CA2832057C - Method and system for generating a family of stream ciphers - Google Patents

Abstract

A method and system for generating a family of stream ciphers has several elements including an iterated transformations procedure, a bit strings generation procedure having clustering, and a padding procedure. The system may incorporate an Orange stream cipher or an ERINDALE-PLUS hashing function, and the characteristics may be parameterized. A customization of the cipher allows generating practically unlimited number of stream ciphers with different inner structures and IV parameters. A method for encryption and decryption of a message has the steps of applying a stream cipher to a key and a message to produce a ciphertext, using an iterated transformations procedure, a bit strings generation procedure, and a padding procedure, and a decipher is subsequently applied to a key and a ciphertext to produce a plaintext.

Description

METHOD AND SYSTEM FOR GENERATING A FAMILY OF STREAM CIPHERS
FIELD OF INVENTION
The present invention is related generally to data communication in various networks.
Specifically, the present invention relates to system and methods for constructing stream ciphers.
BACKGROUND OF INVENTION
Ciphers are used for encryption and decryption. Stream ciphers are cryptographic algorithms that are based on processing individual plaintext digits. Stream ciphers use transformations for generating ciphertext that are time-varying.
Ideologically stream ciphers are based on Shannon's result related to special class of ciphers that usually are referred to as Vernon's ciphers. A Vernon cipher is a cipher where the size of a key is of the size of a message and an encryption procedure is based on xor-ing bits of a message and the corresponding bits of a key. In other words, if m1m2 iris is a binary representation of a message and k1k2 ks is a binary representation of a key, then the binary representation of a ciphertext c1c2 cs is computed by ci = mi El) ki, where i = 1, s. Shannon proved that if a sequence of bits k1k2 k, is completely random and independent on a message, then a ciphertext c1c2 cs cannot be broken.
Thus, the biggest problem of any stream cipher scheme is to construct a mechanism for generating a keystream of a required size, (that is, the size of a message) based on a key of relatively small size and a message itself.
There are a lot of stream ciphers that differ from each other by a method of realization of the keystream generators. One of the main approaches for constructing a keystream generator is based on various feedback shift registers (FSR). There are linear (LFSR) and non-linear feedback shift registers. The keystream generators that are based on LFSR and non-linear FSR are quite fast and convenient for crypto analysis.

Practically all keystream generators may be presented by a finite state machine. It is a well known fact that any finite state machine at certain time repeats its internal states. This means that all generated keystreams have a period, that is, in any keystream it is possible to find repeated substreams. Presence of repeated parts of a keystream allows applying various cryptographic attacks on a cipher. The larger period of a keystream the more secure is a cipher where the keystream is applied. One of the main ways of increasing the period of a keystream is to combine the outputs of a few keystream generators into a resulting keystream.
For instance, the keystreams generated by a few linear FSR can be combined into one keystream using a Boolean function. However this may lead to applying the correlation attack on stream ciphers. The correlation attack analyzes and "catches" correlation between outputs of one "weak" keystream generator, for example, with a short period and an output of the final block that combines keystreams from the individual generators into one keystream. The correlation attack on non-linear generators was developed by Siegenthaler. Meier and Siegenthaler presented fast correlation attacks that are more efficient than the attack proposed by Siegenthaler.
Thus, there is a need in building new constructions of stream ciphers, where, firstly, new methods of generating the keystreams are applied and, secondly, any analysis of influence of any keystream on the final output becoming difficult for an adversary.
ERINDALE-PLUS is a family of polynomial based, stream hashing functions with a huge space of inner states. Changing an inner state of a function allows generating practically unlimited number of hashing functions with different inner structure and with the same speed and level of security. The ERINDALE-PLUS hashing function consists of a splitting with jumping procedure, an iterated masking procedure, a bit string forming procedure, a padding procedure and forming the final hash value procedure.
SUMMARY OF INVENTION
In one aspect the invention is a system directed at stream ciphers capable of encrypting messages based on a key, characterized in that it comprised: at least one computer; a message sent by a sender by way of the at least one computer; a stream cipher system being operable by the at least one computer for application to the message, a key and a collection of initial values to

2 produce a ciphertext, utilizing the following elements: a splitting with jumping procedure, an iterated transformation procedure, a bit strings generation procedure, a padding procedure; a stream cipher system being operable by the at least one computer for application to a ciphertext and a key to produce a plaintext.
In one more aspect the invention is a computer implemented method of a polynomial based stream cipher applied to a key and a message sent by a user from a computer, characterized in that it comprises the following steps: calculating a ciphertext utilizing the stream cipher comprises the following steps: applying to a key and the message a splitting with jumping procedure chosen from the group consisting of splitting with jumping I and splitting with jumping II to generate splitting with jumping outputs, applying an iterated transformation procedure to the splitting with jumping outputs to generate transformation outputs of various degrees and a ciphertext, said iterated transformation procedure chosen from the group consisting of iterated transformation procedure without filters, iterated transformations procedure with filters I, iterated transformations procedure with filters II, iterated transformations procedure with filters III, iterated transformation procedure with filters with switchers I and iterated transformations procedure with filters with switchers II, applying a bit strings generation procedure to the splitting with jumping outputs and outputs of the transformations of various degrees to generate bit strings outputs, said bit strings generation procedure chosen from the group consisting of forming bit strings procedure I
and forming bit strings procedure II, generating padding output by applying a padding procedure to the bit strings outputs, processing the padding outputs to complete generation of a ciphertext by applying the splitting procedure with jumping, iterated transformation procedure and the bit strings generation procedure, a stream cipher system being operable by the at least one computer for application to a key and a ciphertext to produce a plaintext.
In yet another aspect the invention is a computer system characterized in that it comprises software to program existing computer hardware to receiving a message sent by a sender, applying a stream cipher to a key and the message to produce a ciphertext output utilizing the following elements: a splitting with jumping procedure, an iterated transformation procedure and a padding procedure; said iterated transformation procedure chosen from the group consisting of iterated transformation without filters, iterated transformation with filters and iterated

3 transformation with filters with switchers, a bit generation procedure, a padding procedure;
processing a key and the ciphertext by processing functions operable to generate a plaintext. In still another aspect the invention includes a modification of the main procedures of the polynomial-based ERINDALE-PLUS hashing function; said modified ERINDALE-PLUS
hashing function is capable of generating both a ciphertext and a secure hash value fo a message.
In this respect, before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not limited in its application to the details of constructions and to to the arrangements of the components set forth in the following embodiments.
The invention is capable of other embodiments and of being practiced and carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting.
DESCRIPTION OF FIGURES
Figure 1 is an embodiment of the present invention showing a scheme of encryption without filters;
Figure 2 is an embodiment of the present invention showing a scheme of decryption without filters;
Figure 3 is an embodiment of the present invention showing a scheme of encryption with filters;
and Figure 4 is an embodiment of the present invention showing a scheme of decryption with filters.

4 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
The present invention is a family of stream ciphers involving an Orange stream cipher. The construction of the cipher can involve a few steps including splitting with jumping, iterated transformation, forming bit strings and padding procedures which generally involves representing an initial sequence of bits as a specially constructed stream of n-bit words and also as polynomials of a degree less than n, where 4 < n. < 10, The methodology of building the presented cipher combines both - block and stream constructions, The iterated transformation procedure of a degree greater than 1 is applied to the stream of polynomials generated by the splitting with jumping procedure and a new stream of transformed polynomials (n-bit words) of a degree less than n is formed. The iterated transformation allows modifying the whole stream of polynomials that are generated by the splitting with jumping procedure, and the modification may be realized many times, so that each time new streams of polynomials are formed. Iterative transformation of data is exactly the feature, which outlines the property that is natural to any block-based algorithm. On the other hand, the iterated transformation modifies the whole stream of the polynomials, not just a part (a block) of it, which makes it different from a block based construction.
The present invention involves a method of using constantly updated bit strings as keystream generators and a method of applying the keystreams (that is, the bit strings) in transformations of 4a various degrees. Furthermore, the present intention proposes various schemes of applying the bit strings as keystreams - Orange cipher with filters and Orange cipher with filters with switchers.
The iterated transformation provides multiple modification of the initial stream of polynomials generated by a splitting with jumping procedure based on a key and a message.
The iterated transformation consists of the transformations of various degrees, each of which provides the modification of the stream of polynomials ( n -bit words) generated by a transformation of a lower degree. The transformations are fast and very convenient for parallelization. A number of bit strings may be "attached" to each transformation of the iterated transformation. The bit strings reflect a "time pattern" of the generated polynomials within a stream. Embedding the bit streams (keystreams) into transformations of various degrees in a framework of a cipher with filters and a cipher with filters with switchers provides additional "disturbance" in generated streams of polynomials and creates additional obstacle in analyzing the streams in order to break a cipher. As a number of keystreams and a degree of iterated transformation may be parameterized and may be increased up to any desired level practically without reducing the speed of the cipher, this leads to increasing security of the Orange cipher without reducing its speed.
A methodology of varying speed, security and consumed memory of the presented cipher, which was named the parameterization of the cipher, is presented.
A paradigm of generating a lot of stream ciphers with different inner structure, which was named the customization of the hash function, is further presented.
The present invention may provide a few benefits over the prior art, that is any FSR based cipher. Firstly, the present invention is a new method of constructing a cipher that combines both ¨ the block and the stream paradigms. Secondly, the keystreams, a number of which is parameterized, are not combined in one final keystream (as it takes place in a prior art stream ciphers), but applied to the transformations that generate streams of polynomials of various degrees. In turn, this leads to additional modification of the generated streams of polynomials and the keystreams. Thirdly, the present invention (Orange cipher with filters with switchers) provides a construction that allows changing in time the influence of the keystreams to transformations of different degrees, so that during certain period of time a keystream is applied

5 to a transformation of one degree, during another period of time a keystream is applied to a transformation of different degree and so forth. As the number of the keystreams (bit strings) is parameterized and action of each keystream may be changed in time, this leads to additional increasing the difficulty to analyze (to trace the modification of various streams of polynomials) and break a ciphertext.
In an embodiment of the present invention a method of modification of the ERINDALE-PLUS
polynomial based hashing function is presented. In particular, this modification involves transformation of procedures of splitting with jumping, masking, bit string generation and padding. The modifications have multiple effects. Firstly, they may provide increasing security of the ERINDALE-PLUS hashing function as the involvement of bit strings in the computation of elements of transformations of various degrees making analysis and attack of the hashing function more complicated. Secondly, the modifications allow (with the use of a key) generating simultaneously a ciphertext and a secure hash value of a processed message.
Moreover, the generation of a ciphertext during the process of computing a secure hash value of a message does not reduce the speed and does not require using additional memory.
Additionally, the modifications increase the possibilities of the parameterization and customization of the ERINDALE-PLUS hashing functions.
Dedicated hardware elements, including a field-programmable gate array (FPGA), custom Application Specific Integrated Circuits (ASIC) and digital signal processors (DSP), can be used in the implementation of the present invention. A general purpose computer can also be programmed to execute the methods of the present invention.
Embodiments of the present invention may include various constructions of the stream cipher.
These are detailed below. However, a skilled reader will recognize that embodiments of the present invention may include variations of the constructions.
I. The Orange family of stream ciphers without filters In an embodiment of the present invention a family of stream ciphers involving an Orange stream cipher is presented. The construction of the presented family of ciphers does not use any keystream and consists of a few steps.

6 A. Splitting with jumping procedure In an embodiment of the present invention two procedures of splitting with jumping are presented. The presented procedures allow increase flexibility of methods of forming a stream of polynomials based on a processed message.
Splitting with jumping is a procedure of splitting a message into a collection of polynomials of certain degree. It may be noted that a few ways of realizing splitting with jumping have been used in a framework of ERINDALE-PLUS hashing function.
Let M be a message and let n be an integer such that 4 5_ n 5, 10. The parameter n plays important role in the cipher; therefore we will refer the parameter to as a degree of splitting with jumping.
For any s < t such that t 5_ IMI and s> 0 it may be possible to denote by M(s, t) a part of a message M consisting of bits starting from s-th bit to up to t-th bit of M We may refer elements M(s, t) for any s,t such that s < t and t WI to (t ¨ s + 1) - bit sequences.
For example, if M
is 1001110110000, then M(2,6) is 00111, while M(5,10) is 110110.
First describe a q-splitting for an integer 1 q n. Based on a message M the following collection of n-bits sequences (1) M(1, n), M(1 + q,n + q), M(1 + 2q,n + 2q), M(1 + 3q,n + 3q), may be formed.
In fact n-bit sequences M (1, M (1 + q,n + q), M(1 + 2q,n + 2q), M(1+ 3q,n + 3q), may be interpreted as elements of F.
It may happen that the last 1 "remaining" bits of a message M for 0 < I <n may not be enough for forming the corresponding n-bit sequence. In this case a padding sequence of will be used to extend the process of a splitting with jumping.

7 Splitting with jumping may be define as a collection (ii) M(1, n), M(1 + qi, n + q1), M(1 + q1 + q2, n + q1 + q2), M(1 + + q2 + q3, n + qi + q2 + q3), for some integer 1 5 qi n, i = 1,2, .... Denote collection (ii) by S(M, n).
Integers ql, q2, q3, may be computed by some algorithm.
In an embodiment of the present invention a few ways of computing integers 171, q2, q3, ... may be presented. It may be possible, for instance, to set q1 = q2 = q3 = === = 1 or q1= q2 = q3 = === = n.
For example, when q1 = q2 = q3 == = n a collection S(M, n) is M(1, n), M(1 + n, 2n), M(1 + 2n, 3n), ...
and the elements of the collection are not "overlapped", that is, there is no any bit in M that would be presented in two different elements of S(M, n). A splitting with jumping procedure, in which qi = q2 = q3 =-= = n will be referred to as the splitting procedure with maximum jumping, or simply ¨ splitting with maximum jumping.
In general, elements ql, q2, q3, ... will be referred to as jumping bit distances. When ql, q2, q3, ... are different it may be possible to define an algorithm, in accordance with which ql, q2, q3, ... are computed.
I. Splitting with jumping procedure I

8 In an embodiment of the present invention a splitting with jumping procedure may be defined as follows: for example, it is possible to set qi = 1 (or qi = n) for i d(*) +
2 and then calculate for i > d + 2 (iii) = int(M (i ¨ 1, i + n ¨ 1) el CU R1_2 e ED CUR7_3 ED ...
where CUR3, CURid(d*)(*)_2 are the elements of the iterated transformation of the corresponding degrees. The iterated transformation procedure is presented below. In general, any function defined on collection of elements (iv) M(i ¨ 1, i + n ¨ 1), M (i ¨ 2, i + n ¨ 2), ..., M(i ¨ d ¨ 2, i + n ¨ d 2), CURi_i , CURi_2, CU Ri_3, , CURi_d_2, CURi*_d_2, CUR CUR(di(*d) _2) or some subset of the collection can be considered.
Then it is possible to define a mapping and to obtain qi = (p(int(coi)), for i = d(*) + 2,d(*) + 3, ... .
In general, it may be possible to consider a collection of elements (v) - 1 - im, ¨ n ¨ 2 ¨ im), CU Ri_2_io,CU , CU R,di(*) -d(*)-2-id(*)) for LM, j0 ..., id(*) 0 such that i> (max{im, to, ..., too} + d(*) + 2). So a mapping cp may be defined based on an operation similar to operation (iii) involving the elements of collections (iv),

9 (v) or some subsets of the collections. Thus, in an embodiment of the present invention it is possible to consider any operation 6), which results in generating n-bit words based on the elements of collections (iv), (v) or some subsets of the collections.
In embodiments of the present invention it may be possible to change the processing speed for a message M by varying mapping cp.
2. Splitting with jumping procedure II
In an embodiment of the present invention one more method of generating qi, i = 1, ... may be presented. The method does not require using a mapping cp and therefore, in general, it is faster and simpler.
It is possible to start with a table Spl containing nj elements. In general nj 2. We denote by Spl(i) i -th element of a table Spl , i = 1, ,nj . We note that 1 5_ Spl(i) n for all i = 1, nj.
Then it may be possible to set coi = x for some 1 < x < n and i <d(*) + 1 and then compute coi for i > d(*) + 2 based on collections (iv) or (v) presented above, or some subset of the collections. In particular operation (iii) may be applied.
Next, we set q1 = Spl(coi), q2 = Spl((coi + co2)mod nj), q3 = Spl((coi + co2 + co3)mod nj), qi = Spl((coi + co2 + (03 + = = = + wi)mod nj) Varying elements of a table Split is possible to vary the number k of generated elements (ii).
For example, if all qi = 1, i = 1,..., then k = length(M) ¨ n + 1, where length(M) is a number of bits of a message M. On the other hand, if all = teng q1= n, i = 1, ..., then k , where for any y by [y] we denote the largest integer I n x y. So, in general [length(M)1 k length(M) ¨ n + 1.
I n In embodiments of the present invention, by choosing different Spl tables it may be possible to change the processing speed for a message M. The larger jumping distances presented in a table, the faster processing procedure.
It may be noted that a degree of splitting with jumping n, constructions of co that may be used in realizing methods presented in Splitting with jumping I, or Splitting with jumping II sections, mapping cp and Spl table are form initial values (IV) of a cipher. All IV
parameters should be specified before realizing any step or procedure of a cipher.
B. Iterated transformations procedure In an embodiment of the present invention a procedure of iterated transformations is presented. The presented construction of the iterated transformations allows processing simultaneously a few streams of polynomials.
It is possible to start with some notation.
Denote by L(n) an ordered collection of n integers and let L(i, n) be the i-th element of L(n), i = 1, ,n. Denote, further by Sub (L, x) such L' (n) , that L' (1, = x, and L' (i, n) =
L(i ¨ 1,n) for i = 2, ... ,n.
We denote by Sub! (L,j, x) such L' (n), that L'(j,n) = x, for some 1 j 5 n and L' (i, n) =
L(i, n) for all 1 < i n, such that i j.
We may write simply L when the number of the elements of the collection is fixed. In this case we may also write L(i) denoting the i-th element of L.
Denote by Ran(n) an ordered collection of randomly mixed integers [0,1, , n ¨
1} , so that all elements of Ran(n) are different.

Let M be a message and assume that the splitting with jumping procedure of some fixed degree 4 5_ n 10 is applied to M. Thus, a sequence M1, M2, , Mk for some k <
NMB (M), where by NMB (M) a number of bits of a message M is denoted, may be generated in the result of applying a splitting with jumping procedure of a degree n. It may be possible to remind that Mi,ti = 1, ...,k may be considered as a polynomial of degree less than n over F2, or as an n- bit word.
Let f (x), g (x) E F2[x] be irreducible polynomials of degree n. There is an isomorphism of fields F2[X] f (X) F 2n.
Denote by vf the isomorphism of F2 - vector spaces F2[4/ (f (x)) Let .5 and 13 be generators of F2[41 (f (X))* and F2[x]/ (g (x))* , respectively.
Further we may generate Lo = Rani (2n) and 170 = Ran2 (2n), so that Lo and 170 are different ordered sequences containing 2n integers, and may compute (1) CURi = m19(pf (s(ti+Lo(ti,2n))mod2nosvpg (p2+Vo(t2,2n))mod 2n) for the corresponding preliminary chosen 1 < t1 < 2n ¨ 1 and 1 < t2 < 2' ¨ 1.
Next, we may calculate L1 = Sub (Lo, int(C U Ri)), V1 = Sub (V0, int(Mi)), and compute CUR2 by (2) CUR2(mi),2nDmod 2n)ED
= M249(pf (16(int(mi)+Li (int 6)(pg(f3(int(CUR1)+V1(int(CUR1),2n))mod 2") After that we may generate L2 = Sub(Li, int(CU R2)), V2 = Sub(Vi,int(MD) and calculate (3) CUR3 = m3 evf (8(int(M2)+L2(int(M2),2n))mod 2n)ED
evg(p(int(CUR2)+V2(int(CUR2),2n))mod 2').
For any i > 3 and for L1_1 = Sub(L1_2, int(CURi_i)), = Sub(V1_2, int(Mi_i)), it may be possible to compute CUR, = meg) f(5(int(Mi-1)+Li-i(int(Mi_i),2n))mod 2n)ED
EB(pg u3(inoc(JR1_1)+vi-1(int(CURi-1),2n))mod 2n).
Denote by CUR the ordered collection of elements CURi, CUR2, , CURk.
In yet another embodiment of the present invention the calculation of elements of CUR* may be achieved through involving the elements of CUR.
First of all, it is possible to choose irreducible polynomials f* (x), g* (x) E F2 [x] of degree n.
In general, f* (x), g* (x) are different from f (x), g(x) that were used during calculation of the elements of CUR. Then an isomorphism of fields F2 [X]if* (X) Fn may be considered. Denote by (pi- the isomorphism of F2 - vector spaces F2 [x]/ (f* (x)) ---) F.
Then two generators 6* and 16* of F2 [X]/(f *(X))* and F2 [4/ (g*(x))* , respectively, may be picked. The generators may be different from 6 and (I that were used during the calculation of the elements of CUR.

