JP2004233428A

JP2004233428A - Inverse element calculation device, inverse element calculation method, and inverse element calculation program

Info

Publication number: JP2004233428A
Application number: JP2003018846A
Authority: JP
Inventors: Jun Furukawa; 潤古川; Isamu Teranishi; 勇寺西
Original assignee: NEC Corp
Current assignee: NEC Corp
Priority date: 2003-01-28
Filing date: 2003-01-28
Publication date: 2004-08-19

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method for calculating, at high speed, an inverse element of a field which is the base of elliptic cipher, code or the like. <P>SOLUTION: In the inverse element calculation method, when there are an arbitrary base field and its extended field M in an arbitrary order, a field L which is extended by a q-th order cyclotomic polynomial (q is a prime number obtained by adding 1 to an integral multiple of the above order) is considered, and the field M is considered as a medium field of the extended field L. In the above manner, Frobenius mapping in M is obtained naturally from Frobenius mapping in L. The quantity of calculation required for the Frobenius mapping in L is very small. Also, when obtaining the inverse element, frequency of using multiplication in M is reduced by repeating calculation of products and norms of all the conjugate elements in relation to a medium field which is on a certain medium field and has less members. By this operation, an extended field in an arbitrary order can be obtained and, as a result, the inverse element can be obtained at high speed. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

