CN101567783B - Elliptical curve encryption and decryption method and device based on II-type Gaussian base field - Google Patents

Abstract

The invention is suitable for the field of information security and provides an elliptical curve encryption method based on an II-type Gaussian base field. The method comprises the following steps: inputting a command to acquire a public key Db and a generation element P; generating a random number K1; calculating the value of the K1P and the value of the K1Db; encrypting the plaintext information embedded into an elliptical curve by taking R=K1Db as an encryption key, and sending the K1P and the cipher text obtained by encryption to the decryption part. Because the dot product operation of base field elements with the maximum time consumption is optimized, the elliptical curve encryption method only needs 143.8 milliseconds in one time of the process of ECC encryption and decryption, and compared with the 351 milliseconds required by the one time of the process of ECC encryption and decryption, the speed is increased by more than 2 times.

Description

A kind of ellipse curve encryption and decryption method and device based on II type Gaussian base field

Technical field

The invention belongs to information security field, relate in particular to a kind of ellipse curve encryption and decryption method and device based on II type Gaussian base field.

Background technology

Elliptic curve cipher (Elliptic Curve Cryptography; ECC) encryption principle is based on (the Elliptic Curve Discrete Logarithm Problem of elliptic curve discrete logarithm problem on the finite field; ECDLP) intractability of q, this intractability can be the example explanation with the peculiar elliptic curve of levying on the finite field.

If GF (p) is the peculiar finite field of levying of P ≠ 2,3, is defined in elliptic curve on the GF (p) and is meant and satisfies Weierstrass equation: y ²=x ³+ ax+b (a, b ∈ GF (p), and 4a ³+ 27b ²≠ 0) all are separated, (x, y) nonempty set of ∈ GF (p) * GF (p) and infinite point O formation.If P is that (then the elliptic curve discrete logarithm problem about the user is on elliptic curve E for x, a y) point on (GF (p)): (x, y) (GF (p)) find the solution integer x (x ∈ GF (p)) to given 1 Q ∈ E to elliptic curve E, make xP=Q.If such number exists, and is exactly the elliptic curve discrete logarithm so, that is, choose a some P on this elliptic curve as basic point, a given integer x, it is easy finding the solution xP=Q, but will derive integer x from Q point and P point, then is very difficult.Therefore, in numerous cryptosecurity system technical schemes, ECC is the present known the highest a kind of cryptographic system of fail safe.

According to the difference that finite field is chosen, the ECC system can be divided into based on prime field GF (p) and binary system multinomial territory GF (2 ^m) two big types (the elliptic curve equation of this moment is for satisfying Weierstrass equation: y ²+ xy=x ³+ ax+b (a, b ∈ GF (2 ^m), and b ≠ 0)), wherein, binary field comprise general Gaussian base field (Normal gauss Basis, NB) with I, II type Gaussian base field, the back both be classified as again optimal normal bases (Optimal Normal Basis, ONB).Because Gaussian base field has that square operation only need be shifted, multiplying demand mould and be easy to utilize advantage such as hardware realization not; So it is used widely in information privacy systems such as digital signature, smart card, banking secrecy system and government's safety system.

Usually, the ECC that is defined on the Gaussian base field need do three kinds of computings to the base field element: dot product, invert and point adds, and consuming time maximum be point multiplication operation.In the existing ECC system; For point multiplication operation generally is according to ieee standard [IEEE P1363/D13 (Draft Version 13) .StandardSpecifications for Public Key Cryptography Annex A; 1999-12] in the Gaussian base field multiplication realize that its base field multiplication formula is following:

$c_k=\underset{i=1}{\overset{p-2}{\mathrm{\Σ}}}{a}_{F(i+1)}{b}_{F(p-i)}....................\left(1\right)$

Wherein, 0≤k≤m-1, p=2m+1, m are based on binary system multinomial territory GF (2 ^m) on elliptic curve key length, F is a Gaussian base field multiplication subscript sequence formula, by F (2 ^ju ⁱModp)=and i, 0≤i≤m-1, derive 0≤j≤1.

The computational process that provides according to above-mentioned formula (1), Gaussian base field multiplication need be carried out 2m cyclic shift and 2m ²-m time step-by-step distance (XOR) and step-by-step " with " (AND) computing, have o (m ²) complexity.When utilizing computer realization, can obtain following formula through changing by vector:

According to the vectorization algorithm that formula (2) provides, reduced the complexity of calculating, be beneficial on computers and realize, but Gaussian base field multiplication still need 4m-2 cyclic shift and 2m-1 vectorial distance (XOR) computing and " with " (AND) computing.Therefore, in the prior art, the algorithm that provides according to formula (1) or formula (2); The encryption and decryption process of an ECC also needs 1000 number magnitude Gaussian base field multiplication, when utilizing computer software and hardware to realize; Still consume huge computational resource, be unfavorable for the commercialization application.