Agreement about generators In an embodiment of the present invention an agreement in accordance with which we will keep using variables 6 and f in expressions for CUR, CUR, ... using symbols cpf* and cp.g* for denoting the corresponding isomorphisms may be presented. It is possible to stress that using irreducible polynomials f* (x), g* (x) E F2 [x] of degree n, which in general are different from polynomials f (x), g(x) , generators 6* and /3* of F2[41 (f* (x))* and F2 [x]
/ (g* (x))* , correspondingly, may also be different from 6 and )3. The agreement simplifies expressions for iterated transformations of higher degrees, as there will be no need to use extra (upper or lower) indices for 6 and 13 Continuing construction of elements of an iterated transformation of a higher degree, it may be possible to prepare L*0 = Ran3 (2n) different from Lo and Vo and then may compute CUR; = CU Riev f* (o (t1-1-L(tI,2n))mod 2n)(130 g* (t; +L0(q,27'))mod 2n) for the corresponding preliminary chosen 1 < ti* < 2 ¨ 1 and 1 < t2* < 2' ¨ 1 and for Lo that was used for the calculation of CURi. Then we may compute L*1 = Sub(L*0, int(CU R)) and calculate CUR; = CU R29 r(a(int(CUR1)+4(int(CUR1),2n))mod2n)ED
eq)9*(f3(int(CURI)+Li(int(CUR),2n))mod 2n).
It may be noted again that we use L1 for computing CUR, it is the same L1 that was used when we computed CUR2, thus, L1 is used during calculations of both CUR; and CUR2.
Next, we may form 14 = Sub(1,1, int(CU R)) and compute CUR; = CU R3ED(io (s(int(CUR2)+172(int(CUR2),2n))mod2n)ED
eva.(p(int(CUR)+L2(int(CUR),211))mod 2n).
Once again, L3 is the same collection that was used for calculating CUR3.
For any i > 3 and for 14_1 = Sub(1.4_2, int(CU Ri* _1)) we have (4) CURT = CU REEDvr(o(int(CURi_i)+14_1(int(CURi_i),2n))mod 2n)19 ovg*03(int(CUR;_1)+Li_1(int(CUK_i),24))mod 2n).
An ordered collection L1._1 is also may be used for calculating CURL.
The same approach of computing elements (4') CURd(, *) CURd(' *) CURd(*) for any d> 1 may be applied; it is just necessary to generate different Ran(2n), based on which the computation may be started, and to choose the corresponding values tid(*), tc:(*).
For any new d > 1 it may be also possible to pick different pairs of irreducible polynomials fd(*)(x), gd(*) (x) from F2 [x] , for which the isomorphisms cp d(s) and (p d(*) of the corresponding fields will be considered. In particular, all irreducible polynomials f* (x), f d(*) (x) may be the same as f (x) and all irreducible polynomials g*
(x), ,9d(*) (x) may be the same as g(x), however in general they all may be different. By analogy, generators of the corresponding cyclic groups may be the same as 5 and generators )6*, may be the same as /3, though, in general they all may be different.
Elements (4') will be referred to as the elements of a transformation of degree d and the procedure of generating the elements of ordered collections CUR, , CUR(*) for d > 1 will be referred to as the iterated transformations procedure of a degree d, or iterated masking procedure of a degree d. We may also refer the procedure to as an iterated transformation of a degree d.
We may refer to d as a degree of iterated transformation, or a degree of iterated masking.
It may be noted that in accordance with the Agreement about generators presented above notations 5 and may be used for different generators in expressions for transformations of different degrees. For calculating, say CUR*) for any d > 2, i > 1 we may use two collections of integers Ldi (;) and Ldi (*)-1. The collection Ldi (*2 may be formed during the process of computing CURd(*) in the same way as collection /1:_1 was formed during the process of computing the elements of CUR*, while collection L* )_1 may be formed during the calculation of the elements of CURd(*)-1 in the same way as collection Li was formed during the calculation of the elements of CUR.
In an embodiment of the present invention collections V0, Lo, /70, L*0*, Ldo(*) may be defined as collections of any integers ai, 0 < ai < 2n _ 15 =. 1, ..., 2n.
For example, 170 may consist of, say 2n 0-s, Lo may consist of 2n elements each of which is equal to 5. On the other hand each element of the first 2n/2 elements of ro may be equal, for instance, to 2n ¨ 1 and the rest of the elements of L*0 may be equal to 3, and so forth.
C. Changing indices procedure In an embodiment of the present invention a procedure of changing indices of various elements that are used in the constructions for computing elements of CUR, CUR*, ... , CU Rd(*) , d 2 may be presented. The changing indices procedure allows constructing various types of the iterated transformations of degree greater than 1, which, in turn, increasing the possibilities for customizing a cipher.
Consider the presented above procedure of forming elements of CUR. In accordance with (1) the following expression for calculating CURi may be used CURi = mi@vi (8 (ti+Lo (t1,2n))mod 2.) (Depg (fii (t2+v0(t2,2n))mod 21) for preliminary chosen 1 5 t1 5 2n ¨ 1, 1 t2 < 2' ¨ 1 and preliminary generated and different Lo = Rani (2n) and Vo = Ran2 (2n). We note that, in general Lo and Ito may contain any, integers 0 x 2n ¨ 1 that may not necessarily be different. Then for any i > 2 and for (5) Li_i = Sub(L1_2, int(CU Ri_i)), V = Sub(V1_2, int(Mi_i)), CU R1 may be computed by (6) CU R1 =mieyf (8(int(Mi_i)+Li-i(int(Mi_112n))mod 2n)ED
evg(i)(int(CURi_1)+Vi_1(int(CURi_1),2n))mod 2n).

It may be possible to use elements M1 in (1) and Mi in (5) (the first terms on the right sides of the expressions) with indices different from 1 and i, correspondingly. It may also be possible to compute the elements of CUR, CUR*, ...,CURd(*),d > 2 using terms int(Mi_i) and int(CURi_i) with indices different from i ¨ 1, that is, it may be possible to modify the computation of CUR and CUR*, CUR**, ...,CURv(*) using, for instance, index I ¨
2, or I ¨ 3, or i ¨ 5 instead of i ¨ 1 in (3) and (4). Moreover it may be possible to change indices of various terms of expression CURi, i 2 in a way different from changing indices of various terms in expression CURt and, in turn, the changes may be different for terms in expression CURr for i 2, and so forth. The indices of elements int(CU Ri_i) and int(Mi_i) in (5) may also be changed and may be different for L and V. Furthermore, the changes of the indices for L and V
may differ from the changes applied to L*, V, L**, V** , Ld(*),Vd(*).
In an embodiment of the present invention a general scheme of changing indices of any of the three terms for elements of CUR, ... , CUR(*), d > 1 and the indices of elements involved in computations of collections L,V,L*,V*,L**,V**, ...,Ld(*),Vd(*) may be presented.
It may be important to emphasize that the indices of term Mi in (6) and indices of int(Mi_i) and int(CURi_i) in (5) and (6) cannot exceed index i . It may be possible to describe the procedure that allows changing indices of various of terms starting with elements of CUR.
It may be possible to prepare five vectors (ordered collections) ADF , ADS, ADT, ADL and ADV containing b1,b2,b3,b4 and b5, respectively, polynomials over F2 of degree less than n.
Denote by AD Fj the j-th element of the vector ADF , 1 < j < bl. In the same way the elements of vectors ADS, ADT, ADL and ADV may be specified. The vectors ADF , ADS, ADT, ADL and ADV
become initial values (IV) of the masking procedure of degree 0.
Without losing generality assume that b1 = 1, b2 = 2 and b3 = 3, b4 = 2, b5 =
3. Using the elements of ADF, ADS, ADT, ADL and ADV we may compute (7) CURi = ADFle(pf (6. (int(ADS1)+1.0(int(ADS1)1271))MOd 2n) (pg (fl(int(AD71)+Vo(int(AD71),2nD 71 mod 2) for preliminary generated L0 and 170. Next, it may be possible to compute L1(2n) =
Sub(Lo, int(AD Li)), Vi(272) = Sub(Vo, int(ADV1)), and calculate Mi(131(pf (a (int(ADs2) (8) CUR2 -Fti(int(ADs2),271))mod2n)ED
631(pg (ii,(int(ADT2)+v1(int(ADT2),2n))moci 2n).
Then again we may calculate L2(2) = Sub (Li, int(AD L2)), V2(2n) = Sub(14, int(ADV2)) and compute (9) CUR3 = m2uswpf (6(int(m1)+L2(int(mi),2n))mod 271)ED
ED (I, 9 (fl (int(ADT3)+V2(int(ADT3),2n))mod 2n).
After generating L3(27) = Sub (L2, int(CUR1)), V3(2') = Sub (V2, int (ADV3)) it may be possible to continue

(10) CUR4 = M3 e f (a (int(M2)+L3(int(M2),2n))mod 271)ED
g(p(int(CUR1)+V3(int(CUR1),271))mod 2n).
Thus, for any i > 4 and L1_1(2n) = Sub(Li_2, int(CU Ri_b4)), Vi-1(2n) = Sub(V1_2, int (Mi-b5)) it may be possible to compute

(11) CURE =
Mi_b19(pf (6(int(m i_b2),2n))mod 271) (1) (Depg Vint(CURi_b3)+Vi_1(int(CURi_b3),2n))mod 271) It may be understood that if b1 > 0 then the number of generated elements of CUR will be greater than the number of elements of S(M, n).

In an embodiment of the present invention the described above procedure of changing the indices may be applied during the computation of the elements of CUR*, , CU
Rd(*) and the corresponding collections L*, L**, , Ld(*) , d > 2. It may be just necessary to prepare vectors ADF* , ADS*, ADT* , AD L* , , AD Fv(*) , ADSv(*), ADTv(*), AD Lv(*) , containing, respectively, *
b2, b:, b5* , , U1 U2 b2d(*), U3 U4 b4d(*), b5d(*) polynomials over F2 of degree less than n and apply the described above procedure of the modification of calculation of the elements of CUR(*) for any d > 1.
Changing indices in a framework of an iterated transformation procedure of any degree will be referred to as applying procedure of changing indices to an iterated transformation, or iterated masking procedure.
D. Bit strings generating procedure In an embodiment of the present invention a few ways of bit strings generating may be presented. A few ways of generating bit strings were used in the ERINDALE-PLUS
hashing function. The presented constructions of bit strings generation give additional flexibility in choosing that or another method of forming the bit strings. Presented in an embodiment of the present invention two constructions of forming bit strings are fast and convenient for implementation in both software and hardware.
The bit strings are row matrices containing bits 0 or 1. Bit strings are associated, or related to transformations of the corresponding degrees. The number of the generated bit strings may also vary. In general it may be possible to form up to 271(d + 1), bit strings associated to collections CUR, ... , CUR(*) , d > 1.

Without losing generality it may be possible to fix some degree 4 n 5_ 10 of a splitting with jumping and denote by Sub (2n, mo) a collection of mo ?_ 1 non empty subsets Si , 2n ¨ 1) such that Si n S = 0 for all i # j, i,j = 1, , mo and U S2 U U Sin = {0,1, ..., 2n ¨
If mo = 1 then Sub(2n ,m0) is 0,1, , 2' ¨ 1). If mo = 0 then Sub(2n ,m0) is 0.
Consider Sub(2n ,m0) for some mo 1 and prepare m bit strings el, , emo of sizes 'o-m0' correspondingly. It may be noted that bit strings Ei, , smo are prepared for the elements of a collection CUR that are computed for the same n, for which Sub(2n,m0) was constructed. Then it may be possible to associate bit string el with Si, 2 with S2,..., Emo with Smo and denote by 1 (t) the t-th bit of bit string et , 1 = 1, , mo and t =
1, ..., cri. We will say that bit strings 1, , Emo are related, or associated to a collection CUR.
Next, mo ordered sets of non zero integers Ai may be prepared and by pwi the number of elements in each Ai , that is pwi = lAii may be denoted. In general pwi # 0, i = 1, , mo.
Denote by Ai(j) the] ¨th element of Ai for j = 1, , pwi and i = 1, mo. It may be remarked that, in general pwi may be greater than 2n for i = 1, , mo, though this is not necessarily.
Additionally, variables ti, I = 1, ,k may be used for denoting various positions of bit strings during updating procedure.
We will refer a bit strings generating procedure where a collection of subsets Sub (27t, mo) is involved to as a bit strings generating procedure having clustering.
1. Bit strings generating procedure I
In an embodiment of the present invention the procedure of updating the bit strings related to a collection CUR during the calculation of elements CURi, , CURk may be presented. The presented procedure is based on using specially defined mappings and this leads to constructing a wide class of methods of updating bit strings.

In an embodiment of the present invention from the very beginning some values may be stored into the bit strings. Different values may be stored into different bit strings. The values are part of the IV. In particular, all bits of all the bit strings may be set to 0.
It may be possible to start with considering mo mappings -1) where = 1, ..., mo.
It may be noted that for any CURL, i = 1, k there takes place 0 5_ int(CURi) 2 ¨ 1.
We compute CURi and assume that int(CU ROESõ for some 1 <u mo. It means that bit string ELL may be updated. It may be possible to calculate p = au(int(CURD) and set

(12) s(p) = B ED 1, where Ef) is xor-operation and B is the value of the p-th bit before updating.
As from the beginning all the bits of all bit strings were set to 0, it means that the value of B in (12) is 0.
An element CUR2 may be computed and it may be assumed, for instance, that int(CUR2)ESu, that is, we may need again update bit string eu. It may be possible to calculate p = (au(int(CUR1)) + au(int(CUR2))) mod au and set Eu(p) = B 1, where again B is the p-th value of bit string Eu.
Assume that after computing CUR3 int(CUR3)ESõ for some 1 5 v mo such that v *
u, that is bit string E v should be updated. It may be possible to increment p by av(int(CUR3)), so that p becomes equal to ((au(int(CUR1)) + au(int(CUR2))) mod o-u. + av(int(CUR3))) mod av and update bit string E, by setting v(P) = B ED 1, where again, B is a value of the p-th bit of bit string Ev before updating.
Assume that after i ¨ 1-th stage of processing CUR the value of p was r and assume that on the i -th stage of the calculation an element CU R1 is computed and int(CURDESw for some 1 < w < mo, 4 < i < k.. The new value of p may be computed by p = + aw(in.t(CURw))) mod crw and update bit string Ew by setting w(P) = B ED 1, where B is the value of the p-th bit of bit string Ew before updating.
It may be possible to continue the computation of CURi, k and the procedure of updating bit strings Ei , i = 1, ..., m0 up to the moment when the whole message is processed.
In an embodiment of the present invention the described above method of updating the bit strings related to a collection CUR may be expanded on the bit strings related to any collection CUR*, CUR**, ..., CURd(*) for any d > 2. It is necessary to form mappings ai*: , 2n ¨ 1} ¨) i = 1, ar : ..., 2n ¨ ¨) i = 1,...,m2, d(*) d(*) ai : (0,1, . , 271 ¨ 1} -4 , = 1, , md(*) for the corresponding collections of subsets Sub* (2n, m1), Sub** (2n, m2), , Sub*) (2n, md(*)), and update collections of bit strings === Ern*
ei**, Em**2, d(*) ,d(*) El Gmd(*) of sizes * *
d(*) d(*) ' ' 6md(*)' respectively, in accordance with the presented above procedure.
2. Bit strings generating procedure II
In an embodiment of the present invention one more method of updating the bit strings may be presented. In a framework of the presented method mappings ai, i = 1, , m0 may not be needed and thus, the presented method of updating bit strings may be simpler and faster.
It may be possible to start with a transformation of degree 0. Assume that a collection of subsets Sub (2n, m0), m0 1 is prepared and bit strings El, , Errio of sizes , (rmo, correspondingly, are formed. From the very beginning all the bits of all bit strings are set to 0. Then, ordered sets Ai containing, correspondingly, pwi non-zero integers may be prepared, and pointers pi may be reserved, i = 1, , mo. At last mo variables pi, ,p0' which may be used for denoting various elements of 1, , Am. obtained during a procedure presented below, may be reserved.
An element CURi may be computed and it may be assumed that int(CU eSu for some 1 u mo, that is, bit string Eu may be updated. It may be possible to calculate pit Au(int(CU Ri)), = pu mod o-u and set E(ti) = B ED 1, where Ã1) is xor-operation and B is the value of the trth bit of bit string Eu before updating and Au(int(CUR1)) is the int(CU Ri)-th element of the ordered set Au.
Next, CUR2 may be computed and it may be assumed that int(CUR2)ESu, that is, bit string Eu may be updated again. It may be possible to compute pu = Au ((int(CURi) + int(CUR2))mod pwu), t2 = (ti + pu) mod au and set e(t2) = B ED 1, where, again B is the value of the t2-th bit of bit string Eu before updating.
Next, CUR3 may be computed and assume that int(CUR3)E4 for some 1 5_ v 5_ mo such that v * u, that is, bit string Ei, may be updated. It may be possible to calculate Pp = Av(int(CUR3)), t3 = (t2 + pv) mod av and set e(t3) = B ED 1 where B is the value of the t3-th bit of bit string s before updating.
On the i-th stage of the computation an element CURL is computed and assume that int(CU Ri)eSw for some 1 w mo, that is, bit string Ew may be updated. Let the value of A, at the moment of updating be r. The new value of Pw may be calculated by pw = + int(CURD)mod pww), ti may be calculated in accordance with ti = (ti_i + pw) mod aw and bit string Ew may be updated by E(t1) = B 02) 1, where B is the ti- th bit of bit string evi, before the updating.
The procedure of updating all bit strings Ei , i = 1, ... ,7710 may be continued up to the moment when the calculation of the last element of a collection CUR is completed.
In an embodiment of the present invention the presented above method of forming the bit strings related to a collection CUR may be expanded on the bit strings related to collections CUR*, ... , CU Rd(*) for any d > 2. It may be necessary to build collections Sub* (2n, in1), , Sub*) (2n, ma(*)), of not empty subsets, form ordered sets of non-zero integers AI, Pw: = (A1 = 1, , mi, mi 1, Pwr = I7*,I = , m2, m2 1, Ac:(*) pw id(*) = lAdj(*)I, = ,md(*),md(*) > 1 and to update bit strings Em*

d(*) d(*) El ' "= ' emd(.) of sizes l% *
d(*) d(*) a = Crm ' ' ' correspondingly, in accordance with the presented above procedure.
In an embodiment of the present invention collections containing up to 2n bit strings of different sizes may be prepared for each collection (12') CUR,CUR*,...,CURd(*),d > 2 and the bit strings may be updated during the computation of the elements of collections (12') either in accordance with the method presenting in sections "Bit strings generating procedure I"
or "Bit strings generating procedure II" of the Invention.
E. Encryption without filters In an embodiment of the present invention a method of computing a ciphertext for a message M and a key K without using filters may be presented. The presented method of generating a ciphertext for a message M does not involve bit strings for computing elements of transformations of various degrees.
1. Choosing the size of a key In an embodiment of the present invention, depending on a chosen n, it may be recommended to apply the following sizes of a key during the process of generating a ciphertext for a message M. If n = 4 then the size of a key may be at least 64 bits, if n = 5 then the size of a key may be at least 160 bits, if n = 6 then the size of a key may be at least 384 bits, if n = 7 then the size of a key may be at least 896 bits, if n = 8 then the size of a key may be at least 2048 bits, if n = 9 then the size of a key may be at least 4608 bits, if n = 10 then the size of a key may be at least 10240 bits. The motivation of the presented above sizes of the keys will be presented below. It may be noted that the size of a key for a degree of splitting n is equal to n2n. Indeed, for n = 4 the size of a key is 4*16=64, for n = 5 the size of a key is 5*32=160, and so forth.
2. Generating a ciphertext In an embodiment of the present invention an encryption scheme without applying a keystream generated during computing a ciphertext may be presented. We will refer the encryption scheme to as an encryption without filters and an iterated transformations procedure used in a framework of the encryption scheme may be referred to as an iterated transformations procedure without filters.
An encryption procedure with applying keystreams generated during the process of forming a ciphertext will be referring to as an encryption with filters and will be presented later.
An encryption procedure may be started with applying splitting with jumping procedure, the iterated transformations procedure of a degree d > 0 and the bit strings generating procedure.
Therefore a collection of various parameters related to the procedures may be specified.
Firstly a degree n of a splitting with jumping procedure, where 4 5_ n 5_ 10 and a degree d of the iterated transformations procedure, where d > 2 may be chosen. Next, elements of collections CUR, ...,CURa(*) may be generated in accordance with the procedure described in section "Iterated transformations procedure". Before applying the iterated transformations procedure of a degree d 2, collections

(13) Lo, Vo, , Ldo(*) d (*) may be specified. It may be noted that Lo, Vo, Lo may be generated as Ran1(2n), Ran2(2n), Rand(õ)+2(2n) ; however, in general they may contain repeated integers. Besides, pairs of irreducible polynomials (13') f d(*) gd(*) along with pairs of generators (13") , 6* , ig* ad(*) pa(*) of cyclic groups F2 [x] I (f (x))* F2 [41 (g(x))* , F2 [41 (f * (x))* and F2[41 (g* (x))* , F2 [x]/ (f d(*)(x))* F2 [x] (gd(*)(x))* , correspondingly, may also be defined. The isomorphisms of vector spaces (13") F2 [x] (f (x)) --> F, F2[41 (g(x)) -4 Fe,..., F2 (f d(*) (X)) -4 FT, F2[x]/ (gd(*) (x)) ¨> FT=
may be defined as well.
If the changing indices procedure that was described in section "Changing indices procedure"
of the present Invention is applied, then vectors

(14) ADF , ADS, ADT , ADL,ADV ,...,ADFd(*),ADSd(*),ADTd(*),ADLd(*), containing, respectively,

(15) b2, b3, b4, bs, b6, , bid(*), bc21(*), b3d(*), b4d(*), b5d(*) polynomials over F2 of degree less than n may need to be specified.
In an embodiment of the present invention a bit strings generating procedure may be further applied, so it may be necessary to define a collection of parameters related to the procedure.
Firstly, collections

(16) Sub (2n, mo), Sub* (2n, mi), , Subd(*)(2n, md(*)) may be specified. Without losing generality it may be possible to consider the case when bit strings are built for all collections CUR, ... , CUR*), d > 2, though in general, the bit strings may be prepared not for all collections of polynomials CUR, ...,CURd(*),d > 2.
Then, d +1 ordered sets of non zero integers

(17) Ai, i = 0, ...,d(*) containing pwi elements, correspondingly, may also be prepared. If the bit strings are generated in accordance with the method presented in section "Bit strings generating procedure I", then additionally d + 1 mappings

(18) may be formed, i = 0, d. Eventually bit strings

(19)d(*) d(*) , emo, ..., el , emd(*) of sizes, respectively,

(20) d(*) d(*) GI, = = = = amo, =" ' associated with collections CUR, ...,CURd(*), correspondingly, may be prepared. If the initial values of bit strings (19) are different from 0 then, the values also may be specified.
In an embodiment of the present invention ordered collections of integers (13), irreducible polynomials ( 13' ) of degree n, generators ( 13" ) of the corresponding cyclic groups, isomorphisms of vector spaces (13"), collections of subsets (16), ordered sets of non-zero elements (17) and the bit strings (19) of sizes presented in (20) form initial values (IV) of a cipher. Collections (14) of polynomials over F2 of degree less than n containing number of polynomials presented in (15), correspondingly, are also the part of IV of the cipher. If the bit strings are formed in accordance with the method proposed in section "Bit strings generating procedure I", then mappings (18) are also part of IV. Initial values of the bit strings are also part of IV.
After specifying IV of the presented above procedures a procedure of forming a ciphertext may be presented.

