it generates an encrypted symmetric key of 256 bytes (1 byte = 8-bit), that is 2048 bits. If the public key were 1024 bits and the symmetric one was 128 bits, an encrypted key of 128 bytes would be obtained, that is 1024 bits. Therefore, the resulting encrypted product can no longer be re-encrypted with keys of similar length. There are numerous environments in which the requirement of multiple operators is necessary, for example to control access to highly confidential electronic documents, in which the presence of two or more authorized persons is required. 2.-Another of the limitations presented by the current state of the art is also derived from the size limitation. Although it is documented in Patent CN102404120 (A) the automatic obtaining of symmetric keys by means of random number generation algorithms, these algorithms are specifically restricted to 32 bits, a size considered cryptographically as insecure. It is of great interest the possibility of automatically obtaining, through the use of random number generation algorithms, symmetric keys without size limitation, since since it is a hybrid encryption it is not necessary for the user to know the symmetric encryption key used to encrypt the document, in this way the protection of the documents can be carried out without human intervention. 3.-A new limitation of the current hybrid encryption systems is that they are only capable of encapsulating a single encrypted symmetric key, there is no procedure that allows encapsulating products encrypted by multiple asymmetric keys, or adding other information necessary to reverse this process Encryption When encapsulating the encryption bytes exclusively, the information must always be the same length, which determines the encryption process itself. 4.-Another of the limitations presented by the current technique is that it only offers two modes of use to access a public key, each of them with significant functional deficiencies:

a) Pretty Good Privacy (PGP). This program allows the generation of a public and private key pair, without the public key having to be associated with an electronic certificate. The problem is that the system is not compatible with current cryptographic hardware token. This presupposes a significant functional lack since only these tokens guarantee that the private key is inaccessible and iduplicable.

b) Public Key Infrastructures (PKI). Although this system is compatible with almost all cryptographic hardware tokens, it requires the issuance of the x509v3 electronic certificate, which poses a serious functional problem. International legislation on electronic certificates and the technical standards related to them, from RFC 2459 to RFC 5280 among others, determine the obligation to establish a period of validity, in fact the certificate holder usually signs a document committing to cease to use the private key from the moment the certificate expires. In an environment where the private key is necessary to be able to access the information over time, the problem has an extremely serious scope.

In both cases, each public key is stored in a single container, which presupposes a limitation in automated processes by having to handle as many containers as public keys intervene.

5.-A lack of encryption processes is the quality control of encryption, which despite its importance is virtually non-existent. It is essential to ensure the recovery of the document without losing its essence while maintaining its complete integrity with respect to the original. There are numerous factors that can cause the corruption of a document when it is encrypted, from an error in coding, to a fortuitous hardware failure. Many of these failures are undetectable at the time of encryption, they emerge when you want to recover the electronic document. 6.-Another lack is the transfer of encrypted electronic documents through the Internet, the technique of encoding them previously to Base 64 is generally used, but this coding although highly reliable also presents important deficiencies, as recognized by the international recommendation RFC 1521 of the international organization Internet Engineering Task Force (lETF), which in its section

7.1 .1., Indicates that maximum attention should be given to multibyte characters (MBCS), eg Chinese characters, or Chinese Kanji, which among many other languages cannot be represented by 8 bits, invariably require 16 bits . And it is left for future revisions to solve this problem. 7.-Another lack of encryption processes is that the application used and the documents processed by it are not closely associated. In high security contexts it is essential to have a control of the computer applications that can be used to access the information.

An extensive study on existing patents has been carried out. None of them describe the methods claimed in this invention. And some of those analyzed only confirm the limitations of the state of the art. Specifically:

The publication "Moderne Verfahren der Kryptographie" ("Modern Cryptography Procedures") Beutelspacher, Schwenk, Wolfenstetter, 3. Edition, 1999, Vieweg Verlag, contains a detailed description of the public key cryptographic procedures.