Summary of the invention

The purpose of the embodiment of the invention is to provide a kind of ellipse curve encryption and decryption method and device based on II type Gaussian base field, and it is complicated to be intended to solve the point multiplication operation of existing ECC system on Gaussian base field, algorithm too much problem consuming time in the encryption and decryption process.

The embodiment of the invention is achieved in that a kind of elliptic curve cryptography method based on II type Gaussian base field, said method comprising the steps of:

Input instruction obtains PKI D _bWith generator P;

Generate random number k ₁

Calculate k ₁P and k ₁D _bValue;

With R=k ₁D _bFor encryption key is encrypted the cleartext information that is embedded on the elliptic curve, and with k ₁P sends to deciphering side with encryption gained ciphertext.

Another purpose of the embodiment of the invention is to provide a kind of elliptic curve decryption method based on II type Gaussian base field, said method comprising the steps of:

Input instruction obtains private key D _b, and generate random number k _b

Receive ciphertext and k that encryption side sends ₁P;

Select and the same elliptic curve in encryption side;

Calculate k _bk ₁P;

With R ₂=k _bk ₁P is a decruption key, and ciphertext is deciphered, and obtains the plaintext of information.

Another purpose of the embodiment of the invention is to provide a kind of elliptic curve cryptography device based on II type Gaussian base field, comprises Montgomery algoritic module and encrypting module, and said Montgomery algoritic module is used to calculate random number k ₁PKI D with generator P and encryption side _bProduct k ₁P and k ₁D _b, output key R=k ₁D _bAnd k ₁P, said encrypting module are used to receive the cleartext information input, and according to the key R that said Montgomery algoritic module is exported, use aes algorithm to encrypt to cleartext information.

A purpose again of the embodiment of the invention is to provide a kind of elliptic curve decryption device based on II type Gaussian base field, comprises Montgomery algoritic module and deciphering module, and said Montgomery algoritic module is used for according to random number k _bK with the transmission of encryption side ₁P calculates decruption key R ₂=k _bk ₁P=k ₁k _bP, said deciphering module is used for R ₂Decruption key, the ciphertext that enabling decryption of encrypted side sends.

Beneficial effect of the present invention is: be the key of m for key length; Accomplish base field multiplication only need carry out 2m+1 cyclic shift (comprising circulation move one m+1 time; Circulation moves the k position m time), the vectorial AND operation of nonequivalence operation and m time of 1.5m vector, significantly saved computational resource.Because the point multiplication operation of maximum base field element consuming time is optimized, the present invention carries out an ECC encryption and decryption process only needs 143.8 milliseconds, carries out an ECC encryption and decryption process need with prior art and compares for 351 milliseconds, and speed has improved more than 2 times.

Description of drawings

Fig. 1 is the elliptic curve cryptography method flow diagram based on II type Gaussian base field that the embodiment of the invention provides;

Fig. 2 is the dot product method flow diagram based on element on the II type Gaussian base field that the embodiment of the invention provides;

Fig. 3 is the elliptic curve decryption method figure based on II type Gaussian base field that the embodiment of the invention provides;

Fig. 4 is the elliptic curve cryptography device sketch map based on II type Gaussian base field that the embodiment of the invention provides;

Fig. 5 is the elliptic curve decryption device sketch map based on II type Gaussian base field that the embodiment of the invention provides; And

Fig. 6 is that the II type Gaussian base field dot product module that the embodiment of the invention provides is formed sketch map.

Embodiment

In order to make the object of the invention, technical scheme and advantage clearer,, the present invention is further elaborated below in conjunction with accompanying drawing and embodiment.Should be appreciated that specific embodiment described herein only in order to explanation the present invention, and be not used in qualification the present invention.

See also Fig. 1, the elliptic curve cryptography method that the embodiment of the invention provides based on II type Gaussian base field, details are as follows.

Step S101, input instruction obtains PKI D _bWith generator P.

The ECC system belongs to asymmetric encryption, in communication process, and the public key encryption plaintext that requires encryption side's (transmit leg) to utilize deciphering side (recipient) to provide.Therefore, in embodiment provided by the invention, through input instruction, encryption side at first obtains the deciphering side PKI D that is announced by deciphering side or third party _b, simultaneously, also should obtain generator P.Generator P is the point on the elliptic curve E in the embodiment of the invention, when the encryption and decryption process begins pretreatment stage before, has announced.

Step S102 generates random number k ₁

The generation of key must be at random, and should be equiprobability for various probability that maybe keys, and therefore, every parameter of will the parameter relevant with key doing certain mathematical operation should not possess predictability.In embodiment provided by the invention, can utilize random generator to generate random number k ₁, so that with the generator P (k that multiplies each other ₁P) back increases its unpredictability.

Step S103 calculates k ₁P and k ₁D _bValue.

k ₁D _bBe the encryption key R among the embodiment provided by the invention, that is, and R=k ₁D _bCalculate k ₁P and k ₁D _bValue may further comprise the steps:

S1031, initialization elliptic curve parameter.