【０００１】
【発明の属する技術分野】
本発明は，有限体である基礎体とその有限次拡大体との中間体の元の逆元を求める方法に関し、特に前記拡大体が前記基礎体を、既約な多項式で、ある整数ｍがあって根として１の原始ｍ乗根およびそれのみを根とするものを定義多項式として用いる逆元演算装置、逆元演算方法、及び逆元演算プログラムに関する。
【０００２】
【従来の技術】
楕円曲線暗号や符号においては素体とは限らない有限体の元の逆元を求める演算が使われることがある。そして多くの場合この演算は、乗算加算等のその他の演算に比べて計算時間を多く必要とするため、この高速化による恩恵は大きい。
【０００３】
特許文献１には、この内容が記載されている。
楕円曲線暗号の例をあげる。ある有限体上定義された楕円曲線上の点の加算に必要な計算は、点をａｆｆｉｎｅ座標であらわした場合に定義体上の乗算３個と逆元演算１個である。定義体が素体の場合逆元演算に必要な計算量は乗算の１０倍以上必要で、点の加算に必要な計算に占める逆元演算の割合は大きい。それゆえ、逆元演算の高速化は重要な課題となっている。
【０００４】
定義体を素体でない有限体にすることで、定義体の逆元演算を効率化する方法が幾つか知られている。そうした効率化方法として例えば、ＯＥＦによる方法、逐次拡大ＯＥＦ法，円分拡大による方法などが知られている。
【０００５】
ＯＥＦによる方法とは，非特許文献１に記載されている方法である．
逐次拡大ＯＥＦ法とは，非特許文献２に記載されている方法である。
【０００６】
円分拡大による方法とは、非特許文献３に記載されている方法である。
【０００７】
まずＯＥＦによる方法を説明する。定義体の素体からの拡大次数をｍとすると、定義体の元は素体の元ｍ個の列と見做す事ができる。情報処理装置の処理するワード長をｕとする。ＯＥＦにおいては、定義体の位数ｐは２^ｕ以下で，しかも位数は２^ｕに近い値でなければならない。さらに、定義体の定義多項式は、ある整数ｗで
Ｘ^ｍ−ｗの形で書けるものを用いる。整数ｗの絶対値が小さければ小さいほど演算は高速である。
【０００８】
ＯＥＦによる方法における乗算および逆元演算を説明する。例えば上記ワード長が３２（３２ビット情報処理装置）で、拡大次数ｍが７であったとする。
定義体の位数ｐのビット数は３２以下である。また、Ｚ／ｐＺの元は１ワードで書くことができる。定義体の元Ａを任意に取るとき、Ａは、Ｚ／ｐＺの元ａ_０、ａ_１、ａ_２、ａ_３、ａ_４、ａ_５、ａ_６を用いて、
ａ_０＋ａ_１Ｘ＋ａ_２Ｘ^２＋ａ_３Ｘ^３＋ａ_４Ｘ^４＋ａ_５Ｘ^５＋ａ_６Ｘ^６と表現することができる。定義体のもう一つの元Ｂをｂ_０＋ｂ_１Ｘ＋ｂ_２Ｘ^２＋ｂ_３Ｘ^３＋ｂ_４Ｘ^４＋ｂ_５Ｘ^５＋ｂ_６Ｘ^６とした時に、二つの要素の積ＡＢを求めるにはまず、二つの要素の多項式としての積を求める。結果は１２次の多項式で、Ｚ／ｐＺの要素ｃ_０、ｃ_１、ｃ_２、ｃ_３、ｃ_４、ｃ_５、ｃ_６、ｃ_７、ｃ_８、ｃ_９、ｃ_１０、ｃ_１１、ｃ_１２を用いて、ｃ_０＋ｃ_１Ｘ＋ｃ_２Ｘ^２＋ｃ_３Ｘ^３＋ｃ_４Ｘ^４＋ｃ_５Ｘ^５＋ｃ_６Ｘ^６＋ｃ_７Ｘ^７＋ｃ_９Ｘ^８＋ｃ_９Ｘ^９＋ｃ_１０Ｘ^１０＋ｃ_１１Ｘ^１１＋ｃ_１２Ｘ^１２とあらわせる。
【０００９】
これを既約多項式Ｘ^７−ｗを用いて、６次の多項式に落す。すなわち、７以上のｎに関して操作「ｃ_ｎＸ^ｎ→ｗｃ_ｎＸ^ｎ−７」を繰り返し、６次の多項式を得る。得られた６次式が拡大体上での二つの元Ａ、Ｂの積ＡＢである。
【００１０】
次に、逆元演算の方法を記述する。＾