The RSA cryptographic system described in U.S. Patent No. 4,405,829 issued to Rivest et al. Describes an example of a public key cryptographic system methodology.

Patent CN102404120 (A) -Encryption method and encryption system for electronic documents That includes a module for random number generation, which are used to symmetrically encrypt an electronic document; The symmetric key is encrypted with a public key obtained from an electronic certificate, the only possible procedure according to the description made in the patent; edit the electronic document and include the encrypted symmetric key, without any specific order or structure. Claim 1 expressly limits the algorithm of random number generation to the size of 32 bits, that is to say a symmetric 4-byte key, something that is critically considered a low security encryption today. It is clear that the authors at the time of writing were aware of the problem of the length of keys that symmetric cryptography has, and failed to resolve this limitation.

. EXPLANATION OF THE INVENTION

In order to achieve the objectives and avoid the inconveniences mentioned in the previous sections, this invention develops the following procedures:

1.-The limitation of the size of the symmetric key with respect to the public key, and the limitation of using multiple public keys in a layered encryption, is resolved by the procedure of calculating before each encryption process the size of the product to be encrypted asymmetrically and, if it is larger than the asymmetric key, the product to be encrypted is divided into whole blocks of bytes 0, even, as required, those blocks can be subdivided so that the product to be encrypted is always smaller that the public key to be used, there is no limitation of length or number of keys to be used. To reverse the process, each block is first decrypted in the reverse order of encryption, and using the private key pair associated with the public key that was used to encrypt; once each block group has been deciphered, they are joined in the reverse order in which they were subdivided or divided until the symmetric key was obtained. All programming languages have the ability to edit, divide and subdivide whole blocks of bytes with a symmetric key, an asymmetric encryption algorithm and the same algorithm for decryption are used for asymmetric encryption, there are numerous free-use algorithms, e.g. eg RSA, EIGamal, DSA, etc., extensively documented on the Internet; 2.-Once the size limitation of the symmetric key is resolved, this invention presents the novelty of automatically generating, using a random number generation algorithm, a symmetric key without size limitation; There are multiple algorithms that allow secure keys to be obtained, for example of a size equal to or greater than 128 bits, extensively documented on the Internet p. ex.