As previously mentioned, elliptic curve satisfies Weierstrass equation: y ²+ xy=x ³+ ax+b (a, b ∈ GF (2 ^m), and b ≠ 0), behind initialization elliptic curve parameter a and the b, confirmed the elliptic curve E in the embodiment of the invention.

S1032, the finite field when selecting Gaussian base field as the elliptic curve point multiplication operation is utilized Montgomery algorithm computation k ₁P and k ₁D _b, wherein, adopt rapid Gauss base field dot product method to calculate the dot product between the element on the Gaussian base field.

Suppose k ₁Be converted into binary number, that is, and input k ₁=(k _T-1..., k ₁, k ₀) ₂, P=(x, y), b (here being the elliptic curve parameter), wherein, k ₁＜q, q are the exponent number of elliptic curve, k _i(i gets 0,1 ..., t-1) be binary number 0 or 1.With the present invention is example, and the Montgomery algorithmic procedure is following:

S1：X ₁←x，Z ₁←1，X ₂←x ⁴+b，Z ₂←x ².

S2: from t-2 to 0, repeat for i

If k _i=1, then

T←Z ₁，Z ₁←(X ₁Z ₂+X ₂Z ₁) ²，X ₁←xZ ₁+X ₁X ₂TZ ₂

S2.1：

$T\←X_2,X_2\←X_2^4+b{Z}_2^4,Z_2\←T^2{Z}_2^2$

Otherwise,

T←Z ₂，Z ₂←(X ₁Z ₂+X ₂Z ₁) ²，X ₂←xZ ₂+X ₁X ₂TZ ₁

S2.2：

$T\←X_1,X_1\←X_1^4+b{Z}_1^4,Z_1\←T^2{Z}_1^2$

S3：x ₃←X ₁/Z ₁

S4：y ₃←(x+X ₁/Z ₁)[(X ₁+xZ ₁)(X ₂+xZ ₂)+(x ²+y)(Z ₁Z ₂)](xZ ₁Z ₂) ^-1+y

S5: return k ₁P=(x ₃, y ₃).

In the Montgomery algorithm that the embodiment of the invention provides, the point multiplication operation between any two elements, for example, xZ ₁, bZ ₁ ⁴And x ²(x ²Be regarded as x self and be point multiplication operation xx) etc., all be to be defined on the Gaussian base field.As previously mentioned, the time-consuming of the point multiplication operation in the ECC system between the base field element, the Gaussian base field multiplication that prior art provides according to formula (1) or (2), the point multiplication operation between the base field element is elapsed time too.

In order to save computational resource, the present invention optimizes formula (1), obtains the Gaussian base field element multiplication formula that the embodiment of the invention provides:

$c=\underset{i=0}{\overset{m-1}{\mathrm{\Σ}}}{a}_i{b}_i{r}^{2^{i+1}}+\underset{i=0}{\overset{m-1}{\mathrm{\Σ}}}\underset{j=1}{\overset{m/2}{\mathrm{\Σ}}}(a_i{b}_{i+j}+a_{i+j}{b}_i)(r^{2^{i+t_j}}+r^{2^{i+{t^{\′}}_j}}).........\left(3\right)$

Wherein, sequence subscript t _j, t ' _j

$\left\{\begin{array}{c}{t}_j=(j-F\left(k\right))\%m,0<k<m\\ {t_j}^{\&prime;}=(j-F(p-k))\%m,m\&le;k<p-2\end{array}\right.,u=p-1...........\left(3.1\right)$

Obtain, r is the generator of Gaussian base field, and F is a Gaussian base field multiplication subscript sequence, and m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length.

In embodiment provided by the invention; Some P (x on the elliptic curve; Y) coordinate x, y and the elliptic curve parameter etc. of (also being generator P) all are the elements that is defined on the Gaussian base field; Element self or between do a series of computings (comprising that dot product or point add or the like) backs gained the result also be the element that is defined on the Gaussian base field, for example, the x in the above-mentioned Montgomery algorithm ²(be regarded as coordinate x and self be point multiplication operation xx), xZ ₁(Z ₁Be to obtain xZ after doing a series of computings by coordinate x and parameter b ₁Be coordinate x and Z ₁Between dot product xZ ₁) and bZ ₁ ⁴(Z ₁ ⁴Be regarded as Z ₁The dot product Z of self ₁Z ₁Z ₁Z ₁) all be the element that is defined on the Gaussian base field.For the ease of explanation, in embodiment provided by the invention, utilize Montgomery algorithm computation k ₁P and k ₁D _bThe time, the operand on point multiplication operation symbol both sides is unified with being defined in the element a on the Gaussian base field _kWith element b _kExpression, and with a _kAnd b _kThe subscript area divide the element after the computing, the final result of point multiplication operation is represented with c.Fig. 2 is the dot product method flow based on element on the II type Gaussian base field that the embodiment of the invention provides, and details are as follows.