Assume that M is a message that we wish to encrypt. We may choose a key K with the size, specified in accordance with the presented above procedure.
In an embodiment of the present invention the process of encrypting a message M using a key K may involve a splitting with jumping procedure, an iterated transformations procedure of degree d 2, a bit strings generating procedure and a padding procedure that will be presented below.
The process of encrypting a message may be split into three stages. The first stage is related to processing a key part of concatenation K II M II BS, where K and M are a key and a message, respectively, and BS is a padding sequence of bit that will be described below. The three procedures (the splitting with jumping procedure, the iterated transformations procedure of a degree d > 2 and the bit strings generating procedure) are applied to the concatenation. During the first stage collections L, V, L*, Ld(*) and bit strings (19) are updated. The first stage is completed when the last n -bit word generated by a splitting with jumping procedure and containing just bits of a key K is processed. In other words, the next n-bit word generated by a splitting with jumping procedure after the first stage of the computation contains at least one bit from a message M. It may be stressed that in the case of a splitting procedure with maximum jumping the first stage is completed when the last n-bit word of a key is processed (it is assumed that the size of a key K is chosen in accordance with the presented above scheme), so the first element of the second stage in this case would be the first n-bit word of a message M. Denote by rf the number of the last bits of a key K that are included into the first n-bit word of the second stage of the computation. It may be noted that 0 < rf <n. Denote the last rf bits of a key K by Kr f =
Thus, it may be possible to say that the second stage of the computation of a ciphertext begins with processing a subsequence of bits Krf II M of a sequence K II M. It may be important to note that the first stage of the generating a ciphertext is the preliminary one, which means that no part of a ciphertext is generated during the first stage.
Thus, the splitting with jumping procedure, the iterated masking procedure of degree d> 2 and the forming bit strings procedure are continued to be applied and the first element of the splitting with jumping, which is formed during the second stage is an n-bit word, which is a concatenation of Kr! and the first n ¨ rf bits of a message M. The second stage is completed, when the last n-bit word generated by a splitting with jumping procedure of a sequence Krf II M
is processed. In other words, the next n-bit word generated by a splitting with jumping procedure after the second stage of the computation contains at least one bit from a sequence BS, where BS
is formed from a collection of bit strings (19) in accordance with a procedure presented below.
The second stage is completed when a sequence of bits Krf U M is processed.
Denote by

(21) CUR*), CUR(*),..., CUR*) elements (that is, n-bit words) of the transformation procedure of degree d 2 generated during the second stage. Denote by rs the number of the last bits of a sequence Krf II M that are included into the first n-bit word of the third stage of the computation contains. It may be noted that 0 < rs <n. Denote the last rs bits of a sequence Krf II M by Mrs.
3. Padding procedure The third stage begins with processing a sequence of bits M, II BS, where BS
is a sequence of bits that is formed based on a collection of bit strings (19). A sequence BS is a padding sequence of bits. This means that the sequence will be processed after the procedure of processing a message M is completed.
In an embodiment of the present invention a few methods of forming a sequence BS may be presented.
Assume that all the bit strings presented in (19) have the same lengths, that is a (71 == 472 == == crnio == 4(*) 7t).,) In this case it may be possible to form BS by

(22) d(*) µ11 Ulna(*) If bit strings (19) have different lengths, assume that the bit strings may be split into two groups and the bit strings inside of each group have the same length. In this case BS
may be formed in accordance with

(23) BS

1GR1 II ZGR2, where EGRi is a result of xor-ing of all the bit strings from the first group and EGR2 is a result of xor-ing of all the bit strings from the second group.
In general, this method may be expanded into any number of the groups of the bit strings. We note also that, in general, different order of ZGRi and ZGR2 in (23) may result in forming different sequences BS. Therefore it may be possible to demand that EGRi in (23) contains the bit strings of a smaller length, while EGR2 contains the bit strings of a bigger length. This order of sequences of bits may be expanded on any number of groups and in a framework of which group the bit strings have the same length. In other words, if ng groups may be considered for a collection of bit strings (19), then nb(EGRi) 5_ nb(EGR2) nb(EGR3) 5. _5_ nb (EGRng) where nb(ZGR) is the length of the bit strings (in bits) that form a group EGRi, = 1,2, 119.
The third stage is completed when a sequence of bits Mõ 11 BS is processed. It may happen again that last rt bits of a sequence of bits BS, where 0 < rt < n cannot be processed as rt bits may not be enough to form an n-bit element of splitting with jumping.
In an embodiment of the present invention it may be stressed that during the first and the second stages of generating a ciphertext bit strings (19) are constantly updated in accordance with the applied Forming the bit strings I, or Forming the bit strings II
procedures presented above. It also may be possible to emphasize that, in general one of the presented procedures of forming the bit strings (for instance, Forming the bit strings I procedure) may be applied to a part of bit strings (19), while another procedure may be applied to remaining part of the bit strings.
Thus, both procedures of forming bit strings may be applied during the process of generating a ciphertext in a framework of a transformation of any degree. The process of updating the bit strings is continued during the third stage of the computation.
Denote by

(24)CUR CUR d(*) d(*) " CUR(*) the elements of the masking procedure of degree d 2 generated during processing a sequence Mrs II BS
p nb(EGRi))/n, for i = 1,2, ...,k. A ciphertext of a message M is a sequence of bits

(25) CUR*) II CUR2d(*) II ===II CUR*) II CUR II... II CUR*) II s1 II
LB, where s1 is an s-bit word consisting of 1, s = NBC mod 8, 0 < s <8 and NBC is a number of bits of a sequence d(*) d(*) d(*) d(*) d(*) (25') CURi II CUR2 II II CUR/ II CURTi CUR*) (25') It may be noted that part (25') of a ciphertext (25) may not be divisible by 8, that is, it may not be presented as a file. Therefore it may be necessary to add an s-bit word consisting of bits 1 to a sequence of bits (25') to make a sequence d( d(*) d( d(*) d(*) (25") CUR*) i II CUR2 II CUR*) I II CURTI ii...
iiCURT II .51 divisible by 8. At last, LB is an informational part of a ciphertext, the length of which is 2 bytes and which contains numbers rf,rs,rt and s. As 4 < n < 10 and 0 < s <8 it may be enough to use 4 bits to represent each of the numbers rf,rs,rt (and s, of course); this why the size of LB
is two bytes. The four numbers will be used during deciphering procedure.
In an embodiment of the present invention a ciphertext of a message M is a concatenation of elements of collections (21), (24) a sequence of bit s1 and LB where each element CUR(*), i =
1, ..., /, T1, ..., T1 is presented as an element of FT, that is, as an n-bit word.
The procedure of forming a ciphertext (25) may be also understood as a concatenation of those elements of the iterated masking procedure of degree d > 2 computed during processing a sequence K II M II BS that are generated during the second and the third stages of processing.
The elements of the masking procedure of a degree d > 2 that are generated during the first stage of the processing are not included into a ciphertext. It may be also possible to note that the bit strings are updated during all three stages of processing a sequence K II
M II BS, though BS
is formed based on the bit strings formed during the first and second stages of the computation. It may be emphasized that adding the concatenated elements of a collection (24) to a ciphertext is very important, as the concatenation plays a role of a padding sequence. As an encrypted message may be short (for instance, a few bytes) it may be necessary to pad it to generate a cipher of a quite large size (in general, larger than the size of a key), and as we do not know the size of a message that is going to be encrypted beforehand, all messages are padded.
3. Decryption procedure In an embodiment of the present invention a method of decrypting a ciphertext generated by the encryption procedure without filters with the use of a key and IV may be presented.
Assume that a receiver has obtained a ciphertext (25), that is, a collection of bits CUR(*) d(*) d(*) d(*) d(*) CURi CUR2 II CUR*) II CURTI. CUR(*) H s1 II LB.
A receiver knows a key K, parameters of IV of the algorithm and the algorithm itself, based on which a ciphertext (25) was generated. Consider, first, the case when a changing indices procedure is not applied to the iterated masking procedure of the corresponding degree during generation of a ciphertext. A receiver may start the decryption procedure with processing a key, that is, applying a splitting with jumping procedure, the iterated transformation procedure of a degree d and forming the bit strings procedure to a key K. In the result of the processing a key K
elements

(26) Wl, W2, === Wv CURR1,CURR2,...,CURRõ, CURR;,CURn...,CUR4, CURRid(*),CURR2d(*),...,CURRI,d(*) are generated.

It may be noted that W1, W2, are the elements of S(K II M, n), that is the elements that were generated during the splitting with jumping procedure; besides, Wv is such an element of S(K II M, n) that contains only bits from a key K. In other words, the next n-bit word generated by a splitting with jumping procedure contains at least one bit from M . Here CURRi, CURR2,...,CURRi, are the elements that were computed based on W1, W2, ..., Wi, and the corresponding collections Li and Vi,i = 1, ..., v in accordance with the transformation procedure of degree 0 presented above. Elements CURRI,CURn ...,CURRv* were computed based on CURRi, CURR2,...,CURRv and the corresponding collections Li and LI, i = 1, ..., v in accordance with the transformation procedure of a degree 1, and so forth. The notation CURRi,...,CURRid(*),i = 1, ..., v was used to emphasize the difference between the elements of iterated transformation applied to the elements Wi, i = 1, ..., v of S(K II M, n) and the elements that were generated during the second and the third stages of the encryption.
It may be possible to stress, that during processing a key K, collections

(27) L = V= L*. Ld(*) 11 ===
i = 1, ..., v are also generated in accordance with the iterated transformation procedure presented above using presented as part of IV vectors Lo, 143, , L*). For example, it may be possible to present the following computations related to collections (27) performed during processing a key K
(27') L = Sub(L,_1,CURR,), 14, = Sub(Vv_i,VVõ), L*õ = Sub(L*v_i,CURR,*), Ldv(*) = Sub (Ldv(*, CURRõd(*)).
Next, a receiver may start using a ciphertext in order to obtain a plaintext after computing all elements presented in (26) and (27). The first n-bit word of a ciphertext is CUR*). Therefore based on (26), (27) and CUR*) a receiver needs to compute the first n-bit word of a sequence Krf II M, where, again Icy is a sequence of last 0 5_ rf <n bits of a key K.
In order to obtain the n bits of Krf II M, a receiver preliminary needs to compute one by one the following elements

(28) CURd(*)-1 1, CURid(*)-2, ..., CURT.
Assume, first, that during the computation of a ciphertext no changing indices procedure has been applied.
Let's present the expression for calculation of CURid(*),d > 2. After adaptation of formula (4) presented in section "Iterated transformations" of the invention to the transformation of a degree d and using elements (26) with the corresponding notation, it is possible to write

(29) CUR*) = CURd(*)-1 ED
I. 1 d( d() d(*
ED (pf d(*) (o(int(CURR*)-1, )+L*
v (int(CURR)-1, ),2n ))mod 2n) IED
EBV.gd(*) (f3(int(CURRLvd(*))+.dv(*)-1 -(tint(CURRvd(*)),2n))mod 2n).
d( d()-1 As elements CURRvd(*)-1,CURR,d(*) and collections L*)v , L*
v are known (as they have been generated during processing a key K), it is possible to calculate CURid(*)-1

(30) CURid(*)-1 = CUR*) @
(pfd (.,c (int(cuRRd(*)-1)+Ldõ(*)(int(cuRRvd(*)-'),2n))mod 2n) ED
ED (*) V
p(int(CURRvd(*))+Lnd(*)-1(int(CURR,d(*)),2n))mod 2n) EBV gd(*)(p - .
Having computed CURid(*)-1 is possible to calculate CURid(*)-2. Indeed, as

(31) CURd(*)-1 = CURd(*)-2 ED

ED (pf d(*)_ 1 (8(int(CURRvvd(*)-i(int(CURR, ),2 ))mod 2n) ED
riN
w _ d(*)-1. ( pn(int(CURR,d(*)-1)+Ldv(*)-2(int(CURR,d(*)-1),2n))mod 2n) av g it is possible to get

(32) CURid(*)-2 = CURd(*)-1 (8 (int(CU
(Pfd()- R12,,v(*)-1 (int(CU RRvd(*)-2),2n))mod 2n) ED
*1 V9d()-1 (0 (int(CURR,d(*)-1)+ Ldp(*)-2 (int(CURR,d(*)-1),21))mod 2n EB* p Continuing the process of calculation of elements CURid(*)-3,...,CUR1 it is possible to compute the first n-bit word of Krf II M that we denote by M1. Indeed, assume that CURi is calculated, that is,

(33) CURi ED (pf (8 (int(WI)+4 (int(Wv),2nDmod 2n)ED
ED(pg (int(CUR Rv)+Vv(int(CU RRv),271))mod 2').
As elements wv, CU RR, and collections L, 14, have been calculated during processing a key K, it may be possible to obtain M1 by EB(pf (s(inow0+4(int(wo,

(34) = CURi 2n))mod 2n)ED
(p 9(13 (int(CURR1v)+ i(int(CU RRv),211))mod 2n).
The gradual computation of elements

(35) CURid(*)-1, CURid(*)-2, , CURi, presented above allows performing gradual updating collections (27). Indeed, it may be possible to start with Ldv(*). Element CUR*) is known (it is the first element of a ciphertext), so it is possible to generate L; by

(36) L (+*1) = Sub (Ldv(*),int(CURf(*))).
In the same, way after gradual calculation of CURid(*)-1, CURid(*)-2, , CURD
M1 it is possible gradually computing

37 (37) L+*1) = Sub (Ldv(*)-1 , int(CURid(*)-1)), Ldv(E*1)-2 = Sub (Ldv(*)-2, int (C U R (*)-2)), L*v+T = Sub(L*õ, int(CU RI)), Lv+i = Sub (Lõ, int(CURT)), Vv+T = Sub (Võ, int(MT)).
Thus, collections (8) cl(*) d(*)-1 d(*)-2 Lv+1, Lv+1 Lv+1= , Lv+i, Vv-Fi are prepared.
In an embodiment of the present invention it may be emphasized that bit strings (19) may also be gradually updated upon obtaining element CUR*) and gradual calculation of elements CURd(*)-1, CURd(*)-2 , , CURT, MT.
Having computed elements (35) and collections (38) it may be possible to start the process of computation that leads to obtaining the second element, that is n-bit word M2 of the splitting with jumping procedure of a subsequence Krf II M of a sequence K II M II BS.
The process of obtaining element M2 may be performed in the same way as the process of computing element M1 described above. It may be possible again to start with obtaining the second n-bit words from a ciphertext, that is, element CUR*). Then noting that expression for CUR*) may be written as (39) CUR*) = CUR2d(*)-1 (i) d(*)-1 d(*) d(*)-1 n (pfd(*) (s(int(CUR, ),2 ))mod 2n) ED
(nt(CURd(*))+LcTtl(int(CURd(*)),2n)) gd(*) (fit,i v mod 2n)

38 it may be possible to get CUR2d(*)-1 by (40) CUR2d(*)-1 = CUR*) ED
6 co fd(*) (8(int(CURid(*)-1)+LZ(int(CURcil.(*)-1),2n))mod 2n) ED
+11t).-1(int(CURid(*)),2nDmod 21 .
evgd(*) (f3(int(cuRid(*)) Continuing the process of the calculation of elements CUR2d(*)-2, ..., CUR2 it may be eventually possible to obtain M2. Indeed, since (41) C U R2 t(Ali),2n))mod 2n)ED
= Al2M(Pf Wint(M1)+Lv+i(in (Bcog (pnt(cuRi)+v,+,(int(cuRi),2n))mod 2n) it may be possible to get (42) M2 = CUR26)(pf (6(int(M1)+Lv4-1(int(Mi),2n))Mod 21)ED
ED (p g(13(int (CU R1) +V V +1(int (C U Ri) ,2n))M0 d 2n).
Once again, the gradual computation of elements (43) CURd(' *) CURd(*)-1 CURd(*)-2 CUR
2 2 ) 2 , " . ' 2; M2 allows generate (44) r((*) fd(*)-1 ,d(*)-2 -v4-2, -v+2 ' I-'v+2 , === ) Lv+2, Vv+2 by computing gradually (45) Lc.,;(+ = Sub(Ld12(:)1, CUR(*)), LZ-1 = Sub(Ldv(+*-1, CUR2d(*)-1), Lc.:,(+T-2 = Sub(LC11,(:)1-2, CUR2d(*)-2),

39 4+2 = Sub (4+1, CUR`), Lv+2 = Sub (L+1, int(C U R2)), Vv+2 = Sub (17,+1, int (M2)).
It is important to note that bit strings (19) may be gradually updated upon obtaining elements (43).
Having computed elements (43) and collections (44) it may be possible to start calculating the third element M3, that is, the third n-bit word of the splitting with jumping procedure of a subsequence Ifrf II M of a sequence K II M using the same methodology used above, by means of which elements Mi. and M2 were computed. Indeed, the third n-bit word, that is, an element d( CUR*)3 may be extracted from a ciphertext (25). Then CUR*) -1 may be computed by (46) CUR3d(*)-1 = CUR(*) ED
d( d(*) d( 9 ep fd(*) (s(int(CUR*)-12 )+Lv+2(int(CUR *)-12 ),2n ))mod 2n) le EDT gd(*) ((int(CURL2d(*))+, vd(*)_i -(int(cuR2d(*)),2n))mod 2n After that elements le Li /13 , CUR3 may be gradually calculated. And eventually M3 may be obtained in accordance with M3 = CUR39(pf (8(int(A42)+4+2(int(M2),2n))MOd 2n)e 9(pg(13(int(CUR2)+Vv+2(int(CUR2),2n))mod 2n).
Collections rd(*) ,d (*)-1 ,d (*)-2 11 '-'v+3,"v+3 ,"v+3 "= Lv+3,v+3 may be gradually formed and bit strings (19) may be gradually updated.