Blum Blum Shub, Fortuna, or Mersenne twister, in addition to almost all cryptographic hardware tokens integrate a random number generation function that can also be used; 3.-In order to reverse the sophisticated encryption process of this invention, identification tags are used that make it possible to structure the information necessary to decrypt the electronic document, and act as data separators; The set of information and labels forms one or more data containers that are encapsulated in the body of the encrypted electronic document. Informational contents are associated with identifying tags, and you can even include tags that have no associated informational content, eg start and end of encapsulation. This procedure allows to develop a process logic that not only treats each information independently, but also converts the labels into logical separators, which allow encapsulating the information in any part of the encrypted document and subsequently extracting the exact bytes of the encapsulated information. This procedure is extremely versatile, it has no limitation as to the format, length, number, or identification code of the labels, the structure considered necessary according to the type of encryption to be performed is implemented in a computer logic, being of this way capable of automating the generation of data containers and their encapsulation; the information being structured can be consulted and the necessary data used to easily reverse the cryptographic process carried out; All programming languages have the ability to edit documents, implement information labeling logic, create data containers and encapsulate them. 4.-This invention defines a new procedure that stores the bytes of a public key in a structured information container, together with the identifier that it shares with its private key pair. For this purpose, a procedure has been developed that, starting from the usual system for preparing an x509v3 certificate, the process is interrupted in a previous step, specifically at the time of creation of the file in PKCS # 10 format, also called self-signed or petition certificate; in that step the private key has already been generated, and is contained in a cryptographic hardware token or in a software keystore in which the private key is associated with an identifier that it shares with the public key; This PKCS # 10 file is edited and its information is loaded into a structured information container, eg an XML, which allows saving at least: [KEY] bytes of the public key; [1 D] identifier that you share with your private key pair; You can also store other data such as: [TYPE] type of key; [SIZE] key size in Bits. A peculiarity of the cryptographic information of the PKCS # 10 file is that it has not yet undergone a period of validity, therefore, it can be used indefinitely. Almost all programming languages have the ability to create structured information containers such as XML, and can use cryptosystems that include this functionality, are free to use and are widely documented on the Internet such as Open SSL or Bouncy Castell; 5.-This method incorporates an encryption quality control, based on the generation and comparison of hash summaries. Using a digestion algorithm that is applied to the original electronic document, a first hash is obtained that can be labeled and encapsulated in the body of the encrypted document, after each decryption a hash of the decrypted document is obtained, which is compared with the first hash to determine its integrity; There are various free-use hash digest or digest algorithms widely documented on the Internet, e.g. ex. SHA1, SHA256, among others, 6.-A conversion table has been created that contains all the characters recognized in a standard way by Base64 encoding, this table also contains characters not recognized in Base64 having included equivalences that are characterized by being 16 bits; This table allows a secure coding that guarantees the transmission of the encrypted and encapsulated document over the Internet without the risk of being corrupted; the procedure reads all the characters contained in the encrypted and encapsulated electronic document, if any of the characters is not included in the conversion table, the document will not be encoded thus preventing corruption, and if all the characters are recognized even if any of them does not correspond to the Base64 standard, it is possible to encode it with the 16-bit equivalence implemented in the table. All programming languages can implement this procedure without presupposing any relevant challenge. 7.-A procedure has been developed whereby the computer application used to process the document has an identifier or use key, each document processed by this application incorporates the encrypted identifier or its hash in a data container label which is encapsulated in the encrypted electronic document. This identifier or usage code intimately associates the processed document with a certain licensed application, which in turn can be installed on n computer equipment that makes up an infrastructure associated by that common element, this identifier can be determined at the will of the managing administrator the infrastructure, or by the manufacturer that markets it, or be automatically generated from another value shared by all computer equipment, eg organization name, IP reason, etc. there is no other limitation than to select an identifier that is univocal, and there is no restriction to store the identifier, which can be recorded in a memory location of the equipment in which the application is installed, in an electronic file, in the own application code, etc. There is no other limitation than selecting a specific location. The procedure contemplates the possibility that the encrypted identifier or hash are already processed and stored, so the application does not have to carry out the transformation every time, with the consequent process savings. In any case, the hash is obtained by applying a digestion algorithm to the identifier, and for the encryption of the identifier a symmetric or asymmetric encryption algorithm can be used and it is clear that the only limitation is that they must always be the same. Prior to the decryption process, the computer application determines if the application identifier is associated with the identifier included in the encrypted document, for this purpose it edits the data container and obtains the label and information

label and information associated with the identifier; if the identifier is encrypted, it must be decrypted using the same key case if it is symmetric, or private key associated with the public pair used to encrypt, if it is asymmetric encryption, always using the same algorithm that encrypted them, we proceed to compare the identifier decrypted with the application identifier; if it is the hash of the identifier, it will apply a digestion algorithm on the identifier of the application, and compare the hash obtained with the hash labeled in the data container of the encrypted document. Making these comparisons does not presuppose any challenge, and follows the

10 same cryptographic processes as previously described. 8.-To encrypt the document uses a symmetric key without size limitation and a symmetric algorithm, there are numerous free-use symmetric encryption algorithms, widely documented on the Internet, its use does not presuppose any challenge, eg CAST, IDEA, TripleDES, AES, etc; and cryptosystems that facilitate its use as Open

15 SSL or Bouncy Castell; to decipher the same symmetric key and the symmetric algorithm used to encrypt is used.

BRIEF DESCRIPTION OF THE DRAWINGS

To complement the description that is being made and in order to help a better understanding of the characteristics of the invention, a set of drawings is attached as an integral part of said description, in which the following has been represented:

25 Figure 1 illustrates a symmetric encryption scheme. Figure 2 illustrates an asymmetric encryption scheme. Figure 3 illustrates a random number generator scheme, according to the invention patent Application Number: P200702299. Figure 4 illustrates a data encapsulation scheme with separators.