Step S201 is according to formula (3.1) sequence of calculation subscript t _jAnd t ' _jValue.

Step S202 is to element a _kWith element b _kDo " with " (AND) computing, the gained result temporarily is stored in element c _kIn.

Element a _kWith element b _kBetween " and " (AND) computing be exactly the point multiplication operation between the Gaussian base field element.As previously mentioned, element a _kWith element b _kThe operand on point multiplication operation symbol both sides in the expression Montgomery algorithm; It can be the some P (x on the elliptic curve; Y) coordinate x, y or the elliptic curve parameter b etc. of (also being generator P), also can be they self or between be the result of a series of computings (comprising that dot product or point add or the like) back gained, for example; In above-mentioned Montgomery algorithm, for x ²Point multiplication operation xx, element a _kCan represent x, element b _kCan represent x; For xZ ₁Point multiplication operation xZ ₁, element a _kCan represent x, element b _kCan represent Z ₁For bZ ₁ ⁴Or other are analogized.

Step S203 is to step S204, to element c _kDo the computing of one of ring shift right, judge that whether (m-1)/2 are greater than k.

M is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length, k is a variable, for the first time to c _kDuring computing that ring shift right is one, its value is 0.According to the magnitude relationship of (m-1)/2 with k, judge whether circulation should finish, if (m-1)/2 greater than k, then changes step S205, otherwise, directly export c _kAs element a _kWith element b _kThe final result c (step S210) of dot product.

Step S205 is to element a _kWith element b _kDo the computing of one of ring shift left respectively, obtain element a _K+1With element b _K+1

Step S206 is to a _K+1Element and element b _kDo " with " (AND) computing, obtain element d _kTo element b _K+1With element a _kDo " with " (AND) computing, obtain element d _k'.

Step S207 is to element d _kWith element d _k' do distance (XOR) computing, obtain element q _k

Step S208 is to element q _kBe ring shift right t _jPosition and ring shift right t ' _jBit arithmetic obtains element p respectively _kWith element p _k'.

The value of j from 0 to (m-1)/2, parametric t _jAnd t ' _jDetermine by formula (3.1).

Step S209 is to step S210, to element p _k, element p _k' and element c _kDo distance (XOR) computing, and export c as a result.

Element p _k, p _k' and c _kXOR (

) after the result can use c _K+1Expression is done from increasing 1 computing with variations per hour k,, makes k=k+1 that is, and after this, flow process jumps to step S204, and relatively if the magnitude relationship of (m-1)/2 and k (m-1)/2 greater than k, then begins new computing, otherwise, with c _K+1Final result c output (step S210) as the element point multiplication operation.

Algorithm flow by Fig. 2 can find out, completing steps S202 need cyclic shift with " with " (AND) computing, completing steps S205 to S209 needs 2m cycle shift operation, 1.5m distance (XOR) computing and m distance (XOR) computing.Like this, accomplish base field multiplication only need carry out 2m+1 cycle shift operation, 1.5m vectorial distance (XOR) and m vector " with " (AND) computing, wherein, comprising circulation move one m+1 time, circulate and move k position (k＞1) m time.

Step S104 is with R=k ₁D _bFor key is encrypted the cleartext information that is embedded on the elliptic curve, and with k ₁P sends to deciphering side with encryption gained ciphertext.

As one embodiment of the invention, can be with R=k ₁D _bBe encryption key, (Advanced Encryption Standard, AES) algorithm is encrypted the cleartext information that is embedded on the elliptic curve to adopt Advanced Encryption Standard.If deciphering side (recipient) is according to the k that receives ₁P can calculate a key R ₂, R ₂Be and the identical PKI in encryption side's (transmit leg), that is, and R ₂=R=k ₁D _b, then deciphering side (recipient) can recover expressly from ciphertext.

See also Fig. 3, the elliptic curve decryption method that the embodiment of the invention provides based on II type Gaussian base field, details are as follows.

Step S301, input instruction obtains private key D _b, and generate random number k _b

The same with encryption side, in embodiment provided by the invention, random number k _bGenerate by a randomizer.To encrypting Fang Eryan, D _bIt is PKI; For deciphering Fang Eryan, D _bBe private key, and have mathematical relationship D _b=k _bP.Because k _bProduce by deciphering side, therefore, have only deciphering can enough decipher by PKI (private key) D _bCiphertext after the encryption.

Step S302 receives ciphertext and k that encryption side sends ₁P.

Step S303 selects and the same elliptic curve in encryption side.

Because elliptic curve is by Weierstrass equation: y ²+ xy=x ³+ ax+b (a, b ∈ GF (2 ^m), and b ≠ 0) decision, therefore, the elliptic curve E same with encryption side just selected as long as confirm and encrypt to put same parameter a and parameter b in deciphering side.