まず、Ａ^−１＝（Ａ^{（ｐ＾（ｍ−１）＋ｐ＾（ｍ−２）＋、、、＋ｐ＋１）}）^−１Ａ^{（ｐ＾（ｍ−１）＋ｐ＾（ｍ−２）＋、、、＋Ｐ）}であることが知られている．最初にＡ^{（ｐ＾（ｍ−１）＋ｐ＾（ｍ−２）＋、、、＋Ｐ）}を求める。
【００１１】
ＯＥＦにおいてはフロベニウス写像Ａ→Ａ^ｐは簡単に計算できるので、この計算は高速に行うことができる。
【００１２】
具体的には、
Ａ^{（ｐ＾（ｍ−１）＋ｐ＾（ｍ−２）＋、、、＋Ｐ）}＝（．．．（（Ａ^ｐＡ）^ｐＡ）．．．）^ｐである事を用いて、フロベニウス写像とＡとの積を取る演算とを交互に用いることで値を計算する。次にこれにＡを乗じてＡ^{（ｐ＾（ｍ−１）＋ｐ＾（ｍ−２）＋、、、＋ｐ＋１）}を求める。この値は素体の元なので、基礎体上での逆元を計算すれば良い。
【００１３】
ＯＥＦを用いることの第一の利点は、多項式の積を求める上述の計算が、情報処理装置の処理するワード長に収まる数どうしの積と和とで可能なため、多倍長演算が不要となり、ソフトウェア実装の場合高速になる事である。
【００１４】
第二の利点は、１２次の多項式を６次に落す際に、各Ｚ／ｐＺにｗという小さい値を乗じるだけで済む事である。これが拡大体と同程度の位数を持つ素体である場合は、同じ操作に対応する除算に必要な計算コストが非常に大きい。
【００１５】
第３の利点は、逆元の計算が容易なことである。素体上での逆元演算は、体が大きいとコストが非常に大きくなるが、ＯＥＦの場合拡大体の逆元を計算する時に必要な逆元演算は、小さな素体上での逆元演算だけである為、コストが少なくてすむ。
【００１６】
次に逐次拡大ＯＥＦによる方法を説明する。逐次拡大ＯＥＦによる方法は、ＯＥＦによる方法と同様の拡大を繰り返し適用して拡大した体を用いる。例として、２回拡大する場合を記述する。
【００１７】
まず有限体Ｋをひとつとり、その拡大体Ｍをとる。拡大体Ｍをさらに拡大したものを拡大体Ｌと呼ぶことにする。ＭのＫからの拡大次数をｎ’とし、ＬのＭからの拡大次数をｎとする。Ｌの元Ａを任意に取る。逐次拡大ＯＥＦで元Ａの逆元を求める方法を説明する。
【００１８】
ＯＥＦの場合と同様に
Ａ^−１＝（Ａ^{（ｐ＾（ｎ−１）＋ｐ＾（ｎ−２）＋、、、＋ｐ＋１）}）^−１Ａ^{（ｐ＾（ｎ−１）＋ｐ＾（ｎ−２）＋、、、＋Ｐ）}である事を利用する。
ここで、Ｂ＝Ａ^{（ｐ＾（ｎ−１）＋ｐ＾（ｎ−２）＋、、、＋ｐ＋１）}とするとＢはＭの要素である。
するとまた、
Ｂ^−１＝（Ｂ^{（ｐ＾（ｎ’−１）＋ｐ＾（ｎ’−２）＋、、、＋ｐ＋１）}）^−１Ｂ^{（ｐ＾（ｎ’−１）＋ｐ＾（ｎ’−２）＋、、、＋ｐ）}がなり立つ。
【００１９】
ここでＣ＝Ｂ^{（ｐ＾（ｎ’−１）＋ｐ＾（ｎ’−２）＋、、、＋ｐ＋１）}とおくと、Ｃは基礎体Ｋの要素である。よってＡ^−１＝Ａ^{（ｐ＾（ｎ−１）＋ｐ＾（ｎ−２）＋、、、＋ｐ）}Ｂ^{（ｐ＾（ｎ’−１）＋ｐ＾（ｎ’−２）＋、、、＋ｐ）}Ｃ^−１である。
【００２０】
この等式を用いてＡ^−１を求める。拡大の回数が２より大きい場合は、同様の手法を各拡大体に対して順次繰り返せば良い．
逐次拡大ＯＥＦによる方法を用いることの利点を上記例で説明する．
等式Ａ^−１＝Ａ^{（ｐ＾（ｎ−１）＋ｐ＾（ｎ−２）＋、、、＋ｐ）}Ｂ^{（ｐ＾（ｎ’−１）＋ｐ＾（ｎ’−２）＋、、、＋ｐ）}Ｃ^−１を用いて、式Ａ^−１を求める場合、右辺の計算において、Ａを乗じる演算は、体Ｌ上の演算であるが、Ｂを乗じる演算は体Ｍ上の演算である。体Ｍは体Ｌより小さいので、後者の演算はより効率的に行える。ＯＥＦによる方法におけるｍと、本方法におけるｎ，ｎ’の間に、ｍ＝ｎｎ’の関係があるとする。これは、暗号にこれらの体を用いた時に、暗号に同程度の強度を持たせるためには適切な仮定である。