PREFERRED EMBODIMENT OF THE INVENTION

A first preferred embodiment of the system described herein essentially comprises the following elements:

a) A computer terminal, which has a storage memory of

non volatile data (1). A PKI cryptographic token, also known as the HSM electronic signature device (hardware security module (5), has been connected to this terminal with a USB connector that assembles a cryptographic processor from the manufacturer ST Microelectronics. In the preferred application example a HP Pavilion model computer with Intel® Atom ™ 2 Z8300 processor, and with Windows 8 operating system, with 500 Gb SATA hard drive.

The storage unit (1) contains a PKCS # 10 file (2) with the public key (7) labeled with an identifier (19) that is shared with the private key (6); an API PKCS # 11 (16) of the manufacturer ST Microelectronics; an electronic document (8); an XML containing the identifier (29) of the user program (4) entered by the user himself; a user program (4); a cryptosystem (3), Bouncy Castle, which offers a wide collection of APIs that contain the main algorithms for symmetric (31) and asymmetric (32) cryptographic processes, and even implements the ability to make calls according to the PKCS # 11 standard ( 16), read the content of X509 electronic certificates, read PKCS # 10 (2) files, and store software according to PKCS # 15 standard that contain a private key, and it also has algorithms for random generation of numbers (20) equal to or greater than 128 bits It also has digestion algorithms (25) for obtaining hash. It has a version for Java.

b) A user program (4). An application has been developed in Java. This software contains a user interface and all the required logic:

•

Interface that allows the user to navigate through the storage unit (1), and select an electronic document regardless of its status, original (8) or encrypted (12), or encapsulated 15).

•

Browse the storage unit (1) and select a PKCS # 10 file (2).

•

Make calls to the cryptosystem (3) for all cryptographic processes contemplated in this invention, including calls to the PKCS # 11 library (16) to access the cryptographic token (5)

•

Ability to create, feed and query a conversion table (34) that has at least two fields: character field and equivalence field up to 16 bits. This table (34) is fed with all the characters that are recognized as standard by Base 64 encoding, if they have added

multibyte characters (MBCS), which are not recognized by this Base 64 encoding

•

Ability to edit, read and count the bytes that make up a symmetric key and an asymmetric key. Including the logic necessary to assess, according to the encryption process required on each occasion, if the bytes that are to be encrypted asymmetrically have a size larger than the public key that you want to use, determining in each case whether or not to divide into blocks the product to be encrypted to obtain a size smaller than the public key. and ability to reverse the block division operation performed. This is an elementary process, available in any commonly used programming language.

•

Enter a PIN (10) and a symmetric key (9)

•

Ability to compare several hash bytes and determine if they are identical or different.

•

Edit an encrypted electronic document (12) and enter the data container

(21) that contains the information of the cryptographic processes carried out, and that have been labeled (13) according to the logic defined in this invention: 1.-each informative content has is associated with an identification tag (13), and 2.-there may be tags (13) that do not have informative content. The following label structure (26) has been developed for this example of practical application:

[START]

[H] Hash of the original document

[O] number of operator pairs [01]: identifier (19) of operator 1 of pair i (i <= O) (01 bytes): bytes of the public key (7) of operator 1 [02]: identifier (19) of operator 2 of pair i (i <= O) (02 bytes): bytes of the public key (7) of operator 2

[P] (4-byte integer): number of 64-byte parts of encryption done with operator 1

[T] (4-byte integer): the size of the encryption done with operator 1 (P * Tbytes): each part of 64 bytes is encrypted with operator 2 and an encrypted part of size T is written

[To the AES

[A2) RSA

[FINISH)

The labels (13) act as information separators, while

identify each content, the set of labels and the information that

contain make up the data container (21).