Step S304 calculates k _bk ₁The value of P.

Calculate k _bk ₁During P, also relate to the point multiplication operation of base field element.With calculate k among the step S103 ₁P or k ₁D _bMethod identical, that is, be finite field with II type Gaussian base field, take the opportunity in that element is done a little, according to the described dot product method of Fig. 2, calculate R based on element on the II type Gaussian base field ₂, specifically repeat no more.

Step S305 is with R ₂=k _bk ₁P is a decruption key, and ciphertext is deciphered, and obtains the plaintext of information.

As one embodiment of the invention, deciphering can be deciphered ciphertext with the algorithm for inversion that adopts aes algorithm, and the deciphering principle is: when by k ₁P calculates key R ₂=k _bk ₁P=k ₁k _bDuring P, owing to there is mathematical relationship D _b=k _bIn fact P then exists mathematical relationship R ₂=k ₁D _b, and, R=k is arranged in encryption side ₁D _b(step S103) is so R ₂=R, that is, deciphering side has the key identical with encryption side, according to aes algorithm rule, ciphertext that can enabling decryption of encrypted side, thus recover cleartext information.

Fig. 4 is the elliptic curve cryptography device based on II type Gaussian base field that the embodiment of the invention provides.For the ease of explanation, the part relevant with the present invention only is shown.Module in the said device can be the functional unit of hardware, software or software and hardware combining, and principle below is detailed.

Parameter acquisition module 401 is used to obtain the PKI D of generator P and encryption side _b, random number generation module 402 generates a random number k ₁ Montgomery algoritic module 403 comprises an II type Gaussian base field dot product module 4031 at least.The generator P that Montgomery algoritic module 403 obtains according to parameter acquisition module 401 and the PKI D of encryption side _bAnd the random number k of random number generation module 402 generations ₁, calculate k ₁P and k ₁D _bCalculating k ₁P and k ₁D _bIn the process, II type Gaussian base field dot product module 4031 is accomplished the point multiplication operation of element on the II type Gaussian base field.Encrypting module 404 receives the cleartext informations input, and according to encryption key R (R and the k of Montgomery algoritic module 403 outputs ₁D _bRelation be R=k ₁D _b), use aes algorithm to encrypt to cleartext information.Sending module 405 is with the ciphertext of encrypting module 404 outputs and the k of Montgomery algoritic module 403 outputs ₁P is sent to deciphering side (recipient).

Fig. 5 is the elliptic curve decryption device based on II type Gaussian base field that the embodiment of the invention provides; Said device comprises private key acquisition module 501, random number generation module 502, Montgomery algoritic module 503 and deciphering module 504; Wherein, Montgomery algoritic module 503 comprises an II type Gaussian base field dot product module 4031 at least.

Private key acquisition module 501 is used to obtain the private key D of deciphering side _b(D _bTo encrypting Fang Eryan is PKI) and export to Montgomery algoritic module 503.Random number generation module 502 generates a random number k _bExport Montgomery algoritic module 503 to so that computation key.The random number k that Montgomery algoritic module 503 generates according to random number generation module 502 _bK with the transmission of encryption side ₁P calculates decruption key R ₂(R ₂And k _b, k ₁The P mathematical relationship is R ₂=k _bk ₁P=k ₁k _bP).In computational process, the point multiplication operation of element is accomplished by II type Gaussian base field dot product module 4031 on the II type Gaussian base field.Owing to there is mathematical relationship D _b=k _bP, and R ₂=k _bk ₁P=k ₁k _bP, then R in fact ₂=k ₁D _b, and, R=k is arranged in encryption side ₁D _bSo, R ₂=R, that is, deciphering side has the key identical with encryption side, and therefore, deciphering module 504 can be with R ₂Be decruption key, the algorithm for inversion deciphering of adopting aes algorithm recovers cleartext information by the ciphertext that encryption side sends over.

Fig. 6 is that the II type Gaussian base field dot product module 4031 that the embodiment of the invention provides is formed sketch map, and details are as follows.

Two elements of supposing to do on the II type Gaussian base field of point multiplication operation are a _kAnd b _k, that is, and II type Gaussian base field dot product module be input as a _kAnd b _k