Thus, the process of computing elements M4, M5, ... may be continued up to the moment when d( the last element CUR*)TI of a ciphertext (25) is processed.
It may be stressed that using two last bytes LB of a ciphertext, numbers rf,rs,rt and a length s of a padding sequence of bits that was added to a sequence (25') may be obtained. This why d( the last bit of CUR*) TI will be the 16 + s + 1-th bit from the end of a ciphertext (25).
In an embodiment of the present invention a procedure of retrieving a plaintext from a collection of elements M1, M2, ... obtained during the decryption procedure described above may be presented.
Assume that a collection of elements M1, M2, ... is obtained. Taking into account that a splitting with jumping procedure has been used during generating a ciphertext, it may be not possible to obtain a plaintext by (47) M1 II M2 II M3 II
as different elements M1, M2, M3, ... may be "overlapped", that is, may contain common parts of a sequence of bits consisting of a plaintext and BS. However it may be noted that if the splitting with maximum jumping procedure was applied during an encryption of a message M
and the length of a chosen key is chosen in accordance with the scheme considered in section "Choosing the size of a key" and presented above, then rf = 0 and a plaintext may be obtained by (47), though it may be still necessary to separate a plaintext and BS. It can be done naturally, as the length of BS is known (the lengths of all the bit strings are known and the method of forming BS
is also known), parameters rs and rt may be obtained from LB. Therefore in this case a plaintext is a sequence of bits (47) the first bit of which is the first bit of M1 and the last bit of a plaintext is the (length(BS) ¨ rt + 1)-th bit of sequence (47) from the end, where length(BS) is the number of bits of a sequence BS (the size of LB 16 bits is not considered, as it is an informational part of a ciphertext).
In the case, when (11, q2, q3, ... are different, a plaintext may be also extracted from (47). We may start with M1. As qi, i = 1, ... may be different from n it means that rf may be different from 0, and in this case the first bit of a plaintext begins with the rf + 1-th bit of M1. Denote the part of an n-bit word M1 starting from the rf + 1-th bit of M1 to up to the last, that is, n-th bit of Mi. by Pti. Next, in accordance with the splitting with jumping procedure presented above, qõ44 may be computed, and when the computation of M2 is completed, another portion of a plaintext may be recovered. Taking into account that the first n ¨
bits of an n-bit word M2 are "overlapped" with the last n ¨ cb+1 bits of M1, it is possible to obtain (48) Pt2 = Pti II /bq,+, (M2), where by lkiv+i(M2) we denoted the last ch,+1 bits of M2 and Pt2 denotes a part of a plaintext recovered from M1 and M2.
Then, it may be possible to calculate qv+2 and after the calculation M3 it is possible to continue the process of restoring the plaintext by concatenating Pt2 and Civ+2 last bits of M3, that is (49) Pt3 = Pt2 II
where by /bg. (M3) the last qi+i bits of M3 are denoted. It may be possible to continue the described above process of restoring a sequence of bits Icy H M II BS for any Mj, j > 3 and the corresponding by (50) Pti = Pti_i II /1/4+i_1(Mj) up to the moment when the last element of a ciphertext CUR*) is processed. The sequence of bits Ptn, that will be obtained after processing CUR*) will be, in fact, a sequence M II BS(rt), where by BS(rt) we denote a sequence BS without last rt bits. We remind that the last two bytes of a ciphertext, that is, LB is an informational part of a ciphertext and it is not processed.
After restoring a sequence M II BS(rt) it may be possible, at last, to obtain a message M.
Indeed, as the length of BS is known and parameter rt is also known, the last bit of a message M
will be the length(BS) ¨ rt + 1-th bit of a sequence M II BS(rt) from the end, where by length(BS) we denote a number of bits of a sequence BS.

It may be noted that the process of restoring a collection M II BS(rt), that is the process of gradual computation of Pti, Pt2, Pt3,...,Ptm presented above may be realized gradually upon computing elements M1, M2, M3, ..., that is, the process of decryption may also be organized as a stream process.
4. The Orange cipher with an iterated transformations procedure without filters with applying a changing indices procedure.
In an embodiment of the present invention applying a changing indices procedure in the Orange cipher without filters may be presented. Applying the changing indices procedure in the Orange cipher allows, in particular, speeding up both - software and hardware implementations of computing transformations of various degrees. On the other hand, applying the changing indices procedure making the analysis of possibilities to attack the cipher more complicated, as transformations of different degrees should be analyzed "individually" and, therefore, no general scheme of analysis will be possible to apply to all transformations.
If the changing indices procedure that was presented above is applied, then vectors (14), that is, vectors ADF,ADS,ADT,ADL,ADV,...,ADFa(*),ADSd(*),ADTd(*),ADLd(*), containing, respectively, U1, b2, b3, b4, b5, b6, bld (*) b2d(*) b3d(*) , b 4d(*) , b5d(*) polynomials of degrees less than n may be specified. When vectors (14) are specified in a framework of the encryption procedure presented above, it may be necessary to apply expressions for calculating elements of collections CUR,...,CURd(*),d> 2 in accordance with the procedure presented in "Changing indices" section of the present invention. The main steps of the encryption procedure - a key processing, the first and the second stages of the generation of a ciphertext of a message M, are not changed.
If the changing indices procedure is applied during encrypting a message, the corresponding expressions (with specified vectors (14)) should also be applied for calculating elements of collections CUR*), CURd(*)-1,...,CUR, d> 2 during decrypting a ciphertext. In particular, expressions (29-34) and (39-42) presented above may be modified and the modification depends on the specified vectors (14), while the whole process of decryption is not changed.
5. The Orange cipher with iterative constraints without filters In an embodiment of the present invention a construction of the Orange cipher with iterative constraints without filters may be presented.
a. Constant iterative constraints without filters In an embodiment of the present invention a modification of the iterated transformations procedure based on constant iterative constraints without filters may be presented.
Assume that a degree n of a splitting with jumping procedure, where 4 n < 10 and a degree d of the iterated transformations procedure, where d > 2, are specified. Next we choose d + 1 integers /ti > 0, i = 0,1, ..., d and associate the integers to the iterated masking procedures, so that a collection CUR (*) is associated with /to, CUR*) is associated with /ti CUR*) is associated with ltd.
Then we prepare d + 1 mappings (5.1) 1.'0T x FT x ...x FT) -4 FT, so that each ri is associated with CURj(*), and It, for] = 0,1, ..., d.
Further, FT is a vector and each /I is a d + 2 - place mapping.
Mappings r; will be used for modification of the procedure of computing the elements of CURi(*), j = 0,1, ..., d presented above in section "Iterated transformations procedure".
Mappings Ti will be defined for any] = 0,1, ... , d, however the procedure of the modification of the elements of CURj(*), which will be presented below, will be applied just for those CURi(*), for which It # 0, j = 0,1, ..., d. For any 0 54 5_ d if It = 0 elements of CURi(*) will be computed in accordance with the presented above iterated transformations procedure.
Assume that for some 5d+1 a d+ 2 - place mapping /I is defined and let coo, coi, , 0od4.1 be variables, that is, a function 1j(a)0,6)10 === d+1) is defined for variables coo, ..., cod+1 having values of the elements of a vector space FT. and ri (coo, coi, ,+i) E F.
We remind that by S(M, n) a collection of elements generating during a splitting with jumping procedure was denoted. We will associate a variable coo with the elements of S(M, n), a variable coi with the elements of a collection CUR (*), a variable co2 with the elements of a collection CUR1(*), and so forth. Thus, variables cod and cod+1 will be associated with the elements of a collections CUR(d-1)(*) and CURd(*), correspondingly.
In an embodiment of the present invention a number of ways of specifying the values of variables coo, cod+1 during the process of computing collections CURi(*), j= 0,1, ..., d may be presented.
For instance, it is possible to define rj(cdo, col, ..., cod+i), j= 0,1, ..., d by setting (5.2) f (*) is M, CUR,?(*) CURil(*) (f) EI) CUR,d- (*), Fl(*) is M, ED cuR*) cuRil(*) ... CUR, ri 2(*) is 7 _________________________ m cu4(*) cuRil(*) ... cuRid(*), ri3(*) is Mt (1) CUR*) cuRtl(*) El) ... # CUR', rid(*) is vt e a/4e') e cue*) e ...e cue-2)(*) cukd-1)(*)cuRid(*), i = 1,...,k, and for any vector x E F11, x = (a1, a2, an), ai E F2 by )-c we denote a vector y = a-2-, ...,c7-71). If, for example, n=5 and CUR*) is presented as a vector (0,1,1,0,0) E
for some 1 < I < k, then CUR*) is a vector (1,0,0,1,1).

By ED we denoted xor operation of vectors. For example, the result of applying ED to vectors (0,1,0,1,1) and (1,0,0,0,1) is a vector (1,1,0,1,0).
Present one more way of defining mappings (c 0 0, w1, d+1), j= 0,1, ... , d. For instance we may set (5.3) p (*) is Al, El) CUR:" El) CURil(*) El) ... e) Cu 4(*) , is Mi CUR, (*) ED CUR,i(*) CURi2(*) e e cuRid(*), n2(*) is Mi ED CUR*) 6 CUR,1(*) 6 CUR,2(*) ... CUR', rid(*) is mi e CUR*) 0 CUR ... 0 CU R2 CUK e cuRid(*), for i = 1, , k.
Below is presented another method of defining mappings J( a0, coi, cod+i), j= 0,1, d.
We may set (5.4) p (*) is Mt CUR*) CURil(*) 6 ...ED
.s M, CUR, (*) CUR,i(*) CUR(*) ED ... 6 CUR, is Mi ({) CUR:" e CUR ... 0 CU Rid(*) , for i = 1, k.
Bit operations ^ and & may also be used for constructing collections ni(*)(too, w 1 j = 0,1, , d, i = 1, , k. For any two vectors x = (a1, a2, , an), Y = (b1, b2, bn) x,y E F, ai, bi E F2, i = 1, n we may define two operations V and A by setting (5.4) xVy = (ctiAbi, a2 b2, anAbn), xAy = a2&b2, an&bn), where again A and & are bit operations.
In an embodiment of the present invention any collection of d+1 expressions involving elements (vectors) from S(M, n), CUR (*), CUR1(*),CUR2(*), , CUR d(*) or their negations, xor operation, V and A operations (5.4) applied to the elements from (M, n), CUR (*), CUR1(*),CUR2(*),...,CURd(*) may be used for constructing mappings ni(*)(coo, wa+1), j= 0,1, ...,d, j = 1, ...,k.
Consider now the largest integer /4:(*) such that 0 <
rij(*) < iti(*), j= 0,1, ... , d,. This means that either Ecgil(*)+1) rj(*) > /000, or ill is equal to k for j= 0,1, ..., d. Consider, further, the largest integer 14(*) such that E4*) rj(*) < itj(*), i=04.(*) +1) that is, either ft4(*).+1) ri(*) > iti(*), i=(4.04-1) or µ(*) is equal to k, j= 0,1, ..., d.
Consider then the largest integer /4(*) such that vi4(*) pi(*) -i=(,4 (*)-1-1) and so forth, j= 0,1, ..., d.
Eventually for vi(*) = [ + 1 and itvi.(/*(*)) = k mod Iti(*) we consider pi(*) > iti(*) j= 0,1, ...,d.
Define, further functions (5.5) xj(*)(i) = 1 for all such i = 1, , k that (5.6) 1 < i <
ti(*) + 1 < <
k(*) + 1 < t< 1.1(*), and set (5.7) xj(*)(i) = 0 for all such i= 1,...,k that (5.8) /4(*) + 1 < i I4(*) + 1 < i < tdt(*), k(*) + 1 < i<
j= 0,1, ...,d.
In an embodiment of the present invention a modification of the iterated transformations procedure described above may be presented.

For the corresponding preliminary chosen Lo, Vo, 1 < t1 < 2 ¨ 1 and 1 < t2 <
2' ¨ 1 we set cu4(*) = miED(pf. (a(to-Ljo(*)(ti,2nDmod 271) 631(pg (p(t24-voint2,27Dmod 271) if x0(.)(1) = 1 and cuRi (*) = miED(pi. (8(t14-4*)(ti,29)mod 2n) etpg (fl(t2+17r)(t2,2n))mod 2n) if x0(*)(1) = 0 After recalculating L1 = Sub (Lo, int (CU RI)), V1 = Sub(Vo, int(1110) we compute CUR2 by o CUR2(*) =

(pf (o(int(M1)+1,1(int(M1)12n))MOd 2n)e (fl(int(CUR1)+Vi.(int(CUR1),2n))mod 2n) if x0(*) (2) = 1 m2 9q) ______________________________________________________________________________ f (6 Ont(M1)+Li(int(Mi),29)mod 2n)19(p9 (i3(int(CUR1)+Vi(Lnt(CUR1),29)mod 2n) if x0(*)(2) = 0 For any i = 3, ... , k we set (5.9) CUR9(*) =
= M f (o (int (14 +Li- i(int(M 0,2n))mod 2n)19(p9 (int(CURi_i)+17 i-i(int(CURi-i),2n))mod 2n) X (*) (0 = 1 and (5.10) CUR?(*) =
mte(pf (a(Ent(m/-1)+4-10nt(m,-1),29)mod 2n)eyg(fl(tnt(CUR1_1)+14_1(int(CURI_i),29)mod 271) e(*) (i) = 0, where Li_i, Vi_ are the corresponding collections of integers.
Here Aftevf (60.ntoit_o+L,_1(int(m,-,),29)mod 271)e)(pg winocuR,-1)+14-10.nocuRt_i),29)mod 271) is a negation of a vector of FT obtained in the result of the computation Mi (pf (s(int(A1 i_i)+Li_1(int(Mi_i),2n))mod 2n), 9(p 903(int(CURi_i)+Vi_1(int(CURi_i),2n))mod 2n).
We remind that CURI(*), i = 1,...,k, j = 0, d can be presented as a vector of F.
Constructions 5.9 and 5.10 may be expanded on any element CURI(*) for]
=1,...,d.
Assume, for instance, that we computed CUR; for some i = 1,...,k in accordance with the iterated transformations procedure presented above, and assume that in the result of the computation we obtained a vector x E F. We set x if xt(i) = 1 (5.11) CUR; = 1_ x if x*(i) =
In an embodiment of the present invention for any i = 1, , k and for any] =
0,1,...,d if we compute CUR*) in accordance with the iterated transformation procedure presented above and obtain a vector y E FT. in the result of the computation, it may be possible to set ij(*) =
(5.12) CUR-!(*) = fyf x (i) 1 y if xj(*)(i) = 0 In an embodiment of the present invention in the expressions presented in 5.2 and 5.3 it may be possible to use different indices i for different terms in the expressions.
For instance, ii (*) in 5.2 we be presented as (5.13)o(*) 1.(*) d(*) (1) CUR e cuR ... cuRi).
In this case the computation of fici(*) may be started from i = d and the number of elements of ri (*) in this case is equal to k ¨ d +1.
In an embodiment of the present invention any collection of indices may be used in the expressions for rif(*), > 1, j = 0, d.
The modification (5.12) of the iterated transformations procedure will be referred to as the iterated transformations with constant iterative constraints.

The Orange cipher where the iterated transformations with constant iterative constraints are applied will be referred to as the Orange cipher with constant iterative constraints without filters.
The ERINDALE-PLUS hashing function where the iterated transformations with constant iterative constraints are applied will be referred to as the ERINDALE-PLUS
hashing function with constant iterative constraints without filters.
b. Variable iterative constraints without filters In the case of the constant iterations without filters presented above, d + 1 integers /ti > 0 that are associated with collections CURj(*), may be different, however they are constant and the integers are not changed during the computation of the elements of collections Ri(*), j =
0,1, , d.
In an embodiment of the present invention variable iterations without filters may be presented.
In this case ordered sets of integers may be associated with each CURi(*), j =
0,1, ..., d. Denote by V/t (*), V/t*, V/t**, V/td(*) ordered finite sets of integers associated with CUR (*), CURd(*), correspondingly, d > 1.
In an embodiment of the present invention ordered finite sets of integers V/ti(*), j = 0, d may contain different integers and the number of elements in each set may be different.
By V/ti(*)(i) we will denote the i-th element (an integer) of ordered set V/tj(*), j = 0, , d, = 1, , Si(*). Thus, the number of integers in V/ti(*) is equal to si(*), j =
0, d.
Next, it is possible to define a collection of mappings Fj (coo, coi, cod+i), (in accordance, for instance, with 5.2, 5.3, or 5.4 presented above) with any indices used in the mappings ri (coo, === 6061+1), 1= 0,1, ... , d, see, for example (5.13).
Assume that the presented above collection of mappings /"(a) --1, === (I)d+1) j= 0,1, d is defined. Without losing generality we will show how to compute the collection of elements of CUR (*) in the case when I V/t (*)I > 1. We will omit an upper index OM in /4(*) and Fi (*).

Consider the largest integer pi such that (5.13) 0 < <VIt (*)(1), that is, either 4141+1)l > V/t (*)(1), or pi is equal to k Consider, further, the largest integer /12 such that (5.14) Zri2ri VIt (*) (2), and, again, either Viii2ri > V/t (*)(2), or p.2 is equal to k Consider, next, the largest integer /23 such that (5.15) 43_122+1)r, v It (*)(3), which implies that either 11) fl > V/t (*)(3), or p3 is equal to k.
Continuing the process of evaluating partial sums of ri, consider the largest pso(*) such that (5.16) Zgo(*) < v (s (*)) and such that either s0(*) +1 fl > vito(*)(so(*)) (i=g(so(*)_1)+1) or pso(*) is equal to k.
Then we consider such largest integer p(so(*)+1) that (5.17) Zt( < v t (*) (1) g so(*)+1- ) and either tt(so(*) 1)+1 > V I t (*) (1) (i=t2ttso(*)+1) or i1(so(*)+1) is equal to k, and so forth.
Denote by r the index of the last integer , for which the corresponding inequality takes place.
It's clear that j2i. is equal to k We construct, further a function x (*) in the same way that was presented above (see 5.5 ¨ 5.8) defining it for integers /21, /22, Aso(*), , In an embodiment of the present invention for any i = 1, , k if we compute CUR*) in accordance with the iterated transformation procedure presented above it may be possible to set CURi (*) if x (*)(i) = 1 (5.17) C *UR ." = __ CUR, (*) if x (*)(i) = 0 In an embodiment of the present invention the presented above procedure of the modification of elements of CUR (*) with regards of the ordered set V/t (*) may be expanded on any CURi(*), with the corresponding ordered sets Viti(*), j = 1, , d.
Thus, in an embodiment of the present invention a collection of functions xj(*) may be defined in accordance with the presented above procedure and for any element CUR*) computed by the iterated transformation procedure presented above it may be possible to set CURL(*) if xj(*)(i) = 1 (5.18) CUR!(*) ¨ ______ CUR*) if xj(*)(i) = 0 for = 1, k and j = 0, d.

The modification (5.18) of the iterated transformations procedure will be referred to as the iterated transformations with variable iterative constraints without filters, or simply, the iterated transformations with iterative constraints without filters.
The Orange cipher where the iterated transformations procedure with iterative constraints without filters is applied will be referred to as the Orange cipher with iterative constraints without filters.
The ERINDALE-PLUS hashing function where the iterated transformations with iterative constraints without filters is applied will be referred to as the ERINDALE-PLUS hashing function with iterative constraints without filters.
5. Example I
In an embodiment of the present invention it is possible to present an example of IV (initial values) of the presented above encryption construction.
It may be possible to set a degree of splitting n = 5, which means that in accordance with the choosing the size of a key procedure presented above, a key of 160 bits should be used.
a. Splitting with jumping parameters It may be possible to choose a splitting with jumping scheme II with the following Spl table 4,5,2,5,3,1,5,5,4,3,2,4,4,5,4,5,3,1,5,4,3,4,5,5,4,3,3,5,5,4,4,5,5,2,4,3,4,5,5.
It may be also possible to set ch = q2 = q3 = q4. = 1 and for any i > 4 qi may be define in accordance with procedure presented in section "Splitting with jumping II" for tOi = int(CURi*_3 CUR_ 4).
b. Iterated transformation parameters It may be possible, next to to choose an iterated transformation of degree 6 (that is, d = 6) with the following parameters:
f(x) = x5 + x2 + 1 , g(x) = x5 + x4 + x3 + x + 1 , S=X4 -FX-F 1, fl=x3+x2+x+1, f * (x) = x5 + x4 + x2 + x + 1, g* (x) = xs + x3 + x2 + x + 1.
8*=x2+x+1, fl*=x+1.
We set f * (x) = f ** (x) = f3(*) (x) = f 4(*)(x) = f5(*)(x) = g6(*)(x), g* (x) = g** (x) = g3(*)(x) = g4(*)(x) = g5(*)(x) = f 600 (x) and s* = fr* = fp(*) = p(*) = f35(*) = 66(*) = 6** = 63(*) = 64(*) = 65(*) = f36(*) All isomorphisms q) f*, j6(*), (pg, Ty*, , cp96(*) are trivial, that is, for any polynomial of degree less than 5 ao + aix + a2x2 + a3x3 + a4x4 there takes place (Pj(ao + aix + a2x2 + a3x3 + a4x4) =< a0a1a2a3a4 where] = f, f*, f** , f6(*), g* g** g6(*), aiEF2, i = 0, ...,4 and < aoaia2a3a4 > is a vector of a vector space F. Then, we may, for instance, set Lo ¨
25,7,4,6,18,23,24,13,15,9,10,28,21,30,20,8,19,2,29,27,31,0,11,14,1,5,12,17,16,2 2,26,3, Vo ¨
7,19,5,6,17,29,16,4,31,28,10,24,8,9,23,27,2,20,21,0,30,12,25,18,1,26,11,13,22,1 4,15,3, 2,12,5,31,17,20,10,11,7,9,29,25,13,14,4,28,19,6,21,17,18,15,0,26,3,19,13,27,16, 22,5,30, el;
¨26,19,5,9,0,18,1,2,16,22,21,23,30,17,31,24,15,28,4,3,25,7,8,14,27,29,13,10,6,1 1,20,12, L30(*) ¨8,14,16,2,5,6,21,26,1,25,19,29,15,7,12,10,28,27,22,0,30,24,13,3,9,20,31,17,23, 18,11,4, L40(*) ¨3,31,9,15,2,27,25,21,18,10,4,5,0,1,19,17,25,29,6,23,30,16,26,13,14,12,31,20,24 ,8,2,7, L50(*) ¨29,7,22,1,27,24,0,19,17,16,3,12,5,18,15,23,14,13,6,4,30,2,10,31,9,25,20,11,8,2 8,21,26 6(*) Lo ¨4,18,9,28,8,11,27,23,10,7,2,19,7,26,25,26,24,13,20,0,11,21,30,17,12,29,15,7,16 ,31,3,11.
and = 5, t2 = 17, t; = 15, t = 3, 4- = o, t;* = 28, 3(*) t4(*) 5(*) ¨_ , t1 3 t3(*) t4(*) ts(*) _ 1t1, 2 2 2 ¨ L.
6(*) 6(*) t = t2 = 11.