•

Edit the document with the logic necessary to extract the data container (21) from the encapsulated encrypted electronic document (15), leaving the encrypted electronic document (12) free of bytes from the data container (21).

•

Create a file capable of containing structured information, the XML format (22) has been chosen. Make the corresponding call to the cryptosystem (3) to access the public key information (7) contained in a PKCS # 10 file (2), and obtain: [KEY] bytes of the public key, [ID] identifier that shares with its private key pair [TYPE] key type, [SIZE] key size in Bits. This information is stored in the XML container (22)

•

Ability to enter and read a data string containing identifier or usage key (29), which is stored in an XML file.

•

Ability to compare the bytes of two hashes, assessing whether they are identical or not.

•

Ability to compare two data strings.

c) An electronic signature device (5). It is an HSM token (harware security module), with a USB connector that assembles a cryptographic processor from ST Microelectronics. This token has a random number generator (20) validated by the NIST, capable of producing numbers of a size equal to or greater than 128 bits, and a secure container of cryptographic keys, which stores the private key pair (6) associated with its public key pair (7) with an identifier (19) that both keys share. It also integrates symmetric (31) and asymmetric (32) cryptographic algorithms, the necessary logic and the ability to perform encryption and decryption processes without the private key (6) leaving the security container. This hardware token (5) is interoperable using the PKCS API # 11 (16) supplied by its manufacturer STMicroelectronics.

d) Two PKCS # 1 files OR (2) that in accordance with that international standard, each file contains its respective public key (7) associated with its private key pair (6) by the identifier they share (19)

e) An electronic document (8) in pdf format, which contains as the only test text uHola mundo ".

The following procedure is performed:

Encryption of the electronic document:

1. Users (17), connect their respective HSM electronic signature devices (5) to the computer terminal, each containing a private key (6) labeled with an identifier (19) that it shares with its public key pair (7); 2.-Two PKCS # 10 files (2) are available, each one containing a public key (7) labeled with an identifier (19) that it shares with its private key pair (6), it is also possible to use a electronic certificate according to X509 standard;

3. Using the user program (4), the electronic document (8) to be encrypted is selected, the symmetric encryption algorithm (31) AES is selected, a symmetric key (9) of 256 bit size is entered, specify the identifiers

(19) "test1" and uprueba2 "of the public keys (7) that will be used to asymmetrically encrypt the symmetric key, specify that multilayer encryption is required, and give the order to start the process. The user program (4 ) perform the following process:

a) Read a symmetric key (9) of 256-bit size that has been entered by the user. b) Use the cryptosystem (3), so that using the symmetric key (9) and having selected the symmetric algorithm (31) AES, encrypt the electronic document (8). The cryptosystem (3) generates the encrypted electronic document

(12) c) The public keys (7) are read by selecting those whose identifier (19) corresponds to the two selected by the user. The size of each public key (2048 bits) (7) and the size of the symmetric key (256 bits) (9) are consulted, and taking into account that a multilayer encryption has been requested, it assesses the need to have to divide the symmetric key (9) in whole blocks of bytes. Confirming that the symmetric key, once encrypted, will be divided into four 64-bit blocks. d) The symmetric key (9) is encrypted with the first public key (7) indicated by the user, identifier (19) "test1". e) The encrypted symmetric key (11) is edited and divided into four blocks of 64

bits f) The four blocks (14) obtained from the division made of the key Symmetric encrypted (11) are encrypted with the second public key (7) indicated by the user, identifier (19) "test2". g) The label structure (26) is edited and each label is loaded with the information related to the cryptographic process carried out:

[START l

[H] Hash of the original document (23)

[H1] Hash (28) of the user program identifier (29) (4)