【００２１】
ＯＥＦで用いられる拡大体をＬ’とする。逆元演算のために必要な演算は、ＯＥＦの場合体Ｌ’上の乗算がｍ個と素体上の逆元演算、逐次拡大ＯＥＦの場合体Ｌ上の乗算はｎ個、体Ｍ上の乗算がｎ’個と基礎体上の逆元演算である．体Ｌ上の乗算と体Ｌ’上の乗算にかかるコストはほぼ同じであるので、全体として逐次拡大ＯＥＦの方が演算コストが低い。但し、逐次拡大ＯＥＦは体の拡大次数がｎｎ’と書けるため、拡大次数は合成数である必要がある。
【００２２】
最後に円分拡大を用いる方法を説明する。有限体Ｋに対し、Ｋ上の多項式で、１の原始ｍ乗根およびそれのみを根とするものを、Ｋ上の第ｍ円分多項式と呼ぶことにする。Ｋが１の原始ｍ乗根を含まないことがＫ上のｍ次の円分多項式が既約であるための必用十分条件である。円分拡大を用いる方法では、ＯＥＦとほぼ同等の効果に加えて、フロベニウス写像がより高速であることが期待できる。但し、選択できる拡大体は、拡大次数が素数より１小さいものに限られている。
【００２３】
【特許文献１】
特開２０００−２１４７６８（４−４、図１）
【非特許文献１】
ダニエル（ＤａｎｉｅｌＶ．）、ベイリー（Ｂａｉｌｅｙ）、パー（ＣｈｒｉｓｔｏｆＰａａｒ）による文献「オプティマルイクステンションフィールドフォーファストアリスメティックインパブリックキーアルゴリズムズ。クリプト９８、シュプリンガーレクチャーノートインコンピューターサイエンス、１９９６年（ＯｐｔｉｍａｌＥｘｔｅｎｓｉｏｎＦｉｅｌｄｓｆｏｒＦａｓｔＡｒｉｔｈｍｅｔｉｃｉｎＰｕｂｌｉｃ−ＫｅｙＡｌｇｏｒｉｔｈｍｓ，ＣＲＹＰＴＯ’９８．ＳｐｒｉｎｇｅｒＬｅｃｔｕｒｅＮｏｔｅｓｉｎＣｏｍｐｕｔｅｒＳｃｉｅｎｃｓ，１９９６．）」
【非特許文献２】
小林鉄太郎青木和麻呂、星野文学による文献「逐次拡大ＯＥＦ，ＳＣＩＳ２０００−Ｂ０２」
【非特許文献３】
柳澤重毅松尾和人趙晋輝辻井重男による文献「楕円暗号のハードウェア実装，ＳＣＩＳ’９８−１０．１．Ｃ．」
【００２４】
【発明が解決しようとする課題】
２００３年現在、多くのコンピューターが３２ビットＣＰＵを使っている。
【００２５】
その為、楕円曲線暗号を高速にソフトウエア実装するためには、その演算の単位が３２ビット以下で、その値が２^３２に近いものであることが望ましい。また同現在，楕円曲線暗号の安全定数のビット数の標準は１６０ビットである。これは、用いる体の位数が２^{１６０−１}以上であることを要求している。もし、３２ビット程度の素体を選んだ場合、その拡大体の位数が上記値であるためには、拡大次数は５または６である必要がある。拡大次数が５であるためには基礎体のビット数は丁度３２（＝１６０／５）である必要がある。拡大次数が６であるならば、基礎体のビット数は２７（＞１６０／６）ビット以上であれば良い。
【００２６】
従来の技術では、フロベニウス写像を高速化するためには、体の拡大は円分多項式で行うことが好ましく、乗算を少しでも小さな体で行うためには逐次拡大が好ましいことが結論される。ところが、拡大次数として５を選んだ場合、５は素数であるので逐次拡大とはなり得ず、５＋１は素数でもないので円分多項式による拡大も行えない。また、拡大次数として６を選んだ場合、６＝２ｘ３であるので逐次拡大とすることはできるが、３＋１が合成数なので４次の拡大は円分多項式による拡大とはできない。
【００２７】
本発明は、いかなる拡大次数の拡大体でも円分多項式を用いる拡大を応用して、拡大体のフロベニウス写像を高速に演算することを可能にし、またその拡大次数が合成数の場合、逐次拡大の長所もあわせ持たせることを可能にする逆元演算装置、逆元演算方法、及び逆元演算プログラムを提供するものである。