c. Bit strings parameters It may be possible, for instance, set one bit string E** for CUR** and two bit strings Ei4(*), E24(*) with S/4(*) and S24(*), correspondingly, for CUR4(*), where = [14,18,9,28,8,22,27,23,10,4,2,19,7,26,24,13,20), S24(*) = [0,11,21,30,17,12,29,15,5,16,31,3,1,6,25,).
The sizes of all the bit strings are equal and are 200 bits and all the bit of the bit strings are set to 0 from the beginning. The bit strings will be updated in accordance with the procedure "Forming the bit strings II" presented above. We may set A**
¨(4,6,2,7,3,5,1,3,4,8,1,6,3,7,5,4,3,1,2,1,7,9,4,5,2,3,6,1,7,8,4,1,2,2,6,3,1), Al(*) ¨(5,3,6,5,8,5,7,9,6,9,5,7,4,5,9,7,6,8,2,7,1,9,5,3,6,7,8,4,6,9,3,8,7,5,3,9,9,4,8 ,5,8,9,5,5,4), 4(*) ¨(6,1,7,3,6,5,2,7,7,1,3,4,6,5,1,2,6,3,1,4,1,9,8,5,2,2,4,1,3,9,5,6,7,6).
II. The Orange family of stream ciphers with filters In an embodiment of the present invention a family of stream ciphers with applying keystreams generated during computing a ciphertext may be presented. The constantly updated bit strings are used as the keystreams. As the number of generated bit strings may be parameterized, so the number of the keystreams may also be parameterized. In an embodiment of the present invention a few schemes of applying the keystreams may be presented.
F. Encryption with filters In an embodiment of the present invention a method of computing a ciphertext for a message M and a key K with using keystreams may be presented. We will refer the scheme to as an encryption with filters.
In a framework of the encryption with filters the encryption procedure may also be started with applying a splitting with jumping procedure, an iterated transformation procedure and forming the bit strings procedure; however the iterated transformation procedure is modified, as the bit strings are involved in the iterated transformation procedure.
1. Filters In an embodiment of the present invention applying a splitting with jumping procedure to a bit string may be presented. By applying a splitting with jumping procedure to a bit string and generating a collection of the corresponding n - bit words it may be possible to generate elements of a keystream that will be used in an iterated transformations procedure considered below.
Let E be a bit string of length cr and fix some degree of a splitting with jumping n such that 4 5. n 5. 10. The corresponding ql, q2, q3, ... may be generated and a splitting with jumping procedure may be applied to E in accordance with the presented above procedure. The obtained n-bit words may be denoted by E(1, n) , E (2 , n) , E (3 , n) , ... and assume that that for some i > 0 E(i,n) is the last an n -bit word containing n bits of E, that is, there is not enough bits in remaining part of E to form another n-bit word. A procedure of generating E(i + 1,n) in this case may be presented. Denote by Et(i + 1) a collection of remaining bits of E
that will be included into E(i + 1,n), and denote by length(El(i + 1)) a number of bits in Ei(i + 1). It may be noted that 0 5_ length(Ei(i + 1)) <n. Further, denote by Ef (i + 1) an (n ¨ length(Ei(i + 1)))-bit word formed from the first (n ¨ length(ei(i + 1))) bits of E. Then it may be possible to define E(i + 1, n) by E(i + 1,n) = Et(i + 1) II ef(i + 1), where H is an operation of concatenation of the two sequences of bits. After that it may be possible to keep generating elements E(i + 2, n), E(i + 3, n), and so forth.
The presented above procedure of applying a splitting with jumping to a bit string E may be interpreted in the following way. Every time when in the result of applying a splitting with jumping procedure to E
we are "out of bits" of a bit string E, it is always possible to move to the beginning of the bit string and add the needed number of bits starting from the beginning of E in order to complete forming an n-bit word. The process of generating the next n-bit word is naturally continued keeping in mind the move to the beginning of a bit string. However, it is important to notice that bit string E may be constantly updated.
Thus, it may be possible to generate any number of n-bit words applying a splitting with jumping procedure presented above.
In an embodiment of the present invention a method of applying a backward splitting with jumping procedure to a bit string E may be considered.
Let a be any collection of bits. Denote by Op(a) a collection of bits that may be obtained by inverting a collection a. For example, if a is a sequence of bits 011010001110101, where 0 is the first bit, 1 is the second bit and so forth, then Op(a) is the following collection of bits 101011100010110.
A backward splitting with jumping procedure applied to a bit string E is a splitting with jumping procedure applied to Op(e).

In an embodiment of the present invention any function defined on a collection of elements (iv) or (v) (see section "Splitting with jumping") may be used to generate q1, q2, q3, ... and any corresponding mapping may be considered if the Splitting with jumping procedure I presented above is applied, or any Spl table may be defined if the Splitting with jumping procedure II presented above is applied.
Thus, in general, more than one splitting with jumping procedures, or more than one backward splitting with jumping procedures may be applied to one and the same bit string E. If q1 = q2 =
q3 = = = = = n we may say that a splitting with maximum jumping is applied to a bit string E.
The bit strings, to which splitting with jumping procedures are applied will be referred to as filters and the bit strings, to which backwards splitting with jumping procedures are applied will be referred to as reverse filters, or a filter in reverse order. If E is a filter, that is, a bit string with applied splitting with jumping procedure then elements (1, n), E(2, n), s(3, n), ... will be referred to as the first, second and so forth elements of a filter E. If e is a bit string, then the reverse filter based on E will be denoted by E-1 and the elements of the reverse filter will be denoted by E-1(1, n), E-1(2, n), n) If no splitting with jumping procedure is specified to a bit string, it may be possible to consider that, by default, a splitting with maximum jumping is applied to the bit string in the case when it is considered as a filter.
2. Continuation of Example I
In a framework of the Continuation of Example I parameters of two splitting with jumping procedures applied to a bit string e** are presented. Therefore the parameters of the splitting with jumping procedure (applied to a message) and iterated transformation parameters in the Continuation of Example I will be the same as in Example I; however a section c ("Bit string parameters") is changed. The updated c section is presented below.
c'. Bit strings parameters We may set one bit string t** for CUR** and two bit strings e*), E*) with si4(*) and S24(*), correspondingly, for CUR 4(*), where = {14,18,9,28,8,22,27,23,10,4,2,19,7,26,24,1 4(40 S2 = {0,11,21,30,17,12,29,15,5,16,31,3,1,6,25,20,13).
The sizes of all the bit strings are equal and are 200 bits. The bit strings will be updated in accordance with the procedure "Forming the bit strings II" presented above. It may be possible to define A**
¨(10,6,9,12,3,5,6,3,9,5,12,6,3,10,5,12,3,6,10,9,5,9,9,5,10,3,6,12,9,3,5,6,3,10, 12,5,11,3), 4(*) ¨(5,3,6,5,8,5,7,9,6,9,5,7,4,5,9,7,6,8,2,7,1,9,5,3,6,7,8,4,6,9,3,8,7,5,3,9,9,4,8 ,5,8,9,5,5,4), 4(*) A2 ¨(6,1,7,3,6,5,2,7,7,1,3,4,6,5,1,2,6,3,1,4,1,9,8,5,2,2,4,1,3,9,5,6,7,6).
Then, a splitting with jumping scheme II with Spli table 4,5,2,5,3,1,5,5,4,3,2,4,4,5,4,5,3,1,5,4,3,4,5,5,4,3,3,5,5,4,4,5,5,2,4,3,4,5,5 for filter s** and a backward splitting with jumping scheme with Sp12 table 4,1,3,2,5,3,1,4,5,4,3,2,4,1,3,4,5,3,1,4,5,3,2,5,1,4,2,3,1,5,4,3,5,4,2,5,4,3,1,5 ,2,2,1,4,3,5 for reverse filter (E**)-1 are prepared. From the beginning all bits of all the bit strings are set to 0.
Additionally, co' and co" need to be defined for computing splitting periods for E** and (E**)-1, correspondingly. It may be possible to set q1 = q2 = q3 = q4 = 1 and for any i > 4 qi may be define in accordance with procedure presented in section "Splitting with jumping II" for co; and tor defined, for instance, in accordance with co; = int(CURi_i ED CUR) and GO;r = (CURi CUR).
3. Iterated transformations with direct filters An iterated transformation with direct filters procedure involves filters and reverse filters that are formed based on bit strings. Assume that some degree of splitting with jumping 4 5_ n 5_ 10 and a degree d > 2 of an iterated transformation are chosen. Assume, further that Sub(2n, mo), Sub* (2n, mi), , Subd(*)(2n, md(*)) and the collections of bit strings d(*) d(*) e1, = = = , emo, el, .. = , em* . = = , ei === , emd(*) with sizes * * d(*) tra(*) al, === attioi 61) =" 67n ' 61' ' respectively, for the elements of collections CUR,CUR*,...,CURd(*), correspondingly, are prepared. Assume, at last, that a collection of ordered sets of non-zero integers d(*) Ai0)2171, = = = PA =
,d(*) containing d(*) PWid(*) non zero integers, respectively, io = 1, , mo, i1 = 1, , , id(*) = 1, , ma(*) is also prepared.
It may be noted that empty set of the bit strings may be associated to some of the collections (51) CUR,CUR*,...,CURa(*).
Eventually, collections (13), pairs of irreducible polynomials (13`), pairs of generators (13") and isomorphisms of vector spaces (13") may be specified.
In a framework of an iterated transformation with direct filters a special table of filters Dfl may be prepared before starting a modified computation of elements of collections CUR, CUR*, ...,CURa(*) . The table contains pairs (i[u],j), i > j that specify a collection CURL(*), the u-th filter of which will be used during the computation of elements of a collection CURi(*), i,j = 0,1, , d. The table may also contain pairs (i'[u],j), i > j for ti,j = 0,1, ..., d.
This means that the u-th reverse filter (that is, the u-th bit string associated with a collection CURi(*) with applied backward splitting with jumping procedure) will be used during the computation of elements of a collection CURi(*).
Without losing generality it may be possible to consider the presentation of an iterated transformation with direct filters based on the Continuation to Example I
presented above. It may be possible to start, for instance, with the following Dfl table (52) (2,3), (4[1],5), (4-1[2], 6).
It means that a filter E** with applied splitting with jumping procedure will be used when the computation of elements of CUR3(*) takes place, and filters Ei4(*), El.(*) will be used when the computation of elements of collections CURS(*) and CUR6(*), correspondingly, takes place.
Moreover, a reverse filter Er) with applied backward splitting with jumping procedure will be used during the computation of elements of a collection CUR6(*). Again, it may be possible to remind that if no splitting with jumping is specified to any bit string, then, by default a splitting with maximum jumping is applied to any bit string considered as a filter.
Let, further, R be any sequence of bits that should be processed. First, a splitting with jumping procedure may be applied to R and then an iterated transformation procedure with direct filters may be presented. The computation of the elements of collections CUR, CUR* and CUR** is the same as it was described in section "Iterated transformations"; however the computation of the elements of CUR3(*) is different and may be realized by 3( (5 3 ) CUR*) _i ¨ (CURi**EDE** (1, 5)) 0(pp (*) (84,3(*)+4,3(*)(ti3(*),25))mod e evg3(*) (fl(t(*)+L*0*4,300,25))mod 25) for the corresponding 1 < ti3(*) < 25 ¨ 1 and 1 < t23(*) < 25 ¨ 1 and for L7 that was used for the computing CURT*. Here E** (1,5) is the first elements of a filter E**

Then it is possible to compute L3i(*) = Sub(1,30(*), int(C U Ri3(1) and the next element E** (2,5) of a filter E**, and calculate (54) CUR*) =

= (C U R`4` ED E** (2, 5) ) (pf.3(*)int(CURr)+1, ( *) (int(CUR),25))mod 25) e 6 (31( os 93(*) (13(int(CUR,3(*))+LI* (int(CUR i3(*)),25))mod 25).
Thus, for any i> 2 and L? = Sub(L, tint(CURi3T)) it may be possible to calculate (55) CUR*) =
= (CURrEDE**(ti, 5))EBTf3(*) (6(int(cuci)+4_(;).(inocuRi*._,),25))mod 25) 93(*) (ig (int (C Ri3(1) )+14'11(int (C R ) ,25))M0 a 25) .
It may be noted that L*, LI* in expressions (53), (54), correspondingly, and 1.1* in (55) are ordered collections of integers that arise during the process of computing the elements of CUR**. It may be also noted that E** (1,5), E**(2,5), ... are the corresponding elements of a filter 8**
Next, the elements of CUR4(*) are computed in accordance with the procedure described in section "Iterated transformations" presented above, that is, the elements are computed without involving any filters; however the elements of CUR5(*) are computed with involving elements Ei4(*)(i, 5) of a filter E i = 1,2, ... , that is, (56) CUR*) = (CUR:(*)Ser)(1,5))(1)(pfs(*)5(*) 5(.) 5(*) (8(ti +/.0 (t, ,25 Dmod 25) e ED(pgs(*) ($(t25(*)+L40(*)(t25(*),25))mod 25) for the corresponding 1 < ti5(*) < 25 ¨ 1, 1 < t25(*) < 25 ¨ 1 and for L40(*) that was used for computing CUR*). Thus, for any i > 2, L = Sub(L, int(CURisT)) and element 4(*) (i, 5) it may be possible to obtain (57) CUR*) =
= (CU Ri (*) 5 4(40 (i, 5)) (13Vpfs (*) (a (int( CUR )+L5i_(*2 (in t(CUR4i_ ),2 Dmod 25) el t95(*) (16.(int(curq_(*2)+41*2(int(cuRr2),25))mod 25).
Eventually the elements of CUR6(*) are computed with involving elements (E24(*))-1(i, 5) of a reverse filter (E24(*))-1, i = 1,2, ... , that is, (58) CUR*) =
= (CUR*) (4(*)) -1 (1,5))&pf5(*) (8(ti6(*) -44(*) (ti6(*) ,25))mod 25) s 9(pa5(*) (fl(t26(*)+4(*)(4(*),25))mod 25) for the corresponding t16(*) and t26(*) and for L50(*) that was used for the computing CUR15(*). For L = Sub(L6i(*2, int (CU Ri6(*2)) and element (e24(*))-1(i, 5) it may be possible to calculate for i > 2 (59) CUR*) =
= ( CUR i5 (*) (E4(*)) (i, 5)) ED(Pf 5 (.) (6(int(CUR1))+L6i1*2 (int(CUR*2),25))mod 25) ED
95(*) (fl(int(CUR?_(;))+Ln(int(CURn)),25))mod 25).
In general, considering an iterated transformations with the corresponding parameters of degree d > 1 and having a table D f 1 with elements (60) (si [hi], (s2 [h2], u2), , (s[hw], u)), it may be possible to assume that collections (61) Sub sl(*) (271, msi), Subs2(*) (2n, Ms2), , SUbsw(*)(2n, Trisw) and bit strings (62) esi.(*) si.(*) s2(*) s2(*) sw(*) es(*) , , ems, , , , ems2 el , , msw with sizes (63) õsi.(*) õsi.(*) õs2(*) õs2(*) õsw(*) sw(*) -ms, -1 ' -ms2 ' "' ' ' correspondingly, are prepared. Bit strings (62) are related to collections CURs1(*), , CURsw(*), respectively. It may be noted that 1 5 v1 5 m51, 1 5 v2 5 m2....., 1 5 vw 5..
msw and max{sl, s2 , s} < d, max(ui, u2 , uw) d.
It may also be assumed that s1 <u1, s2 <u2, sw <u and that u1, u2, uw are different, and that some (or all) of s1 [h1], s2[h2], s[h] in (60) may be with degree ¨1.
We will say that .51-filter h1 is set up for the transformation of degree ul, s2-filter h2 is set up for the transformation of degree u2 and so forth. If, for instance, a pair (sr-1 [hr], Ur) is an element of a table (60) we will say that an inverse sr-filter it, is set up for the transformation of degree Ur, or that an sr-filter hr is set up for the transformation of degree Ur in inverse order. If, for example, m51 = 1, that is, there is just one bit string associated with CURsi(*), it may be possible simply to say that s1-filter is set up for the transformation of degree uõ.
Thus, taking into account D fl table (52) it may be possible to say that 2-filter is set up for the transformation of degree 3, 4-filter 1 is set up for the transformation of degree 5 and inverse 4-filter 2 is set up for the transformation of degree 6.
Sometimes we may say that 2-filter E**, or simply E** filter is set up for the transformation of degree 3, 4-filter E14(*), or simply filter Ei4(*) is set up for the transformation of degree 5, and 4( 4( inverse 4-filter E2 40 , or simply inverse E2 *) filter is set up for the transformation of degree 6.
We may also say that a filter E24(*) is set up for the transformation of degree 6 in inverse order.

4. Iterated transformations with direct filters and bit strings In an embodiment of the present invention a modified procedure of updating the bit strings in a framework of the iterated transformations with direct filters may be presented.
Consider iterated transformations of a degree d > 1 with direct filters. It means that a table Dfl related to the transformations with direct filters is not empty. Assume that a table Dfl contains at least one pair, say (i,j), for i > j, i 0 and] d, that is, we assume that at least one bit string E is associated with a collection CURi(*). It may be possible to update a bit string E in a framework of computing elements of a collection CURi(*). However keeping in mind that the bit string is used as a filter in a framework of computing elements of CURi(*) the updating procedure of a bit string E is slightly modified.
From the very beginning some initial value may be stored to a bit string E
are. In particular, all the bits of a bit string E may be set to 0. If M is a message, which is processed, a splitting with jumping procedure is applied to M and the computation of an element CUR*) may be performed. After that it is possible to start updating a bit string E by applying procedure Forming the bit string I, or Forming the bit string II, however the process of updating a bit string E has to be postponed. As a pair (i,j) is an element of a table Dfl, i -filter E is set up for the transformation of degree]. We claim that for any i > 0 we do not update bit string E associated to CURi(*) until element CUR*) is computed. In other words, unless the computation of CUR*) realized by CUR*) = (CURU-1)(*)EBEi(*) (1, n))ED(pf,(*) (8(t(*) +Llo(*) (q(*) ,25))mod 25) s µVg" ) (*) (i-i)(*) J(*) 5 (f3(t2 +Lo (t2 ,2 ))mod 25) w is completed for the corresponding t*), t2i(*), f (*) , g (*) , Lio(*) and Lr1)(*), the procedure of updating a bit string E is not applied.
Let (s[h], u), 1 h 771., be any pair of a table Dfl, where Subs(*)(2n, Ms), S
> 0, Ms > 1 is a collection of the corresponding subsets associated to CURS(*) and assume that a bit string eS(*) is associated with not empty SheSubs(*)(2n, ms) . Then for any j > 1 such int(CUle(*))ESh a procedure of updating a bit string ehs(*) is not applied until the computation of element CUR*) is not completed. The same condition of updating a bit string es(*) is applied if a table Dfl contains a pair (s-l[h],u), 1 h Lc. ms,ms > 1.
In general, assume that for some s > 0 and 1 < ms < 2, Subs(*)(2n, Ms) is a collection of some non empty subsets associated to CURS(*) and eis(*), i = 1, , ms is a collection of bit strings related to CURS(*) . Assume that a table Dfl contains pairs (s[i], u1), i = 1, , ms. Then for any j > 1 after computing an element CUR;(*) a procedure of updating any of bit strings u eis(*), i = 1, ..., ms is not applied until the computation of element CURm(*) ./ is not completed, where um = max[ui), I = 1, . The same condition of updating bit strings eis(*), i =
1, ..., ms takes place if some or all filters assigned by a table Dfl are applied in inverse order.
In an embodiment of the present invention the presented above condition of updating a bit string used as a filter will be referred to as the filters updating condition I.
5. Iterated transformations with special filters In an embodiment of the present invention iterated transformations with special filters may be presented.
Without losing generality consider the Continuation of the Example I presented above. It may be possible to build a Dfl table with the following pairs (64) (2,2), (4[1],4), (4'[2], 6).
It means that it is possible to set up filters for the transformation procedures of the same degree, to which the corresponding bit strings are associated. We will refer such filters to as special filters. Of course, the updating filters condition I should hold for the case as well.
In general, if there is just one bit string E s (*) , which is associated to an iterated transformation of a degree s 0 and the bit string is used as a special filter, at any stage of computation no updating bit string procedure should be applied until the computation of the corresponding element of CURS(*) is completed.
6. Iterated transformations with backward filters In an embodiment of the present invention iterated transformations with backward filters may be presented.
Consider a table Dfl of an iterated transformation of a degree d> 0 containing the following pairs (65) (i2[1'2],i2), (is[vs],is) where ii. > Ii' i2 > I2, is > Is for some 1 v1 5_ ml, 1 5_ v2 5_ m2, ..., 1 5_ v., ms, and ml, m2, , ms are the numbers of bit strings associated with iterated transformations of degrees i2, ..., is, correspondingly. Such filters will be referred to as backward filters.
Taking into account the Continuation to Example I, it is possible, for instance, to consider a table Dfl containing the following pairs (66) (2-1, 0), (4-i [1],1), (4[21, 3), that is, a filter E** is set up in reverse order for the transformation of degree 0, a filter E is set up in reverse order for the transformation of degree 1 and filter E24(*) is set up for the transformation of degree 3. Thus, pairs (66) may be considered as an example of three backward filters that may be set up in a framework of Example I presented above. The updating filters condition I for backward filters is the same as for special filters.
7. Iterated transformations with filters I
In an embodiment of the present invention iterated transformations with universal filters may be presented. In the iterated transformations with universal filters for transformations of various degrees it may be possible simultaneously apply forward, backward and universal filters.