When point multiplication operation begins, first " with " 601 couples of element a of logical block _kAnd b _kCarry out AND operation, its operation result is c _k602 pairs first of the first ring shift right unit " with " c as a result of logical block 601 outputs _kCarry out the computing of one of ring shift right, let the number of times that should circulate in the judging unit 603 judging point multiplication processes whether reach set point simultaneously, if reach, then output unit 612 is directly exported c _kFinal result as point multiplication operation; Otherwise, by the first ring shift left unit 604 and the 606 couples of element a in the second ring shift left unit _kWith element b _kCarry out one the computing of moving to left respectively, the output operation result is respectively element a _K+1With element b _K+1Second " with " 605 couples of a of logical block _K+1Element and element b _kCarry out AND operation, the output operation result is element d _kThe 3rd " with " 607 couples of element b of logical block _K+1With element a _kCarry out AND operation, the output operation result is element d _k'.The 608 couples of element d in the first XOR unit _kWith element d _k' carry out nonequivalence operation, the output operation result is element q _kThe 609 couples of element q in the second ring shift right unit _kCarry out ring shift right t ' _j(t ' _jBy formula (3.1) decision) position, the output operation result is element p _k'; The 610 couples of element q in the 3rd ring shift right unit _kCarry out ring shift right t _j(t _jBy formula (3.1) decision) position, the output operation result is element p _kThe 611 couples of element p in the second XOR unit _k, p _k' and c _kThe execution distance (

) computing, obtaining operation result is element c _K+1Simultaneously, whether the number of times that should circulate in the judging unit 612 judging point multiplication processes reaches set point, if reach, then output unit 612 is directly exported c _K+1As element a _kWith element b _kThe final result c of point multiplication operation; Otherwise the first ring shift left unit 604 and each later unit thereof are handled the output result of each unit once more, and the number of times that in the point multiplication operation process, should circulate reaches set point.

The present invention passes through Gaussian base field multiplication formula in the ieee standard $c_k=\underset{i=1}{\overset{p-2}{\mathrm{\&Sigma;}}}{a}_{F(i+1)}{b}_{F(p-i)}$ Be optimized for $c=\underset{i=0}{\overset{m-1}{\mathrm{\&Sigma;}}}{a}_i{b}_i{r}^{2^{i+1}}+\underset{i=0}{\overset{m-1}{\mathrm{\&Sigma;}}}\underset{j=1}{\overset{m/2}{\mathrm{\&Sigma;}}}(a_i{b}_{i+j}+a_{i+j}{b}_i)(r^{2^{i+t_j}}+r^{2^{i+{t^{\&prime;}}_j}}),$ When using the ECC system; In the feasible Montgomery algorithm based on II type Gaussian base field; For key length is the key of m; Accomplish base field multiplication only need carry out 2m+1 cyclic shift (comprising circulation move one m+1 time, circulation moves the k position m time), 1.5m vectorial nonequivalence operation and m vectorial AND operation, significantly saved computational resource.Because the point multiplication operation of maximum base field element consuming time is optimized, the present invention carries out an ECC encryption and decryption process only needs 143.8 milliseconds, carries out an ECC encryption and decryption process need with prior art and compares for 351 milliseconds, and speed has improved more than 2 times.

The above is merely preferred embodiment of the present invention, not in order to restriction the present invention, all any modifications of within spirit of the present invention and principle, being done, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.

Claims (8)

1. the elliptic curve cryptography method based on II type Gaussian base field is characterized in that, said method comprising the steps of:

Input instruction obtains PKI D _bWith generator P;

Generate random number k ₁

Calculate k ₁P and k ₁D _bValue;

With R=k ₁D _bFor encryption key is encrypted the cleartext information that is embedded on the elliptic curve, and with k ₁P sends to deciphering side with encryption gained ciphertext;

Wherein, said calculating k ₁P and k ₁D _bThe value step comprise:

The said elliptic curve parameter of initialization;

Finite field when selecting Gaussian base field as the elliptic curve point multiplication operation is utilized Montgomery algorithm computation k ₁P and k ₁D _b, wherein, adopt rapid Gauss base field dot product method to calculate the dot product between the element on the Gaussian base field, said rapid Gauss base field dot product method comprises:

Input Gaussian base field element a _kWith element b _k

To element a _kWith element b _kCarry out " with " logical operation, the gained operation result temporarily is stored in element c _kIn;

To element c _kCarry out the computing of one of ring shift right, whether judge (m-1)/2 greater than k, wherein, said m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length, k is integer one variable, its initial value is 0;

If (m-1)/2 greater than k, then to element a _kWith element b _kCarry out the computing of one of ring shift left respectively, obtain element a _K+1With element b _K+1Otherwise, directly export c _kAs element a _kWith element b _kThe final result c of dot product;

To a _K+1Element and element b _kCarry out " with " logical operation, obtain element d _k, to element b _K+1With element a _kCarry out " with " logical operation, obtain element d _k';

To element d _kWith element d _k' carry out the XOR computing, obtain element q _k

To element q _kCarry out ring shift right t _jPosition and ring shift right

Bit arithmetic obtains element p respectively _kWith element p _k', wherein, said t _jWith By formula $\left\{\begin{array}{c}{t}_j=(j-F\left(k\right))\%m,0<k<m\\ {t_j}^{\&prime;}=(j-F(p-k))\%m,m\&le;k<p-2\end{array}\right.,1\&le;j\&le;m/2,$ P=2m+1, the u=p-1 decision, F is a Gaussian base field multiplication subscript sequence, m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length;

To element p _k, element p _k' and element c _kCarry out the XOR computing, obtain operation result c _K+1, simultaneously, variable k does and increases 1 computing certainly, and compares the magnitude relationship of (m-1)/2 and k, if (m-1)/2 greater than k, then begins new computing, otherwise, with c _K+1As element a _kWith element b _kThe final result output of point multiplication operation.