【００２８】
【課題を解決するための手段】
本発明の第１の逆元演算装置は、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算装置であって、
外部からの入力データを受け付ける入力部と、前記入力データの数値から約数列を決定する約数列算出部と、前記約数列算出部から前記約数を逐次入力して共役元積とノルムとを計算し前記約数列算出部に返却する共役元積ノルム計算部と、前記約数列算出部から入力した共役元積とノルムとから逆元を計算する逆元計算部と、前記逆元計算部で計算した逆元を出力する出力部とを備え、
前記入力部は、前記基礎体Ｋを拡大して前記拡大体Ｍを求める任意の拡大次数ｎ（ｎは自然数）と、ｑ＝ｎ・ｊ＋１が素数となるようなｑ（ｊは小さい自然数）と、ｑ次の円分分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐであって、その素数ｐを情報処理装置上の数値として表現した場合の有効ビット数が情報処理装置の処理するワード長以下でかつそれに近いビット数、ワード長の半分以下でかつそれに近いビット数，およびワード長の２倍以下でかつそれに近いビット数のいずれかの条件をもつ素数ｐと、
素体Ｚ／ｐＺを拡大して基礎体Ｋを得るための既約多項式と、を入力し、
素数ｐと既約多項式をもとに基礎体Ｋを生成し、基礎体Ｋをｎによって拡大して拡大体Ｍ、基礎体Ｋをｑ次の円分多項式で拡大して拡大体Ｌを決定し、前記拡大体Ｍの元で逆元の演算を行う元Ａを入力し、
前記約数列算出部は、ｎの約数ｎ［１］、・・・ｎ［ｋ］について、ｎ［ｉ］がｎ［ｉ＋１］を割りきるような約数列を選び、位数が基礎体Ｋのｎ［ｉ］乗であるＬの部分体をＮ［ｉ］とし、ｎ［０］＝１、ｎ［ｋ＋１］＝ｎ、Ｎ［０］＝Ｋ、Ｎ［ｋ＋１］＝Ｍ、Ａ［ｋ＋１］＝Ａとした時、ｎの約数ｎ［ｉ］、ｎ［ｉ＋１］と、Ａ［ｉ］とをｉがｋから始まり１になるまで逐次前記共役元積ノルム算出部に提供し、結果として前記共役元積ノルム算出部から返却された共役元積Ａ［ｉ］ ^＊を記憶し、
前記共役元積ノルム算出部は、約数ｎ［ｉ］、ｎ［ｉ＋１］と、Ａ［ｉ］を用い、
Ｎ［ｉ−１］に関するＡ［ｉ］を除くＡ［ｉ］の共役元全ての積Ａ［ｉ］ ^＊を、
Ａ［ｉ］^＊＝Ａ［ｉ］＾｛ｐ^{ｎ［ｉ−１］}＋ｐ^{２ｎ［ｉ−１］}＋・・・＋ｐ^{ｎ［ｉ］−ｎ［ｉ−１］}｝＝（・・・（（Ａ［ｉ］＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）・・・）＾（ｐ^{ｎ［ｉ−１］}）、と計算し、
ノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を、
Ｎ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）＝Ａ［ｉ］Ａ［ｉ］^＊、として計算し、このノルムを
新たにＡ［ｉ−１］とし共役元積Ａ［ｉ］^＊とともに前記約数列算出部に返却し、
前記逆元算出部は、前記約数列算出部の記憶する共役元積全てと、
前記約数列算出部が最後に呼び出した時の前記共役元積ノルム算出部が出力したノルムの逆元Ａ［０］^−１との積を、
Ａ^−１＝Ａ［ｋ＋１］^＊Ａ［ｋ］^＊・・・Ａ［１］^＊Ａ［０］^−１として計算し、
前記出力部は、前記逆元計算部の計算結果を出力する、
ことを備える。
【００２９】
本発明の第１の逆元演算方法は、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算方法であって、