It may be possible to consider an iterated transformation where forward filters, backward filters and special filters are set up. For instance, taking into account the Continuation to Example I presented above it is possible to consider a table D fl containing the following pairs (67) (2_1,5), (4[1J,1), (4[2},4).
that is, a filter E** is set up for transformation of degree 5 in reverse order, a filter Ei4(*)is set up for transformation of degree 1 and a special filter E
is set up for transformation of degree 4.
Moreover, a reverse filter (E**)-1 is formed using a backward splitting with jumping scheme II
with Sp12 table.
It is also possible, for instance, to consider a table D fl containing the pairs (67') (2-1, 0), (4[1], 1), (4[4, 4), or (67-) (2-1, 0), (2,6), (4[1], 1), (4[4, 4), and so forth.
Thus, direct, backward or special filters may be set up for an iterated transformation of any degree. Such iterated transformations will be referred to as the iterated transformations with universal filters or simply, iterated transformations with filters.
8. Encryption based on iterated transformations with filters In an embodiment of the present invention an encryption procedure based on an iterated transformation with filters may be presented. The presented below encryption procedure with filters allows using any number of filters that play role of keystreams in the encryption scheme..
Without losing generality we may fix some 4 5. n < 10 and choose a key K, the size of which is defined in accordance with the procedure presented above. Let, further, M
be a message that should be encrypted. Assume also that we consider an iterated transformation of a degree d > 1 with filters set up in accordance with some Dfl table. If Dfl table does not contain any pairs, a cipher is generated in accordance with encryption without filters procedure already presented above. So assume that Dfl table contains at least one pair, which means that at least one bit string is associated with CURS(*) for some 0 < s < d.
The procedure of generating a cipher for a message M with a key K is similar to the encryption procedure without filters presented above. The main difference is that the iterated transformation with filters is applied now.
Without losing generality it is possible to demonstrate a process of generating a cipher based on the Continuation to Example I. Since n = 5, an 160-bit key K should be used for encrypting a message M. It may be stressed that the iterated transformation with filters procedure is applied during all three stages of generating a cipher. Assume that filters are set up in accordance with a table Dfl that contains pairs (67).
As it was presented above, in section "Encryption without filters" the process of generating a cipher for a message M consists of three stages.
The process of generating a cipher may be split in the same three stages in the case of encryption with filters. The first stage begins with applying a splitting with jumping, the iterated transformation procedure of degree 6 with filters, and the forming bit strings procedure to a sequence of bits K II M. It is important to note that Dfl table becoming a part of IV. It may be also noted that the filters updating condition I should take place during all three stages. The first stage is a preliminary stage, so no part of a cipher is generated during this stage.
And again it may happen that during the splitting with jumping procedure applied to a key K a few last bits of a key may not be presented as a 5-bit word (or as an element of FT), as the number of the bits may be fewer than 5, and therefore, these last bits of a key K cannot be processed. We again denote the number of the bits by rf where 0 < rf < 5.
The first stage is completed when a key K is processed and the last rf bits of the key, which will be denoted by Krf, remain unprocessed.
The second stage begins with processing a sequence Krf II M, (actually, a collection of bits K II M is processed from the beginning and the moment when a subsequence Krf II M of a sequence K 11M started to be processed is important, because a ciphertext is generated starting from the moment), that is, with applying the splitting with jumping procedure, the iterated transformation procedure with filters and the forming bit strings procedure.
The second stage is completed when a sequence of bits Kr! II M is processed.
Again, it may happen that last rs bits of a message M, where 0 rs < 5 cannot be processed as rs bits may not be enough to form a 5-bit word, that is, an element of splitting. Denote by Mõ a sequence of last 0 < rs < 5 bits of M and let (68) CUR*), CUR*),...,CUR*) F2 Ft be the elements of the iterated masking procedure with filters of degree 6 generated during processing a sequence Krf II M. Indices Fi in expressions (68) are used to emphasize the fact that 6( elements CUR*)Fi = 1, ...,1 were generated using the iterated masking procedure with filters.
Once again, the filters are defined by a Dfl containing pairs (67).
Elements of a sequence (68) will be a part of a ciphertext of a message M
based on a key K.
The third stage begins with processing a sequence of bits Mõ II BS, where BS
is a sequence of bits that is formed based on a collection of bit strings E**, Ei4(*) and E24(*) in accordance with (69) BS =
In an embodiment of the present invention it may be possible to stress that during the first and the second stages of generating a ciphertext, in accordance with the Continuation to Example I, bit strings E**, Ei4(*) and E24(*) are constantly updated in accordance with the Forming the bit strings II procedure presented above; however in general, different bit strings may be updated by different procedures. The filters updating condition I, presented earlier, should hold.
We may denote by (70) CUR*),CUR9" 99 6(*) CU R6(*) the elements of the iterated transformation with filters procedure of degree 6 generated during processing a sequence Mrs II BS. Since the length of BS is 200 bits, p > 40.

A ciphertext of a message M is a sequence of bits (71) CUR*) II CUR6(*) II === II CUR*) II CUR6(*) II " II CUR*) II II LB, F2 F Tp where LB is an informational sequence of bits. It may be possible to remind that LB is an informational part of a ciphertext, and the size of LB is 2 bytes. LB contains parameters rf,rs, rt and a number s of bits 1 in a sequence sl, 0 < s < 8, where s = NBC mod 8 and NBC is a number of bits of a sequence (72) CUR*) II CUR,II=== II CUR*) II CUR6(*) II "II CUR*).
Fi T
9. Decryption of a ciphertext generated by a cipher based on iterated transformations with filters In an embodiment of the present invention a procedure of decrypting a ciphertext generated by a cipher based on iterated transformations with filters with using a key and IV may be presented.
The procedure of decrypting a ciphertext constructed with the use of an iterated transformation with filters is similar to the decryption procedure that was presented above, in sub-section "Decryption" of section "Encryption without filters"; however there is a difference as during the decryption procedure presented below bit strings will be used.
Without losing generality we demonstrate the process of decrypting a cipher based on Example I and filters defined by a table Dfl containing pairs (67), that is, pairs (2-i, 5), (4[11, 1), (4[2], 4). It is important to note that D fl table becoming a part of IV.
Assume that it is necessary to decipher a sequence of bits (72), that is, a sequence (73) CUR*) II CUR- r) II === II CUR*) V CUR*) = = =
II II CUR*) II sl II LB.
2 Ti Tp As the structure of 2 last bytes of a cipher, that is, the structure of LB is known, it is possible to obtain parameters rf,rs,rt and a number s. This means that the following part (74) CUR*) II CUR6(*) II ...IICUR6(*) II CUR6(*) II = = II CUR

may be extracted from a ciphertext (73).

Next, it is necessary to process a key K up to the moment when last 0 5_ rf <
5 bits of K are remained unprocessed. In the result of the processing the following elements (75) W1, W2, === Wv CURRi, CURR2, CURR2*,...,CURR,*, CURR16(*), CURR26(*), ...,CURR:(*) are generated. Here W1, W2, , Wõ are the elements of S(K, 5), that is, the elements that were generated during the splitting with jumping procedure applied to a key K. It may be noted that W, is the last element of S(K, 5), which consists of just bits of a key K, so the next element of the splitting with jumping procedure (applied to K M) would contain at least one bit from a message M. Since in a framework of the Continuation to Example I a splitting procedure not with maximum jumping is applied, v 32.
CURRi,CURR,...,CUR4(*) are the elements that were computed based on a elements i = 1, , v and the corresponding collections (76) 11. Lt p p p .== j j = 0, v ¨ 1 in accordance with the iterated transformations with filters procedure presented above. Collections (76), in turn, are also calculated during the iterated transformations with filters procedure. It may be stressed that, firstly, all bits of all bit strings (76') E** , , El(*) from the beginning are set to 0 and, secondly, bit strings (76') are updated during the calculation;
however all the bit strings are updated based on the following condition formulated below for a general case.

Assume that for some s > 0 and 1 < ms < 2, Subs(*) (2n ,m5) is a collection of some non empty subsets associated to CURS(*) and eis(*), i = 1, ..., ms is a collection of bit strings related to CUR(*). Assume that a table D f 1, in particular, contains pairs (s[i], ui), i = 1, ..., ms and assume that direct filters, backward filters and special filters are set up.
Then for any j > 1 after computing an element CUR*) a procedure of updating any of bit strings eis(*), i = 1, ... , ms is not applied until the computation of element CUR7m(*) is completed, where um =
mintua , i =
1, ... , ms.
In an embodiment of the present invention the described above condition will be referred to as the filters updating condition II, or updating filters condition II. Thus, the bit strings may be updated in accordance with the procedure "Forming the bit strings II"; however the filters updating condition II presented above should hold.
A receiver may start using a ciphertext in order to obtain a plaintext upon completing the calculation of all elements (75) and Viõ L, 14, . . . , 1.*) computed by Li, = sub(4_,, cuRR.,,), võ = sub(vi,_,, Wv), L; = Sub (L*õ _1, CURRõ*), 6(*) 6(*) 6( 4, = Sub(L, CURR*) ).
The first n -bit word of a ciphertext form CUR*) ; thus, based on elements (75), v,* õ6õ(*) and CU R6(*) V, L,, L, ... , L one needs to compute the first 5-bit word of a sequence of bits Kr! II M, where, again Krf is a sequence of last 0 5_ r f < 5 bits of a key K.
In order to obtain the first 5-bit word of a sequence Krf ii M, it may be necessary to compute one by one the following elements (77) CUR*), CUR*), ..., CURi.

It is possible to present the expression of CUR*), keeping in mind pairs (2-1, 5), (4[1],1), (4[2], 4) of a table D f 1, elements (75) and collections I4,, L i õ L*, ... , L6v(*) . It may be possible to write (78) CUR*) = CUR*) ED
@ (pf 6(*) (6 (int(CURRv5(*))+L6v(*) (int(CURRvS(*)),25DMOd 25) 19 El)(pg6(*) (fl (int(CURRv6(*))+1,5,(*)(int(CURel, 25))mod 25) , which gives (79) CUR*) = CUR*) ED
ED (pf6(*) (6(int(cuRRy5(*))+L6,7)(int(cuRR*)),25))mod 25) An µ.1v (D(pg6(*) (fl(int(cuRRv6(*))+4,(*)(int(cuRR:(1,25))mod 25) Next, since CURi5(*) = CUR 14(*) ED (E**)-1(v + 1,5) G (pr5(*) (8(int(CURRI74(*))*) (int(CU R4,(*)),25))mo d 25) bp vu Go (pgs(*) (fl(int(CURR*))+4(*)(int(CURR15,(*)),25))mod 25) it is possible to compute CUR*) = CUR 15(*) ED (E**)-1(v + 1,5) G vf,(*) (o(int(cuRRõ4(*))+L5,(*)(inocuRR:(*)),25))mod 25) op viv evg50,) (fl(int(CURR,57))+4,(*)(int(CURR15,(1,25))mod 25) using the v + 1-th element (E**)'(v + 1,5) of bit string E**. Continuing the computations it is possible to obtain CUR(*) = CUR*) ED E24(*)(v + 1,5) ED
(pf4(*) (45 (int(CURRII(*))+1,4v(*)(int(CURRv3 (*)), 2 5DMOd 25) (pg 400 (fl(int(CURR:(*))+4(*)(int(CURR:(1,25BMOd 25) CUR*

CUR*) ED
ED vf3(*) (o(int(cuRn*)+L3v(*)(inocuRR;*),25))mod 25) eve(*) (le (int(cuRR,3(*))+4*(int(cuRR,32(*)),25),mod 25) (80) CUR; = CUR* ED
ED (pf ** (45 (int(CURR;)+4*(int(CURR;),25))MOd 25) evg**(fl(int(CURRn+LVint(CURK,*),25))mod 25) ), (81) CURi = CUR; (1) Ei4(*)(v + 1,5) ED
ED (pf* int(C(1RRV) ( int (CURRV), 2 5))M0 d 25) (1)99* (13 (int(CURK,)+Lv(int(CURR;),25))mod 25) and eventually = CURi wf(o(tint(Wv)+Lv(int(Wv),25))mod 25) ED
45(pg03(int(CURRO+Vv(int(CURRO,25))mod 25).
Here MT is the first 5-bit word of Icy II M. Collections L, L5v(:1, , 1,õ+1,Vv+1 are gradually calculated upon obtaining elements CUR*), CUR*), , CURT, MT, correpondingly.
It may be stressed again that bit strings (76') are updated in accordance with the filters updating condition II. This means, for instance, that bit string E** may be updated upon 4 ( performing computation (80), while both bit strings E*)i , E2 may be updated upon completion of computation (81).
The presented above computation may be continued to up to the moment when the entire sequence (74) is processed. In a result of the computation a collection of elements (82) MI., M2, === MTV === MTp may be obtained. The procedure of restoring a message M from a collection (82) is similar to the procedure described in details in sub-section "Decryption" of section "Encryption without filters."
10. Iterated transformations with filters II
In an embodiment of the present invention one more construction of iterated transformations with universal filters may be presented. The presented construction allows realizing more complicated way of embedding filters into transformations of various degrees.
The new method makes an analysis of "action" of filters during computation of elements of transformations of various degrees more complicated.
Without losing generality it is possible to demonstrate the new construction of iterated transformation with filters based on the Continuation of Example I. Consider a table Sfl consisting of the following pairs (82') (2-1, 0), (4[1], 2).

We will use notation S f 1 to stress that pairs (82') will be used in a way different from using pairs of a table D f 1 (see "Iterated transformations with filters I").
Let M1, M2, M3, ... be elements of a splitting with jumping procedure applied to a message M.
We will use a splitting with jumping procedure specified in Example I, or the Continuation of Example I presented above. It may be possible to start with computing elements of CUR. For Lo, Vo and tiL and t2 specified in Example I it is possible to compute CURi = mie(pf (6(ti+Lo(ti,25))mod 25)9(p9 u3(t2+vo(t2,25))moct 25).
Next, it may be possible to calculate L1 = Sub(Lo, int((E**)-1(1,5))), V1 --= Sub(Vo, int(Mi)), and compute CUR2 by CUR2 = m2evi.(8cint(Mi)-FL,(int(Ml))25),mod 25), õv9 (fir(int(CUR1)+Vi(int(CURD,25))mod 25).
After that we may generate L2 = SUb(Li, int((e**)-1(2,5))), V2 = Sub(Vi, int(MD) and calculate CUR3 = m39(pf (8(int(m2)+L2(int(ti2),25))mod 25)9 s(pg (fl(int(CUR2)+112(int(CUR2),25))mod 25).
For any i> 3 and for Li_1 = Sub(Li_2, int((s**)-1(i ¨ 1,5)), = Sub (Vi _2, int (Mi _1)) it may be possible to compute CURL.= mievpf(s(int(mi-i)+Li-i(int(mi_i),25))mod25)ED
(DT Wint(CURi_i)+Vi-i(int(CURi_i),25))mod 25).
Elements of CUR* are computed in accordance with the procedure presented in section "Iterated transformation" of the invention. First, based on 4, t and tl it is possible to compute CURI= CUR1E9cpr (a(tI+L*0(tI,2n))mod 27)(B(pg,,o3(t;4-L0(t1,271))mod 2n).
We note that Lo was used for the calculation of CURi.
Then it is possible to compute LI = Sub(L*0, int(CURI)) and calculate CUR; = CUR2a)(pr(8(int(CUR1)+14.(int(C(JR1),25))mod 25)@
9vg.(p(inocuRD+Li(inocuRt),25))mod 25).
For any i > 3 and for /4_1= sub(g_2, int(cuRt_i)) an expression for CURt may be written in a form CUK = CURiED(pr(o(int(cuRi_i)+4_i(inocuRi_) 1,25))mod 25)@
$(4,9*(p(int(cuR;_o+Li_i(inocurq_,),25))mod 25).
Further, as it was specified by Sfl table (82') elements of a filter Ei4(*) are involved in computation of elements of CUR**. Again, based on L*0*, q* and t it is possible to compute CUR j." = CURIevf**(8(tri-L*0*(tr,25))mod 25 )9(pg* ((I (t** +14)(t;*,25))MOd 25).
Then El* = Sub(L*0*, int(E14(*)(1,5))) may be calculated and it may be possible to continue the computation CUR;* == CUR;e(pros(inocuR1)+4*(inocuRD,25))mod25)e(pg*(p(cuRr+ei(cuRr,25))mod 25).
Then again Ly = Sub(1,1*, int(E14(*)(2,5))) may be computed and it is possible to calculate CUR* = CUR3* easTr* (6 (tint(CU RD-I-L;* (int(CURD,25))mod 25) elT9* (fii (CURr + L*2 (CURr ,25))mod 25).
In general, for any i > 3 and for Lr_1 = Sub(1412, int(Ei4(*)(i¨ 1,5))) it may be possible to compute CUR* = CU k evr(o(int(cuK_,)+41,(int(cuR_,),25))mod 25) e(pg*(s(cuCi+1.4_,(cuC' i,25))mod 25).
Thus, in a framework of the presented above iterated transformation with filters lithe elements of filters (E**)-1 and ei4(*) are used for updating the collections Li and LI*, i = 0,1, ... , correspondingly.
It may be noted that the updating condition I presented above needs to be slightly adjusted for the presented iterated transformations with filters II. The adjusted condition of updating bit strings is presented below.
In general, assume that for some s 0 and 1 < ms < 2, Subs(*)(2n, ms) is a collection of some non empty subsets associated to CURS(*) and eis(*), i = 1, ..., ms is a collection of bit strings related to CURS(*) . Assume that a table S f 1 contains pairs (s[i], ui), i = 1, ...,m. Then for any j 1 after computing an element CUR;(*) a procedure of updating any bit string s(*) CUR*) ei , i = 1, ..., ms is not applied until the computation of elements CUR, and updating all collections Lt), i = 1, ...,m are completed.
In an embodiment of the present invention the described above condition of updating bit strings will be referred to as the S ft-condition.
Thus, applying the presented above iterated transformation with filters II
with the corresponding S f 1 tables, a ciphertext may be generated in a way similar to the process of generating a ciphertext in the case of iterated transformations with filters I
presented above.
However in this case the Sf/-condition should hold during the process of generating a ciphertext.
A decryption procedure for the iterated transformations with filters II is similar to the decryption procedure for the iterated transformations with filters I presented above. However, the computation of the elements of the transformations degrees of which are specified by Sfl table, should be performed in accordance with presented above procedure. The Sfl tables become a part of IV.
It is also important to note that the updating of bit strings during the decryption procedure in the case of the iterated transformations with filters II should be performed in accordance with the Sf/-condition presented above.
11. Iterated transformations with filters III
In an embodiment of the present invention it may be possible to apply both -iterated transformation with filters I and iterated transformation with filters II
applied simultaneously in a framework of an iterated transformation. It may be done by applying the corresponding schemes of embedding filters into transformations of various degrees. The combination of the two schemes applied in a framework of an iterated transformation further increasing difficulty of analyzing the influence of filters during the process of the generation of a ciphertext.
Without losing generality it may be possible to illustrate a combination of two methods of applying filters into computation of transformations of various degrees by using the Continuation of Example I.
Thus, assume that a table Sfl consisting, for example, of pairs (82') is defined. In accordance with (82') the transformations of degrees 0 and 2 may be computed with involvement of filters (E**)-1 and Ei4(*), correspondingly. The procedure of the computation of elements of CUR and CUR** with involvement of filters (e.)-1 and Ei4(*) specified by a table Sfl containing pairs (82') was presented above, in section "Iterated transformations with filters II".
Assume, further that a table Dfl with the following pairs (82") (2,5), (4[21 1) is defined as well.
The computation of elements of CUR and CUR** with the involvement of filters (E**)-1 and 4(*) Ei specified by a table Sfl containing pairs (82') is presented above.
Now it is possible to realize the computation of elements CUR* and CURS(*) with involvement filters E** and E in accordance with the construction presented in section "Iterated transformations with filters I". In other words, based on L*0, ti* and t; it may be possible to compute CUR i* = (CUM) (4)(1,5)))@(pf* (5(tI+4)(tI,2n))7n0d 271 ) (91,9*(13(t;+Lo(t2n))mod 2n).
Once again, Lo was used for the calculation of CURi. Then it may be possible to calculate 14= Sub(L*0, int(CUR)) and continue CUR = (CUR2e)(s24(*)(2,5)))0(pr(s(int(CUR1)+4(int(CUR1),25))mod 25)@
e(pg* 03(int(cuR)+Liont(cuR),25))mod 25).
For any i> 3 and for /4_1 = Sub(14_2, int(CURt_i)) it may be computed CUR t = (CUR09(El(*)(2,5)))SVf* (s(tint(CURi_i)+14_1(int(CURi_i),25))mod 25)ED
g* 03(int(CU4_,)+Li_1(int(CURi),25))mod 25).
Computation of elements of CURS(*) may be realized by (56) and (57).
It may be noted that during generation of a ciphertext updating of bit strings should be performed in accordance with the updating condition I and Sf/ -condition presented above.
Specifically, all filters (bit strings) presented in Sfl table should be updated in accordance with Sf/ -condition, while all filters (bit strings) presented in Dfl table should be updated in accordance with the updating condition I. It is possible that one and the same filter may be presented in both Dfl and Sfl tables. In this case the updating of the corresponding bit string should be performed in accordance with the condition (updating condition I and Sf/-condition), in accordance with which the updating may be performed on a later stage. In other words, if updating of a bit string in accordance with the updating condition I may be performed earlier than updating in accordance with the Sf/-condition, then the Sf/-condition should be applied, otherwise updating should be performed in accordance with the updating condition I.
A decryption procedure for the iterated transformations with filters III is the same as decryption procedure with filters - it is necessary just to use Sfl and Dfl tables in order to use the elements of the corresponding filters during the computation of elements of the transformations of the specified by the tables degrees. The schemes of embedding the elements of filters specified by tables Sfl and Dfl into the transformations of the corresponding degrees were presented above, in sections "Iterated transformations with filters II"
and "Iterated transformations with filters I", respectively. Updating procedures of all bit strings should be performed with firm execution of the filters updating condition II (applied to the filters presented in Dfl table) and the Sf/-condition (applied to the filters presented in Sfl table). If a filter is presented in both tables, then the updating of the corresponding bit string should be performed in accordance with the condition (updating condition II and Sfl-condition) in accordance with which the updating may be performed on a later stage.
12. Iterated transformations with filters with switchers I
In an embodiment of the present invention filters with switchers I may be presented. Applying switching of filters allows realizing a scheme of encryption where one and the same keystream may be used in transformations of different degrees in different periods of generating a ciphertext. The switching may be applied simultaneously to a few filters used during encryption of a message.
Without losing generality it is possible to illustrate filters with switchers based on Continuation of Example I. In a framework of the Continuation of Example I
consider an iterated transformation of degree 6 with filters based, for instance, on a table Dfl containing pairs (2,0), (2-i, 5), (4[1], 1), (4[2], 4).