[O]: 1 (pair of operators) [01]: Test 1 (19) (01 bytes): bytes of the public key (7) of operator 1 [02]: Test2 (19)

(02 bytes): bytes of the public key (7) of operator 2

[P] 4 blocks of 64 bytes of encryption done with operator 1

(T] 256 bytes the size of the encryption done with the operator 1

(P * Tbytes). each 64-byte part is encrypted with operator 2 and an encrypted part of size T (14) is written

[A] AES

[A2] RSA [FINISH]

This set of information forms the data container (21) h) The encrypted electronic document (12) is edited, and the data container (21) is encapsulated inside

Decryption of the encrypted electronic document or:

one.

Users (17) connect their respective electronic signature devices HSM (5) to the computer terminal,

2.

The users (17) through the user program (4), enter their PIN (10) for activating the private key (6) and order the cryptosystem (3) to perform the decryption of the encrypted electronic document (12) and quality control Encryption The user program performs the following process:

a) Edit the encapsulated encrypted electronic document (15), and locate the

[START] and [END] tags. b) Having located the [START] and [END] tags, proceed to extract the

data container (21), thus obtaining the encrypted electronic document (12). e) Edit the data container (21) and obtain the public key identifiers (19), the encrypted blocks (14) and the encryption algorithms used.

3.

The cryptosystem is ordered to decrypt the encrypted blocks (14) using the signing device (5), to perform this operation in addition to transferring the encrypted blocks (14) it is provided: PIN (10) for activating the second key private (6), used when encrypting the blocks, and their key identifier "Test2" (19).

Four.

The decrypted blocks are edited and linked, thus obtaining the encrypted symmetric key (11). The cryptosystem is ordered to decrypt the encrypted symmetric key (11) using the signing device (5), to perform this operation in addition to transferring the encrypted symmetric key (11) it is provided: PIN (10) for activation of the first private key (6), used when encrypting the blocks, and its key identifier "Test1" (19). The symmetric key is obtained (9)

5.

The cryptosystem (3) is ordered to decrypt the encrypted electronic document (12), to perform this operation it is also provided in addition to the encrypted electronic document (12), the symmetric key (9) and the symmetric encryption algorithm

(31) employee. Obtaining the decrypted electronic document (33)

According to a second embodiment of the system, in addition to all the elements indicated in the first embodiment, in order to improve access to public keys, we proceed to:

1. Complement step 2 of the encryption process, with the following procedure:

a) Using the user program (4), an XML file (22) is created with the TAGs: [KEYI, [ID], [TYPE], [SIZE], and orders the cryptosystem (3) to read the data contained in two PKCS # 10 files (2). The information contained in these two PKCS # 10 files (2) is loaded into the lAGs of the XML file (22): [KEY] bytes of the public key (7), [ID] "test1" "testT identifier that you share with your private key pair (19) [TYPE] "RSA" key type [SIZE] "2048" key size in Bits.

According to a third embodiment of the system, in addition to all the elements indicated in the first embodiment, in order to guarantee the quality of the encryption, we proceed to

1. Enter a previous step (a) to Step 3 of the encryption process, with the following procedure: a) Ask the cryptosystem (3) to obtain a hash (23) of the document

original electronic (8) applying the digestion algorithm (25) SHA256.

2. Enter some previous steps (a) (b) and (e) to Step 3 e) of the encryption process, with the following procedure: a) Ask the cryptosystem (3) to use the symmetric key (9) and the

symmetric algorithm (31) AES used to encrypt original electronic document (8) decrypt the document (12).

b) Ask the cryptosystem (3) to obtain a hash (24) of the decrypted electronic document, using the same digestion algorithm (25) SHA256 that was used to obtain the first hash (23).

c) The first hash (23) obtained from the original is compared with the hash (24) obtained from the decrypted document (33). If the result is that they are identical, the encryption and decryption process is considered to have been correct. If on the contrary the hashes are different, the decrypted document

(33) is not integral.