2. the elliptic curve cryptography method based on II type Gaussian base field as claimed in claim 1 is characterized in that, said is with aes algorithm the cleartext information that is embedded on the elliptic curve to be encrypted to being embedded in that cleartext information on the elliptic curve encrypts.

3. the elliptic curve decryption method based on II type Gaussian base field is characterized in that, said method comprising the steps of:

Input instruction obtains private key D _b, and generate random number k _b

Receive ciphertext and k that encryption side sends ₁P, wherein, said k ₁Be the random number that the side of encryption generates, the generator that said P obtains for encryption side;

Select and the same elliptic curve in encryption side;

Calculate k _bk ₁P;

With R ₂=k _bk ₁P is a decruption key, and ciphertext is deciphered, and obtains the plaintext of information;

Wherein, said calculating k _bk ₁P adopts Montgomery algorithm computation k _bk ₁P, said Montgomery algorithm comprise the dot product between the element on the employing rapid Gauss base field dot product method calculating Gaussian base field; Wherein, the step of the dot product between the element comprises on the said rapid Gauss base field dot product method calculating Gaussian base field:

Input Gaussian base field element a _kWith element b _k

To element a _kWith element b _kCarry out " with " logical operation, the gained operation result temporarily is stored in element c _kIn;

To element c _kCarry out the computing of one of ring shift right, whether judge (m-1)/2 greater than k, wherein, said m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length, k is an integer variable, its initial value is 0;

If (m-1)/2 greater than k, then to element a _kWith element b _kCarry out the computing of one of ring shift left respectively, obtain element a _K+1With element b _K+1Otherwise, directly export c _kAs element a _kWith element b _kThe final result c of dot product;

To a _K+1Element and element b _kCarry out " with " logical operation, obtain element d _k, to element b _K+1With element a _kCarry out " with " logical operation, obtain element d _k';

To element d _kWith element d _k' carry out the XOR computing, obtain element q _k

To element q _kCarry out ring shift right t _jPosition and ring shift right

Bit arithmetic obtains element p respectively _kWith element p _k', wherein, said t _jWith

By formula $\left\{\begin{array}{c}{t}_j=(j-F\left(k\right))\%m,0<k<m\\ {t_j}^{\&prime;}=(j-F(p-k))\%m,m\&le;k<p-2\end{array}\right.,1\&le;j\&le;m/2,$ P=2m+1, the u=p-1 decision, F is a Gaussian base field multiplication subscript sequence, m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length;

To element p _k, element p _k' and element c _kCarry out the XOR computing, obtain operation result c _K+1, simultaneously, variable k does and increases 1 computing certainly, and compares the magnitude relationship of (m-1)/2 and k, if (m-1)/2 greater than k, then begins new computing, otherwise, with c _K+1As element a _kWith element b _kThe final result output of point multiplication operation.

4. the elliptic curve decryption method based on II type Gaussian base field as claimed in claim 3 is characterized in that, and is said with R ₂=k _bk ₁P is a decruption key, and it is with R that ciphertext is deciphered ₂=k _bk ₁P is a decruption key, adopts the algorithm for inversion of aes algorithm that ciphertext is deciphered.

5. the elliptic curve cryptography device based on II type Gaussian base field comprises Montgomery algoritic module and encrypting module, it is characterized in that, said Montgomery algoritic module is used to calculate random number k ₁PKI D with generator P and encryption side _bProduct k ₁P and k ₁D _b, output key R=k ₁D _bAnd k ₁P, said encrypting module are used to receive the cleartext information input, and according to the key R that said Montgomery algoritic module is exported, use aes algorithm to encrypt to cleartext information; Wherein, said Montgomery algoritic module comprises the II type Gaussian base field dot product module that is used for element point multiplication operation on the II type Gaussian base field at least, and said II type Gaussian base field dot product module specifically comprises:

First " with " logical block, be used for II type Gaussian base field element a _kAnd b _kCarry out AND operation first, obtaining operation result is Gaussian base field element c _k

The first ring shift right unit, be used for to said first " with " c of logical block output _kCarry out the computing of one of ring shift right;

The first ring shift left unit is used for element a _kMove to left one computing of execution, the output operation result is element a _K+1

The second ring shift left unit is used for element b _kMove to left one computing of execution, the output operation result is element b _K+1

Second " with " logical block, be used for element a _K+1With element b _kCarry out AND operation, the output operation result is element d _k

The 3rd " with " logical block, be used for element b _K+1With element a _kCarry out AND operation, the output operation result is element d _k';