During the process of the computation of elements of iterated transformations with filters, elements (83') e**(1,5), e* (2,5), E** (3,5), ...
are used in the calculation of elements of collection CUR; elements (83) E14(*) (1,5), Ei4(*) (2,5), 8:(*) (3,5), ¨
are used in the calculation of elements of collection CUR* ; elements (84) E24(*) (1,5), El(*) (2,5), Ei(*) (3,5), ¨
are used in the calculation of elements of collection CUR4(*) and elements (85) (E**) -1(1,5), (E**) -1 (2,5), (E**) -1(3,5), ¨
are used in the calculation of elements of collection CURS(*).
Assume now that we want to construct a few Dfl tables, each of which defines "action" of filters by collections of elements. For instance, it is possible to write a table D f /1 with pairs (2,0)(10), (2-1", 5)(n), (4[1], 1)0.0), (4[2], specifying that the first ten elements of the filters E** , (E**)-1, Ei4(*) and E24(*) are set up for the transformations of degrees 0, 5, 1 and 4, correspondingly.
Then, for example it is possible to consider a table D f 12 with pairs (2,1){3}, (2-1, 3)[3), (4[1], 0)[3), (4[2], 6)0}
specifying that three elements (starting from the 11-th element in each filter) of filters e**, (),e' and E24(*) are set up for the transformations of degrees 1, 3, 0 and 6, respectively.
Next, for instance it is possible to write a table Df 13 with pairs (2,1)(21), (2-1, O)[m), (4[1], 4){21}, (4[2], 51 -,(21) specifying that starting from the 14-th element in each filter twenty one elements of filters E** , (E**)-1 , Ei4(*) and E24(*) are set up for the transformations of degrees 1, 0, 4 and 5, respectively.
Eventually it is possible, for example, to define a table D fl4 with pairs (2,6){17}, (2-i, 4){17}, (4[1], 5)(17), (4[2], 0)(171 specifying that starting from the 35-th element in each filter seventeen elements of filters E**, (E**)-1, Ei4(*) and E24(*) are set up for the transformations of degrees 6, 4, 5, and 0, respectively. Finally the fifths table Df 15 consisting of pairs (2,0){10}, 5)(10), (4[1], 1)(10), (4[2], 4)(10) may be defined. The meaning of D f is is the same as Df/l, however ten elements of the filters E** , (E**)- , E;1(*) and E24(*) that are set up for the transformations of degrees 0, 5, 1 and 4, correspondingly, are generated starting from the 52-nd element in each filter.
A collection of elements of each filter in each table presented above will be called cycles.
Thus, the first cycle of a filter E** (that is, a collection of elements of a filter E** in a table Df/i) consists of ten elements, while the second cycle of a filter E** (that is, a collection of elements of a filter E** in a table D f12) consists of three elements.
Instead of writing five tables Dfli,i = 1, ... ,5, it is possible to write four tables Dsw for each filter and to point out cycle by cycle four degrees of the transformations, for which the cycles are defined, specifying the number of elements in each cycle. For instance, for E** it is possible to write a "path of action" for the corresponding cycles by writing (86) Dsw2 (Om), 43), 1(21), 6(17), 0(10)) which can be interpreted that filter E** is set up for the transformation of a degree 5 for the elements of the first cycle consisting of ten elements, then filter 8** is set up for the transformation of a degree 1 for the elements of the second cycle consisting of three elements, then filter E** is set up for the transformation of a degree 1 for the elements of the third cycle consisting of twenty one elements and eventually filter E** is set up for the transformation of a degree 6 for the elements of the fourth cycle consisting of 17 elements. After that a filter E** is set up again for the transformation of degree 0 for the elements of the fifth cycle consisting of 10 elements, and so forth. In an embodiment of the present invention Dsw table (86) will be referred to as table of switching for a filter E**.
The following table of switching may be presented for a filter (E**)-1 (86') Dsw2-1 (5{10}, 3(3), 0(21), 40.7}, 5(10)), where index 2-1 indicates that the cycles of a reverse filter related to CUR**
are presented in the table.
It is possible also to write the following table of switching for a filter (87) Dsw4[1] (1{10}, 0{3}, 4{21}, 5(17), 1{10}) while the table of switching for a filter E24(*) may be presented as follows (87') Dsw4[2] (4{1o, 6{3}, 5(2* 0(1* 4{j13))=
We may say in this case that filters with switchers, or filters with switching are set up for an iterated transformation, or, simply ¨ switchers, or switching are organized for an iterated transformation. Tables (86), (86'), (87), (87') will be referred to as tables of switching, or tables of switchers and the number of cycles in a table of switching will be called a period of switching.
Thus, tables of switching (86), (86), (87) and (87') have periods of switching 5. The number of elements in each cycle will be called a period of a cycle. Thus, periods of all first cycles of all filters with switching are ten, the periods of all second cycles of all filters with switching are 3, and so forth.
It may be noted that switching may be organized even for one bit string. For example, it may be possible to use an encryption scheme with a table D f 1 containing pairs (2_1,5), (4[1],1), (4[2],4) and also to use just one table of switching for a filter E**

DSW2( 3[15), 0[23), 6[21), 0(7}, 3(150 that has switching period 5.
At the same time, any number of bit strings may be simultaneously organized as filters with switching. It may be also possible to use filters with and without switching within one and the same iterated transformation procedure. For instance, it may be possible to use an encryption scheme with a table Dfl containing pairs (2-1-, 5), (4[1], 1), (4[2], 4) and also to use two tables of switching Dsw2 3 ( {is}, 0(23), 6[21), 3[15)) and Dsw4[2](6(15), 3(23), 0(21), 6(15)).
Both switching tables have a switching period 4.
In general, if the number of filters set up with switching is more than one, the elements of the same cycles of the filters with switching should be set up for the transformations of different degrees.
On the other hand, it is possible to set up filters with switching using Dsw tables with different periods. For instance, it may be possible to use again an iterated transformation with a table Dfl containing pairs (4[1], 1), (4[2], 4) and define two tables of switching Dsw2( 60.5), 3(23), 6(5), 3(3), 6(15)) and Dsw2-1( 5{25), 0(17), 5(25)) =

It may be noted that a table Dsw2 has a switching period 5, while a table Dsw2-1 has a switching period 3. However, in this case tables Dsw2 and Dsw2-1 specify different collections of degrees of transformations.
Switchers may be also organized for the filters presented in section "Iterated transformations with filters II". Indeed, consider S f 1 table containing pairs (2-1, 4), (4[1], 5).
It may be possible, for example, to define two switching tables Ssw2( 0(25), 3 (2o), 6(15), 2(10), 0(25)) and Ssw4[21(2[25}, 6(20), 0(15), 3tio}, 2(25}).
We denoted the tables by Ssw to emphasize the fact that the filters presented by the tables and involved into the computation of the iterated transformations of the corresponding degrees in accordance with the specified cycles, are applied into the computation of the transformations in a way described in "Iterated transformations with filters II".
Thus, switching table Ssw2 may be interpreted as 25 elements of a filter E**
are used in updating collections L1, L2, ..., L25 in accordance with Li = Sub (Li_i, int(E**(i, 5))) = 1, ,25 , then next 20 elements of the filter are used in updating collections L3(*) L3(*) L3(*) bY
26 ; 27 "" 45 -3(*) L*) = Sub (I. int (E** (i, 5))) = 26, ... ,45. After that 15 elements of the filter starting from the 46-th element are used in 6(*) updating collections L64(:), L64(;), , L60 and so forth. Table Ssw4[2] may be interpreted by analogy.
It may be also noted that, for example, collections L26, L27, ... may be updated by L26 = Sub(L25, int(CU R26)), L27 = Sub(L26, int(CU R27)), and so forth, up to the moment when starting from a collection L96 elements of a filter may be used again.
Thus, an encryption procedure for the scheme with filters with switchers I is the same as an encryption procedure, for instance, for the iterated transformations with filters I. Of course, the corresponding switching tables that become a part of IV should be used in order to apply the elements of the corresponding cycles to the transformations of appropriate degrees. Updating procedure for the filters (bit strings) has to be performed in accordance with updating condition I
and S ft-condition.
On the other hand, a decryption procedure for the scheme with filters with switching is the same as a decryption procedure with filters - it is just necessary to use the corresponding switching tables in order to apply the elements of the corresponding cycles to the transformations of the degrees defined by the switching tables. Updating procedure of all bit strings should be performed with firm execution of the filters condition II. It is necessary to take into account that the elements of the different cycles are set up for the transformations of different degrees, so the procedures of updating filters should be applied in different moments for different cycles in strict accordance with the updating filters condition II and S f /-condition for each cycle.
In general, the greater period of switching and the more filters with switching are arranged the harder to analyze and to break the encryption algorithm.
13. Iterated transformations with filters with switchers II
In an embodiment of the present invention one more scheme of applying filters with switchers may be presented. In a framework of forming filters with switchers II filters may be generated by applying a splitting with jumping procedure with any jumping distance to the corresponding bit strings.
Without losing generality the procedure of forming filters with switchers II
may be presented using the Continuation of Example I presented above.

In a framework of the Continuation of Example I presented above consider iterated transformations of degree 6 with filters based, for instance, on a table Dfl containing pairs (87-) (2,0), (2-1, 5), (41, 1), (42, 4).
By 41 and 42 we denoted filters Ei4(*) and E24(*), correspondingly, associated to CUR4(*).
Assume, next, that we wish to "split" a table Dfl containing pairs (87-) into a collection of Dfl tables containing the following pairs (88) (2(1),0), (2-1(45), (41(1), 1), (42 (1),4) (89) (2(2),5), (21(2),1), (41(2), 6), (42 (2),0) (90) (2(3),3), (2_1(3),4), (41(3), 5), (42(3),1) (91) (2(4),6), (2-1(4),0), (41(4), 2), (42 (4),1) (92) (2(5),5), (2 -1 (5),3), (41(5), 2), (42 (5),1) (93) (2(6),1), (21(6),6), (41(6), 0), (42(6),5) (94) (2(7),4), (2" (7),0), (41(7), 1), (42 (7),2) (95) (2(8),3), (2_1(8),1), (41(8), 4), (42 (8),5) (96) (2(9),6), (2_1(9),4), (41(9), 0), (42(9),3) (97) (2(10),5), (2' (10),1), (41(10), 2), (42(10),6) (98) (2(140), (2-1(11),5), (4(11), 1), (42(144) where 2(1), 2(2), 2(3), ... are, correspondingly, the first, the second, the third and so forth elements of a filter E**, 2-1(4 2-1(2), 2-1(3), ... are, correspondingly, the first, the second, the third and so forth elements of a filter (E**)-1, and 111(1), 41(2), 41(3), ...
are, respectively, the first, the second, the third and so forth elements of a filter Ei4(*) and 42(1), 42(2), 42(3), ... are, correspondingly, the first, the second, the third and so forth elements of a filter However, instead of writing tables (88)-(98) it is possible to write four switching tables SWti, SWt2 SWt3 and SWt4 containing the degrees of the transformations, in computation elements of which the elements of the corresponding filters were involved.
Thus it is possible to write (99) (0,5,3,6,5,1,4,3,6,5,0), (100) (5,1,4,0,3,6,0,1,4,1,5), (101) (1,6,5,2,2,0,1,4,0,2,1), (102) (4,0,1,1,4,5,2,5,3,6,4), Thus, a switching table SWti specifies that elements 2(1), 2(2), 2(3), ... of a filter E** are used during the generation of the first, the second, the third and so forth elements of the transformations of degrees, correspondingly, 0,5,3 and so forth. A switching table SWt2 specifies that elements 2-1(1), 2-1(2), 2-1(3), of a filter (E**)' are used during the generation of the first, the second, the third and so forth elements of the transformations of degrees, correspondingly, 5,1,3 and so forth. Switching tables SWt3 and SWt4 may be interpreted analogously It may be noted that elements 2(11), 2-1(11), 41(11) and 42(11) are used in transformations of degrees 0, 5, 1, 4, correspondingly, and elements 2(12), 2-1(12), 41(12), 42(12) again are used in generating the 12-th elements of transformations of degrees 5, 1, 6, 0, correspondingly.
The number of elements in a table SWti, i = 1, ... ,4 will be referred to as a period of switching. Thus, periods of switching of all four switching tables (99-102) are equal to 11. We used notation SWti, i = 1, ...,4 for switching tables different from notation Dsw used in section "Filters with switchers I" presented above. This was done to emphasize the difference between two methods of organizing filters with switching.
In an embodiment of the present invention different switching tables may have different periods of switching and switching tables may contain repeated elements.
A decryption procedure for the scheme with filters with switching II is similar to the decryption procedure with filters I presented above. However, the switching tables should be used in order to apply the corresponding elements of the corresponding filters to the transformations of the degrees specified by the switching tables.
In an embodiment of the present invention updating procedure of all bit strings should be performed with firm execution of the filters condition II for all stages of computation of various elements of transformations of all degrees.
In general, the greater period of switching and the more filters with switching are arranged, the harder to analyze the encryption scheme.
We may say that two ciphers have different inner structures if they have different either Df 1, Sfl, Dsw,Ssw, or SWt tables, or different collections of the tables, or the iterated transformations realized in the ciphers have different degrees, or the ciphers have different numbers of bit strings. We may also say that two ciphers with iterated transformations of the same degrees and the same numbers of bit strings have different inner structures if the bit strings are related to transformations of different degrees.
14. Applying a changing indices procedure In an embodiment of the present invention applying a changing indices procedure to the Orange cipher with filters and with filters with switchers may be presented.
Applying the changing indices procedure in the Orange cipher, in general allows speeding up both - software and hardware implementations of computing transformations of various degrees.
On the other hand, applying the changing indices procedure leads to further deterioration of the analysis of possibilities to attack the cipher, as transformations of different degrees should be analyzed "individually" and, therefore, no general scheme of analysis will be possible to apply to all transformations.
If the changing indices procedure is applied, then vectors (14), that is, vectors ADF,ADS,ADT,ADL,ADV,...,ADFd(*),ADSd(*),ADTd(*),ADLd(*), containing, respectively, 1. b1, b2, b3, b4,b3, b6, bid(*), b2d(*), b3d(*), b4d(*), b5d(*) polynomials of degrees less than n may be specified.
When vectors (14) are specified the expressions for calculating elements of collections CUR,...,CURd(*),d> 2 should be modified in accordance with the procedure presented in "Changing indices" section of the present invention. The main steps of the encryption procedure - a key processing, the first and the second stages of the generation of a ciphertext of a message M, are not changed.
If the changing indices procedure is applied during encrypting a message, the corresponding modifications (with specified vectors (14)) should also be applied for calculating elements of collections CUR*), CURd(*)-1,...,CUR, d> 2 during decrypting a ciphertext. In particular, expressions (78 - 81) and those without numeration may be modified and the modification depends on the specified vectors (14), while the whole process of decryption is not changed.
G. Parameterization of the Orange Cipher In an embodiment of the present invention the process of parameterization of the described above cipher may be presented. The aim of the parameterization is to generate a wide class of the ciphers with different properties. There are a few possibilities to parameterize the cipher.
1. Parameterization of the speed of the cipher In an embodiment of the present invention parameterization of the speed of the cipher may be achieved by choosing splitting with jumping and defining mappings cp with the larger jumping bit distance (see the section "Splitting with jumping I, II"). Maximum speed of a cipher will be in the case of splitting with maximum jumping.
2. Parameterization of security of the cipher In an embodiment of the present invention it is possible to point out a few possibilities of increasing security of the cipher.
i) Security of both - ciphers without and with filters may be increased by increasing a degree of the iterated transformation. A cipher, which is based on the iterated transformation of degree, say 10 is more secure than a cipher that is based on the iterated transformation of degree 5.
ii) Security of both ¨ ciphers without and with filters may be increased by increasing a degree of splitting with jumping n, which, in turn leads to increasing a size of a key K.
iii) Security of a cipher with filters may be increased by increasing the number of bit strings and increasing the number of filters. In general, it is preferable to prepare one bit string for each transformation of different degrees, than to prepare a few bit strings for a transformation of one degree.
iv) Security of a cipher with filters may be increased by increasing the lengths of prepared bit strings that are used as filters.
v) Security of a cipher with filters with switchers may be increased by increasing the number of filters with switching.
vi) Security of a cipher with filters with switchers may be increased by increasing a period of switching.
vii) Security of a cipher with filters and a cipher with filters with switchers may be increased by applying the changing indices procedure.
It may be emphasized that presented above steps ii, iv, vi do not lead to rapid increase in consumed memory. At the same time all steps i-vi practically do not reduce the speed of the cipher in a case of hardware implementation, or software implementations with large number of independent processors. In the case of software implementation with a few processors steps ii, iv, vi do not lead to rapid decrease in the speed of the cipher and steps iv and vi do not lead to rapid increase in consumed memory. In general, step vii may lead to increasing the speed of both ¨
software and hardware implementations of a cipher.
H. Customization of the Orange Cipher In an embodiment of the present invention a method of generating ciphers by changing their inner structures and parameters of initial values (IV) is presented. This procedure is referenced as customization of the ciphers. There is a fundamental difference between the procedures of parameterization and customization of the ciphers. Parameterization is the procedure of varying the security, the speed, or the memory consumption of the cipher algorithm, while customization is the procedure of generating ciphers with different inner structures or different parameters of IV while keeping approximately the same level of security, speed, memory consumption, etc. In an embodiment of the present invention varying methods of performing customization may be achieved.
1. Varying vectors Vo, Lo, L*0,...,L*) Varying the vectors (using just Ran(2n) collections) it is possible to generate ((2n)D2 ciphers with different parameters of IV. For example, for n = 5 and d= 6 it may be possible to ( generate (32!)8 ciphers with different collections of vectors 170, Lo, L*0, , L*)o .
2. Varying generators and irreducible polynomials of degree n For any chosen n there are 4)(2n ¨ 1) generators of a cycle group GF* (2n).
For example, for n= 5 there are 30 generators of GF* (25). Thus, there are a lot of possibilities to use different generators in transformations of different degrees. Besides, it is possible to use different irreducible polynomial of degree n, modulo of which the corresponding cyclic groups are generated.
3. Varying isomorphisms of vector spaces Varying isomorphisms vi and (pi , where i = f, f*, , fd(*) and j = g,g*,..., gd(*) it is possible additionally to increase the number of the ciphers with different structures.
4. Varying distribution of bit strings between transformations of various degrees Assume that a degree of the iterated transformation of a cipher is d and assume, further, that m bit strings, where d m are prepared for some of the transformations. It is possible to consider (d+,71) possible combinations of distributing the bit strings between transformations of different degrees. This leads to changing the inner structure of the corresponding cipher.
5. Varying tables of filters By varying D fl and S f 1 tables it is possible to change the inner structure of a cipher.