3. If the encryption and decryption process was successful, in step 3 g) load the hash (23) in the [HI] tag

4. Enter a final step 6 to the decryption process, with the following procedure: a) The cryptosystem (3) is requested to apply, on the decrypted electronic document, the same digestion algorithm (25) SHA256 that was used to obtain the first hash (23), obtaining the hash (24).

b) The first hash (23) obtained from the original is compared with the hash (24) obtained from the decrypted document (33). If the result is that they are identical, the encryption and decryption process is considered to have been correct. If on the contrary the hashes are different, the decrypted document (33) is not integral.

According to a fourth embodiment of the system, in addition to all the elements indicated in the first embodiment, to automatically obtain a secure symmetric key, we proceed to:

1. Enter a step that replaces step 3 a) of the encryption process, with the following procedure: a) A symmetric key is automatically generated and unassisted (9)

5 using a random number generation algorithm (20) capable of generating numbers of a size equal to or greater than 128 bits. To perform this process, it uses the cryptographic capability of the hardware cryptographic token (5):

8. The user program (4) through the cryptosystem (3) orders the

10 PKCS API # 11 (16) that through a random number generation algorithm (20) obtains a random number of 256 bit size, which is used as a symmetric key (9).

According to a fifth embodiment of the system, in addition to all the elements indicated 15 in the first embodiment, to associate the user program (4) with the documents it processes, it proceeds to:

1. Enter a step prior to step 3 g) And that complements it with the following procedure · a) Read the identifier (29) of the user program (4) that is stored

20 in an XML file.

b) Using the cryptosystem (3), remove the hash (28) from the identifier (29), and include it in a label [H1] of the data container (21) that is encapsulated in the encrypted electronic document (12)

2. Enter a complementary step to Step 2. e) decryption of the document,

25 and which complements it with the following procedure: a) Read the hash (28) of the identifier (29) of the tag [H1], b) Read the identifier (29) of the user program (4) that is

stored in an XML file, and using the cryptosystem (3) take out the hash (31) of the identifier (29)

30 c) Compare the hash (28) contained in the tag, with the hash (30) obtained from identifier (29), if they are identical, the document is associated with this user program.

Claims (6)