The first XOR unit is used for element d _kWith element d _k' carry out nonequivalence operation, the output operation result is element q _k

The second ring shift right unit is used for element q _kCarry out ring shift right Bit arithmetic, the output operation result is element p _k';

The 3rd ring shift right unit is used for element q _kCarry out ring shift right t _jBit arithmetic, the output operation result is element p _k

The second XOR unit is used for element p _k, p _k' and c _kCarry out distance

Computing, obtaining operation result is element c _K+1

Output unit is used to export element a _kWith element b _kThe final result of point multiplication operation;

Judging unit is used for the number of times that judging point multiplication process should circulate and whether reaches set point, if reach, then said output unit is directly exported c _K+1As element a _kWith element b _kThe final result c of point multiplication operation; Otherwise the said first ring shift left unit and each later unit thereof are handled the output result of each unit once more, and the number of times that in the point multiplication operation process, should circulate reaches set point;

Wherein, said t _jWith By formula $\left\{\begin{array}{c}{t}_j=(j-F\left(k\right))\%m,0<k<m\\ {t_j}^{\&prime;}=(j-F(p-k))\%m,m\&le;k<p-2\end{array}\right.,1\&le;j\&le;m/2,$ P=2m+1, the u=p-1 decision, wherein F is a Gaussian base field multiplication subscript sequence, m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length.

6. the elliptic curve cryptography device based on II type Gaussian base field as claimed in claim 5 is characterized in that said device further comprises:

Parameter acquisition module is used to obtain the PKI D of generator P and encryption side _bAnd export said Montgomery algoritic module to;

The random number generation module is used to generate a random number k ₁And export said Montgomery algoritic module to;

Sending module is used for the ciphertext of said encrypting module output and the k of said Montgomery algoritic module output ₁P is sent to deciphering side.

7. the elliptic curve decryption device based on II type Gaussian base field comprises Montgomery algoritic module and deciphering module, it is characterized in that, said Montgomery algoritic module is used for according to random number k _bK with the transmission of encryption side ₁P calculates decruption key R ₂=k _bk ₁P=k ₁k _bP, wherein, said k ₁Be the random number that the side of encryption generates, the generator that said P obtains for encryption side, said deciphering module is used for R ₂Be decruption key, the ciphertext that enabling decryption of encrypted side sends; Wherein, said Montgomery algoritic module comprises the II type Gaussian base field dot product module that is used for element point multiplication operation on the II type Gaussian base field at least, and said II type Gaussian base field dot product module specifically comprises:

First " with " logical block, be used for II type Gaussian base field element a _kAnd b _kCarry out AND operation first, obtaining operation result is Gaussian base field element c _k

The first ring shift right unit, be used for to said first " with " c of logical block output _kCarry out the computing of one of ring shift right;

The first ring shift left unit is used for element a _kMove to left one computing of execution, the output operation result is element a _K+1

The second ring shift left unit is used for element b _kMove to left one computing of execution, the output operation result is element b _K+1

Second " with " logical block, be used for element a _K+1With element b _kCarry out AND operation, the output operation result is element d _k

The 3rd " with " logical block, be used for element b _K+1With element a _kCarry out AND operation, the output operation result is element d _k';

The first XOR unit is used for element d _kWith element d _k' carry out nonequivalence operation, the output operation result is element q _k

The second ring shift right unit is used for element q _kCarry out ring shift right

Bit arithmetic, the output operation result is element p _k';

The 3rd ring shift right unit is used for element q _kCarry out ring shift right t _jBit arithmetic, the output operation result is element p _k

The second XOR unit is used for element p _k, p _k' and c _kCarry out distance Computing, obtaining operation result is element c _K+1

Output unit is used to export element a _kWith element b _kThe final result of point multiplication operation;

Judging unit is used for the number of times that judging point multiplication process should circulate and whether reaches set point, if reach, then said output unit is directly exported c _K+1As element a _kWith element b _kThe final result c of point multiplication operation; Otherwise the said first ring shift left unit and each later unit thereof are handled the output result of each unit once more, and the number of times that in the point multiplication operation process, should circulate reaches set point;

Wherein, said t _jWith By formula $\left\{\begin{array}{c}{t}_j=(j-F\left(k\right))\%m,0<k<m\\ {t_j}^{\&prime;}=(j-F(p-k))\%m,m\&le;k<p-2\end{array}\right.,1\&le;j\&le;m/2,$ P=2m+1, the u=p-1 decision, wherein F is a Gaussian base field multiplication subscript sequence, m is based on binary system multinomial territory GF (2 ^m) on elliptic curve key length.

8. like the said elliptic curve decryption device of claim 7, it is characterized in that said device further comprises based on II type Gaussian base field:

The private key acquisition module is used to obtain the private key D of deciphering side _bAnd export said Montgomery algoritic module to;

The random number generation module is used to generate a random number k _bAnd export said Montgomery algoritic module to.

Images