6. Varying switching tables Varying Dsw, Ssw and SWt tables leads further to changing the inner structure of a cipher.
7. Varying mappings ai and tables Ai during updating bit string procedures Varying mappings ai and tables Ai using the procedure presented in section "Bit strings generating procedure I" presented above and varying tables Ai using the procedure presented in section "Bit strings generating procedure II" presented above gives a lot of possibilities to generate different ciphers with filters and ciphers with filters and switchers.
8. Varying vectors of the changing indices procedure.
Varying the content (that is, the polynomials of the corresponding degrees) of the vectors of the changing indices procedure and the sizes of the vectors allows additionally diverting constructions of a cipher.
We will refer the changeable parameters presented in 1-8 above to as the customization parameters.
In an embodiment of the present invention it may be possible to generate practically unlimited number of the Orange ciphers with different IV parameters, or different inner structures by varying the customization parameters.
J. Motivations and Elements of Analysis In an embodiment of the present invention the analysis of security and motivations of various constructions of the Orange cipher is presented. The elements of analysis reflect "security engine" of the Orange cipher, while motivations explain importance of various elements of the cipher.
It may be stressed that all three types of the Orange cipher, namely, the Orange cipher without filters, the Orange cipher with filters and the Orange cipher with filters with switching are stream based construction in both encryption and decryption. Moreover, the speeds of encryption and decryption procedures are practically the same, as main calculations (transformations of various degrees) in both cases are the same (just two terms are switched). The complexities of both encryption and decryption are practically the same.
1. Motivations for the Orange cipher without filters It may be possible to start analyzing, firstly, a cipher without filters. In accordance with presented above encryption scheme a ciphertext of a message M is a sequence of bits (103) CUR*) II CUR2d(*) II -= II CUR*) II CURd(*) CURd(*) II s1 II LB, Tp where si is a sequence consisting of s bits 1, s = NBC mod 8, 0 s < 8 and NBC
is a number of bits of a sequence (104) CUR*) II
CUR2d(*)II-=II CURid(*) II CURd(*) CURTpd(*) T1 =
As a key K was processed before the first element of a ciphertext CUR*) was generated, it means that all elements (105) === Wv CURRi, CURR2,...,CURRõ, CURR1,CURR2*,...,CURRv*, d(*) d(*) CURRi , CURR2 , CURRvd(*) are not known to an adversary. It may be possible to emphasize, that during processing a key K, collections (106) LL,14 (*) E, t) === L
where i = 1, ..., v are also generated in accordance with the iterated transformation procedure presented above. As the size of a key is at least n2n for a splitting degree n it means that, firstly, all elements of ift, will be replaced by the corresponding integers extracted from a key K, secondly, all elements of collections L 1 , L*1, , Ldv(*) will be also replaced by the elements of the transformations of the corresponding degrees. The size of a key n2' guarantees that all elements of initial collections Lo, Vo, L*0, Ldo(*) will be replaced when elements (105) are generated.
The circumstance is exactly the motivation for establishing the presented above relation between a degree of a splitting with jumping and the size of a key K. Indeed, size n2n of any chosen key K is a minimal size that guarantees that all elements of Vo will be replaced by the corresponding integers extracted from a key in the result of applying a splitting with jumping procedure and therefore all initial elements of collections Lo, Vo, , Lao(*) will be replaced by the corresponding elements computed during processing a key K. In other words, thanks to the choice of the size of a key, an adversary should not expect that some elements of initial collections Lo, Vo, ro, , Lcoi(*) will not be replaced after processing a key K. Thus, if an adversary does not know a key K, then the adversary does not know elements (105) and (106).
To attack a key K using a brute force an adversary has to try 2' n-bit words.
Thus, for n--5 an adversary has to consider possible variants of 32 5-bit words in order to guess I/0.
On the other hand, based on CUR*) an adversary needs to find a way to compute step by step elements CURid(*)-1, CURid(*)-2, CURi and eventually M1.
Consider expression for CUR*). In accordance with the iterated transformation procedure we have (107)CUR d(*) = CURd(*)-1 "
1 gip d( d( cpfd(.) (8(int(CURRd(*)-1I )+L*) i (int(CURR*)-1I ),2n ))mod 2n) 13) 61,0õ, ) .(*, (fl(int(cuRRP))4(*)-1(int(cuRRP)),2nnmod 2n from which it is possible to obtain CURid(*)-1 by (108)cl( CURd(*)-1 = CUR*) ED

(Pfd(* (ug (tint(CURRd, (*)-1)+ LI(*) (int (C U RR1(*)-1),2n))mod 2n) ) e(pgd(*) (13 (tint(CU RRcl(*))+ LI(*)-1(int(CURIRciz(*)),2n))mod 211).
d(*) d(*)-1d(*) However an adversary does not know elements CURRI , CURRI
and collections L1 and Ld(*)--. This why terms (109) ()Ofd(*) (8 (int(C U RRP)-1)+Ldi(*) (int (CU RR*)-1),2nDmo d 21%) and (110) vgd(-) p (r) (int (CU R4(*))+ 41(*)-1 (int(C U R 12c1(*)),2nDmo d 2) cannot be computed by an adversary. Applying a brute force in order to "check"
various combinations of unknown elements (n-bit words) in terms (109) and (110) an adversary needs to consider x1 n-bit words, where 22n < x1 < 2 in order to complete the search.
Next, considering CURid(*)-2 = CURid(*)-1 Pd(*)-i r(int(CURRd(*)-2\-,-Ld(*)-1(int(CURRrs)-2),2n))mod 2n) 09 129 (f 1 ED
(P9d(*)-1 p(int(CURR*)-1)+4(*)-2 (int (CU RRcel(*)-1),2n))mod 211 an adversary needs additionally check x2 n-bit words, where 2' < x2 < 23n for checking all the possibilities for CURRid(*)-2, Ldi 00-1 (int(C (J RRid(*)-2)) and L*)-2 (int(CURRid(*)-1)) for each variant from a collection containing x1 possibilities.
2. Motivations for Orange cipher with filters The security of the Orange cipher with filters is sufficiently increased even for relatively small degrees of the iterated transformations.

Firstly, it is important to note that during processing a key K a collection of bit strings is updated based on a collection of elements (105) and the bit strings are involved into the computation of elements (105). Considering, for instance, Example I and taking into account that the sizes of all the bit strings are 200 bits, 32 bits of bit string E** will be flipped (from 0 to 1) and totally 32 bits in both bit strings El.(*) and E24(*) will be also flipped after the key processing is completed.
Moreover, as filters are set up from the beginning of processing a key K, a collection of elements (105) in the case of the iterated transformation with filters may differ from the same collection (105) obtained by applying an iterated transformation without filters.
Considering a ciphertext CUR*) d(*) d(*) d(*) d(*) CURi CUR2 === CUR*) II CURTI II-11 CUR*) II II LB
of a message M and starting from CUR*) an adversary needs step by step to compute elements CUR, CURd(*)-2 , , CU R1 and eventually M1 . However, an adversary cannot use d ( expressions (109) and (110) trying to "guess" elements CU RRd(*) , CU RB40 -I
and d( L*)i (int(CURRia(*)-1)), Ldi(*)-1(int(CURRid(*))) as the elements are calculated with involvement of elements of set up filters, that is, the corresponding parts of the bit strings.
Therefore, considering various possibilities for the corresponding parts of the filters, an adversary every time has to recompute the whole chain of elements CURia(*)-1, CURia(*)-2, CURi depending on a Df I table. Furthermore, with the calculation of new variants of CUR1a(*)-1, CUR1, CURi new variants of updating the bit strings are arisen. An adversary does not know a key K and, therefore an adversary does not know the modifications (in general, the number of flipped bits is at least 2n) that changed the bit strings after processing a key K. Therefore, in turn, an adversary facing a challenge to "guess" at least 2n updates per bit string of all the bit strings.
It is necessary also to stress that in accordance with the forming bit strings I and forming bit strings H procedures presented above, changing one position of updating even one bit strings leads to changing all positions in all bit strings starting from the moment of the changing. As the sizes of bit strings may be up to a few hundreds of bits, and, in general, the number of bit strings may be equal up to 271(d + 1), any new variant for any update of any bit string may also potentially influence updates of elements of collections (105) (and collections (106)). Therefore any attempt to track all possible variants for computing the whole chain of elements (111) CURd(*)-1,CURd(*)-2, ..., CURT
becomes extremely difficult. Using iterated transformations with filters with switchers leads to worsening the possibility to analyze and track elements (111).
K. The ER1NDALE-PLUS hashing function with modified main blocks and constructing a stream cipher and MAC based on the modified ERINDALE-PLUS hashing function The ERINDALE-PLUS hashing function consists of a splitting with jumping procedure, an iterated masking procedure, a bit string forming procedure, a padding procedure and a forming the final hash value procedure.
In an embodiment of the present invention the presented below modifications of main blocks of the ERINDALE-PLUS hashing function result in obtaining the modified ERINDALE-PLUS
hashing function with new features. The features increase security of the modified hashing function and also increase the possibility for parameterization and customization of the function.
In an embodiment of the present invention a method of transforming the modified ERINDALE-PLUS hashing algorithm into a keyed hashing function (or MAC) and a stream cipher is presented. Moreover, when a key is involved the modified hashing function may be used for generating a secure hash value (or a MAC-value) of a message, and a ciphertext of a message at the same time.
The type of a stream cipher that it is possible to obtain modifying the ERINDALE-PLUS
hashing function depends on a type of an iterated transformation that one uses for replacing an iterated masking procedure of the ERINDALE-PLUS hashing function.
In an embodiment of the present invention the method of applying various iterated transformation procedures instead of iterated masking procedure used in the ERINDALE-PLUS

hashing function in order to have possibilities to realize various types of ciphers is presented.
Instead of iterated masking procedure in the ERINDALE-PLUS hashing function it may be possible to use the following iterated transformations:
a) The iterated transformations procedure presented above, in section "Iterated transformations" of the present invention;
b) The iterated transformations with filters I, c) The iterated transformations with filters II, d) The iterated transformations with filters III, e) The iterated transformations with filters with switchers I, 0 The iterated transformations with filters with switchers II.
Thus, by applying iterated transformations b) ¨ 0 presented above instead of an iterated masking procedure in the ERINDALE-PLUS hashing function it may be possible to realize the corresponding scheme of encryption with filters and with filters with switchers when a key is involved into the computation.
Processing a concatenation of a key and a message and applying iterated transformation a) a scheme of encryption without filters may be realized. The size of a key should be chosen in accordance with the presented above rule. Processing a concatenation of a key and a message and applying iterated transformations b) ¨ d) in accordance with specified Dfl or Sfl tables, and applying iterated transformations with filters with switchers e) - 0 in accordance with specified tables Dsw,Ssw, and SWt tables, a scheme of the corresponding encryption of a message may be realized. Moreover, tables Dfl and/or Sfl and switching tables Dsw,Ssw, and SWt become a part of initial values (IV) of the ERINDALE-PLUS hashing function. It is also important to apply the presented above filters updating condition I and Sfi-condition during updating bit strings that are used as filters for generating a ciphertext. On the other hand the presented above filters updating condition II and Sfl-condition should be used during updating bit strings that are used as filters for decrypting a ciphertext.
In an embodiment of the present invention modifications of the following main procedures of the ERINDALE-PLUS hashing function may be presented:

i) Two procedures of splitting with jumping described in sections "Splitting with jumping procedure I" and "Splitting with jumping procedure II" of the present invention may be applied in the ERINDALE-PLUS hashing function for realizing splitting with jumping;
ii) Two procedures of forming bit strings described above in sections "Bit strings generating procedure I" and "Bit strings generating procedure II" of the present invention may be applied in the modified ERINDALE-PLUS hashing function for forming bit strings;
iii) A procedure of forming a padding sequence BS presented above in section "Padding procedure" of the present invention may be applied as a padding procedure of the modified ERINDALE-PLUS hashing function.
Thus, described in the present invention two splitting with jumping procedures do not replace the splitting with jumping procedures used in the ERINDALE-PLUS hashing algorithm, they may be used as additional possible constructions for realizing splitting with jumping.
The same takes place for forming bit strings procedures described in the present invention above. It may be also noted that the forming bit strings procedures presented in the ERINDALE-PLUS may be used in the modified version of the hashing function.
At the same time a final hash value generation procedure presented in the ERINDALE-PLUS
may be used in the modified version of the hashing function.
In an embodiment of the present invention a new scheme of computing a keyed hash value, or a MAC-value of a message is presented. The process of computing a keyed hash value (or a MAC-value) may be started with processing a key K, the size of which should be related to the chosen degree of splitting n in accordance with the rule presented in section "Choosing the size of a key" above. By processing a key before processing a message and performing all procedures of hashing a message after that, a MAC-value of the message may be generated.
This is a new method of generating a keyed hash value or a MAC-value of a message is presented.
A ciphertext of a message may be generated by the modified ERINDALE-PLUS
hashing function in accordance with the procedures described in sections "The Orange family of stream ciphers without filters" and "The Orange family of stream ciphers with filters". It means that elements of the transformation of the highest degree generated during the first and the second stage of processing a key, a message and a padding sequence of bits form a ciphertext of a degree message.
In an embodiment of the present invention the presented above modification of the ERINDALE-PLUS hashing function allows realizing simultaneous generation of both a MAC-value and a ciphertext of a message. Moreover, the simultaneous generation of both a MAC-value and a ciphertext of a message may be realized without reducing the speed of the hashing function and without involving any additional memory. To generate both a keyed hash value and a ciphertext of a message it is necessary to save the elements of the transformation of the highest degree generated during the presented above second and the third stages of computation. To create a file based on the collection of the generated elements it may be necessary to form s-bit word consisting of the corresponding collections of bits 1 and 16-bit word LB
(see section "Encryption without filters").
In an embodiment of the present invention when no key is used and a message is processed by the ERINDALE-PLUS hashing function with the applied above modifications, a hash value of a message generated by the modified hash function ERINDALE-PLUS is computed.
To decrypt a message a separate decryption block may be constructed and embedded into the ERINDALE-PLUS hashing function, as it may not be possible to use the ERINDALE-PLUS
hashing algorithm with the modifications presented above for decryption. On the other hand the decryption block may be naturally and easily constructed based on the implemented iterated transformation, as the decryption procedure differs just in rearranging of two terms (see, for instance (39)-(42), or (79)-(81)) in comparing with encryption (or hashing) procedure.
In an embodiment of the preset invention with the presented above modifications of the ERINDALE-PLUS hashing function a partial backward processing may be used for encrypting a message. In this case it is necessary just to invert block by block the decrypted plaintext.
It may be noted that in accordance with presented above, in sections "Parameterization of the Orange cipher" and "Customization of the Orange cipher" it may be possible to construct practically unlimited numbers of ciphers with different IV and different inners structures.
Therefore it is possible to construct practically unlimited Orange stream ciphers (without filters, with filters and with filters with switching) based on the modified ERINDALE-PLUS hashing function and, of course unlimited number of the modified ERINDALE-PLUS hashing functions with different IV and inner structures.
It may be also noted that in general there is no need to apply the presented above modifications to the part of the function, which is not involved in the encryption procedure. In other words, if a direct (or partial backward) processing of a message is used for generation of a ciphertext of a message, there is no need to apply the presented above modifications to the partial backward (or direct) processing of a message.
L. Implementation and Performance As it was presented above any implementation of the ERINDALE-PLUS hashing function with minor modifications may be transformed into an Orange stream cipher.
Therefore performance of the stream cipher may be evaluated by the performance of the ERINDALE-PLUS hashing algorithm.
As both data paths and control paths of the Orange cipher are short (especially when a degree of splitting with jumping n is 4, 5 or 6) it may be possible to use a high frequency in both FPGA
and ASIC. Preliminary estimation shows that ASIC implementation of the ERINDALE-PLUS
hashing function can give speed from 20 to 50+ Gbps.
As the structure of the Orange stream cipher, in general, is simpler than the one of the ERINDALE-PLUS hashing function (a padding procedure of the Orange cipher is more simple, the Orange cipher does not have any backward processing and a final hash value generation procedure) the hardware implementation of the Orange cipher may be realized even more effectively and faster than a hardware implementation of the ERINDALE-PLUS
hashing function.
The speed of a software implementation of the Orange cipher realized on a computer with one processor is close to the speed of SHA 2 family of hash functions. However the speed of the software implementation on a computer with more than one processor may be much higher, as a transformation of each degree may be processed independently and in a parallel way using a separate processor for each transformation. Thus, a software implementation of the Orange cipher with the iterated transformation, for instance, of degree 5 may be very effectively realized on a computer with 4-6 processors. A software implementation of the Orange cipher may be especially effective in servers with many processors, as in this case the stream cipher allows performing the computation of the iterated transformations (with filters and without filters) of various degrees simultaneously. This means that increasing a degree of iterated transformations, that is increasing security of a cipher does not lead to increasing the time of encryption and decryption.
Embodiments of the present invention may be represented as a software product stored in a machine readable medium (also referred to as a computer-readable medium, a processor-readable medium, or a computer usable medium having a computer readable program code embodied therein). The machine readable medium may be any suitable tangible medium, including magnetic, optical, or electrical storage medium including a diskette, compact disk read only memory (CD-ROM), memory device (volatile or non-volatile), or similar storage mechanism.
The machine-readable medium may contain various sets of instructions, code sequences, configuration information, or other data, which, when executed, cause a processor to perform steps in a method according to an embodiment of the present invention.
Those of ordinary skill in the art will appreciate that other instructions and operations necessary to implement the described invention may also be stored on the machine-readable medium. Software running from the machine readable medium may interface with circuitry to perform the described tasks.

Claims (20)

1) A system directed at stream ciphers capable of encrypting and decrypting data characterized in that it comprises:
a) at least one hardware chip having non-volatile memory;
b) a message sent by a sender by way of the at least one hardware chip to a customer;
c) a stream cipher system being operable by the at least one hardware chip for application to a key, a message and a collection of initial values to produce a ciphertext, comprising the following elements:
i) a splitting with jumping procedure;
ii) an iterated transformations procedure that allows widening a class of iterated transformations procedures by changing indices of terms for calculation of the elements of iterated transformations of various degrees;
iii) a bit strings generation procedure having clustering; and iv) a padding procedure.

2) The system of claim 1, characterized in that the stream cipher incorporates an Orange stream cipher.

3) The system of claim 1, characterized in that the stream cipher incorporates a modified ERINDALE-PLUS hashing function comprising the splitting with jumping procedure, the iterated transformations procedure, the bit strings generation procedure, the padding procedure and a final hash value generating procedure such that based on a key, a message and a collection of initial values the function is capable simultaneously generating a ciphertext and keyed hash values of a ciphertext and a message.

4) The system of claim 1, characterized in that the iterated transformations procedure is based on parameters obtained from a collection of initial values, and wherein the iterated transformations procedure is chosen from the group consisting of iterated transformations procedure, iterated transformations with filters, and iterated transformations with filters with switchers.

5) The system of claim 1, further comprising a changing indices procedure wherein the changing indices procedure is applied to the iterated transformations procedure.

6) The system of claim 1, characterized in that the number of the generated bit strings having clustering is based on parameters obtained from a collection of initial values.

7) The system of claim 1, wherein the stream cipher further comprises characteristics of speed, security and used memory, wherein the speed, a level of security and used memory are adjustable.

8) The system of claim 1, wherein a customization procedure is applied to the stream cipher, which allows constructing the stream cipher in accordance with chosen collections of customization parameters.

9) The system of claim 1, wherein the splitting with jumping procedure has a degree applied to an initial message produces a splitting with jumping output; and wherein the degree of the splitting with jumping procedure determines a range of the sizes of the key.

10) A computer-implemented method of encrypting a message characterized in that it is comprises the following steps:
i) applying to a key, a message and a collection of initial values a splitting with jumping procedure to generate a splitting with jumping outputs, an iterated transformations procedure to generate transformation outputs of various degrees and a ciphertext, said iterated transformations procedure chosen from the group consisting of iterated transformations procedure, iterated transformations with filters and iterated transformations with filters with switchers; wherein the iterated transformations procedure further comprises the changing indices procedure;

ii) applying a bit strings generation procedure having clustering to the splitting with jumping outputs and to transformation outputs of various degrees to generate bit strings outputs, wherein the clustering is a part of a collection of initial values;
iii) applying a padding procedure to the transformation outputs and bit strings outputs to generate padding outputs;
iv) processing the splitting with jumping outputs and to generate a ciphertext by applying a procedure comprising an iterated transformations procedure, a bit strings generation procedure having clustering and a padding procedure.

11) The method of claim 10, characterized in that the stream cipher incorporates an Orange stream cipher.

12) The method of claim 10, characterized in that the stream cipher incorporates a modified ERINDALE-PLUS hashing function that is based on a key, a message and a collection of initial values capable of simultaneously generating a ciphertext and keyed hash values of a ciphertext and a message; said modification of the ERINDALE-PLUS hashing function comprising, a spitting with jumping procedure, the iterated transformations procedure, a forming bit strings procedure having clustering, the padding procedure and a final hash value generating procedure; said iterated transformations procedure chosen from the group consisting of iterated transformations procedure, iterated transformations with filters and iterated transformations with filters with switchers; wherein the iterated transformation procedure incorporates changing indices procedure.

13) The method of claim 10, wherein the speed, level security and consumed memory of the stream cipher are adjustable.

14) The method of claim 10, characterized in that the degree of the splitting with jumping determines the range of the sizes of the key.

15) The method of claim 10, wherein a changing indices procedure is applied to the iterated transformations procedure.

=

16) The method of claim 10, wherein a customization procedure is applied to the stream cipher;
said customization procedure allows constructing the stream ciphers in accordance with chosen customization parameters.

17) A method of use for encryption and decryption of a message, the method comprising:
a) applying a stream cipher to a key, a collection of initial value and a message to produce a ciphertext output utilizing the following elements:
i) a splitting with jumping procedure ii) an iterated transformations procedure;
iii) a bit strings generating procedure having clustering;
iv) a padding procedure;
b) applying a decipher to a key, a collection of initial values and a ciphertext to produce a plaintext.

18) The system of claim 1 further comprising a decipher system that based on a collection of initial values and a key capable to decrypt a ciphertext to produce a plaintext.

19) The system of claim 1 wherein the hardware chip is selected from a group consisting of a computer, one or more FPGA chips, and one or more ASIC chips.

20) The method of claim 10 wherein the hardware chip is selected from a group consisting of one or more computers, one or more FPGA chips, and one or more ASIC chips.