1.-Hybrid method of encryption and decryption of electronic documents comprising the following steps: Step 1: The electronic document (8) is encrypted using a symmetric key (9) and a symmetric algorithm (31), resulting in an encrypted document (12). An asymmetric encryption algorithm (32) is selected with which to perform a multilayer asymmetric encryption of the symmetric key (9), using an asymmetric key (7) to encrypt each layer, which will result in an encrypted symmetric key (11). Step 2: The size of the symmetric key (9), the length and number of public keys (7) to be used, as well as the type of encryption required (32) are checked. When the product (9) or (11) to be encrypted asymmetrically has a size equal to or greater than the public key (7) with which you want to encrypt, that product is divided into whole blocks of bytes (14). Step 3: If the number of public keys (7) to be used requires it, the entire blocks of encrypted bytes (14) can be subdivided into other whole blocks of bytes (14) so that the size is always smaller than the public key (7) to use, this process can be replicated as many times as necessary. Step 4: For the encryption of the symmetric key (9) and I or the entire blocks of bytes (14) into which it has been divided, an asymmetric algorithm (32) and the bytes of one or more public keys (7) are used which are stored in a PKCS # 10 (2) file, or in an X509v3 electronic certificate. Step 5: A data container (21) is created that stores all the cryptographic information necessary to reverse the encryption process, this container (21) structures the information through tags (13), in addition these tags serve as information separators, by what can be included labels with that unique and exclusive purpose. There is no limit or restriction on the type of label, format, extension or quantity. Step 6: The encrypted electronic document (12) is edited, and the data container is encapsulated inside, obtaining an encapsulated encrypted electronic document (15) Step 7: For the decryption of the encapsulated encrypted electronic document (15) the data container (21) is extracted obtaining the encrypted electronic document (12). Step 8: The identifiers (19) of the public keys used, the blocks (14) or the encrypted symmetric key (11) are obtained from the data container (21), as well as all the information necessary to perform the cryptographic decryption operations . Step 9: Using the identifier (19) of the public key used to encrypt, access the private key (6), which can be contained in a cryptographic hardware token (5), or in an information container (22) which includes the key identifier (19), with the private key (6), the blocks (14) or the encrypted symmetric key (11) are decrypted, using the same asymmetric algorithm (32) to be decrypted. He used to encrypt it. Step 10: If the symmetric key (9) was divided into whole blocks of bytes (14), the decrypted blocks are joined to obtain the symmetric key (9). Step 11: Using the decrypted symmetric key (9), the encrypted document (12) is decrypted using the same symmetric algorithm (31) that was used to encrypt it. Obtaining the decrypted electronic document (33) 2. Method according to Claim 1, characterized in that in Step 4 it also comprises: Edit the PKCS # 10 file (2) and extract at least the bytes of the public key (7) and its identifier (19). Store that information in a structured information file (22), and use that file (22) to read the bytes of the public key (7) and its identifier (19) in order to perform the encryption processes. 3. Procedure according to Claim 1, characterized by performing a previous step (a) to Step 1, by performing a previous step (b) to Step 2, and a complementary step (e) to Step 11, which comprises: a) A hash (23) of the original electronic document (8) is obtained using a summary algorithm (25). b) The encrypted document (12) is decrypted with the symmetric key (9) and the symmetric algorithm (31) used to encrypt it, it is applied over the decrypted document (33) the same summary algorithm (25) used in step a), obtaining a hash (24) that compares with the first hash (23) a), if both hash are identical the decrypted electronic document (33) is integrated with respect to the original document (8). c) The same summary algorithm is applied to the decrypted document (33) (25) used in step a), obtaining a hash (24) that compares to the first hash (23) a), if both hash are identical the decrypted electronic document (33) is integral with respect to the original document (8) . 4. Method according to Claim 1, characterized in that it has a data container (34) that stores equivalences of all the characters recognized in a standard way in Base 64 and, equivalences that are not recognized in a standard way by Base 64, and the logic of equivalences recorded in that container (34) is used to perform a subsequent step (a) to Step 6, and perform a previous step (b) to Step 7, which comprises: a) A verification of the encrypted and encapsulated electronic document (15) is performed, in order to determine if any of its characters match any of the contents in the container (34), if it coincides, the document is encoded (15) using the logic of the equivalences stored in the container (34), if any character does not co-index, the coding is not performed. b) If it has been possible to encode the document, decoding is performed using the equivalence logic of the container (34) 5. Method according to Claim 1, characterized by performing a step prior to Step 1, comprising: The automatic generation of a symmetric key (9) using a random number generation algorithm (20) without size limitation. 6. Procedure according to Claim 1, characterized in that the user program (4) has a unique identifier (29), and with that identifier (29) a previous step (a) to Step 5 is performed, and a previous step ( b) to Step 8 which includes: a) Include the identifier (29) in the data container (21) that is encapsulated in the encrypted electronic document (12). It is also possible to apply a summary algorithm (25) to the identifier (29) and store the hash (28). This information will indicate whether the stored data is the identifier (29) or hash (28) of that identifier (29). b) The identifier (29) of the user program (4) that initiated the decryption process is checked, and compared with the identifier (29) stored in the data container (21), if the program of identification is not identical user (4) is not associated with the encrypted document (12). If the identifier (29) stored in the data container (21) is a hash (28), a summary algorithm (25) is applied on the identifier (29) of the user program (4) obtaining a hash (30), both hashes are compared and if they are equal, the user program (4) is associated with the encrypted electronic document (12).