ある素数ｑがあって１の原始ｑ乗根のみを根とする前記基礎体Ｋについて既約な多項式を定義多項式として用いて前記基礎体Ｋを拡大した拡大体Ｌを得る第１のステップと、
前記基礎体Ｋと前記拡大体Ｌとの間の所与の拡大次数ｎで前記基礎体Ｋを拡大した拡大体Ｍを求める第２のステップと、
前記拡大体Ｍの元の逆元を前記拡大体Ｌにおけるフロベニウス写像を用いて求める第３のステップと、
を備え、
前記ｑは、前記中間体の拡大次数ｎの整数倍に１を足した素数であることを備える。
【００３０】
本発明の第２の逆元演算方法は、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算方法であって、任意の基礎体とその任意拡大次数ｎの拡大体Ｍがあったとき、前記拡大次数ｎの整数倍に１を足した素数ｑによって得られるｑ次円分多項式により前記基礎体を拡大した拡大体Ｌを求め、前記拡大体Ｍにおけるフロベニウス写像が拡大体Ｌにおけるフロベニウス写像から自然に得られることを利用して逆元を求めることを備える。
【００３１】
本発明の第３の逆元演算方法は、第２の発明において、前記拡大体Ｍの元Ａの逆元を求めるにあたり、前記拡大体Ｍと前記基礎体Ｋとの間で前記拡大次数ｎの任意の約数ｎ［１］、・・・ｎ［ｋ］を、ｎ［ｉ］がｎ［ｉ＋１］を割りきるよう選び、
位数が（＃Ｋ）^ｎ［ｉ］である部分体をＮ［ｉ］としたとき、
Ｋ＝Ｎ［０］⊂Ｎ［１］⊂・・・Ｎ［ｋ］⊂Ｎ［ｋ＋１］＝Ｍであって、
最初にＭの直下の部分体Ｎ［ｋ］に関するＡの全ての共役元の積とノルムをもとめ、これを基礎体Ｋに達するまで繰り返し計算することにより逆元を求めることを備える。
【００３２】
本発明の第４の逆元演算方法は、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算方法であって、
前記拡大体Ｍの拡大次数ｎと、
ｑ＝ｎ・ｊ＋１（ｊは小さな自然数）で得られる素数ｑと、
ｑ次円分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐであって、その素数ｐを情報処理装置上の数値として表現した場合の有効ビット数が情報処理装置の処理するワード長以下で、かつそれに近いビット数、ワード長の半分以下でかつそれに近いビット数，およびワード長の２倍以下でかつそれに近いビット数、のいずれかの条件をもつ素数ｐと、
素体Ｚ／ｐＺを拡大して前記基礎体Ｋを得るための既約多項式と、
前記拡大体中の逆元を求める元Ａを入力する第１のステップと、
前記拡大次数ｎの任意の約数ｎ［１］、・・・ｎ［ｋ］について、ｎ［ｉ］がｎ［ｉ＋１］を割りきるような約数列を選ぶ第２のステップと、
前記拡大体Ｍと前記基礎体Ｋの間にあって位数が（＃Ｋ）^ｎ［ｉ］である中間体列を求める第３のステップと、
前記中間体列の前記拡大体Ｍ直下の中間体に関する元Ａの共役元で自分自身以外のものを全てかけあわせた共役元積を求めこれを記憶する第４のステップと、
前記共役元積と元Ａを掛け合わせてＡのノルムを計算してこれをＡ’とする第５のステップと、
前記第５のステップのＡ’について前記中間体列でＭから１段下げてシフトした中間体について前記第４のステップと第５のステップを実行し、同様にして前記ノルムが前記基礎体Ｋの元になるまでこれを有限回繰り返す第６のステップと、
基礎体についてのノルムの逆元を求め、前記第４のステップで記憶する全ての中間体列に関する共役元積との積を計算してこれをＡの逆元とする第７のステップと、
を備える。
【００３３】
本発明の第５の逆元演算方法は、２７ビット以上３２ビット以下の素数を標数とし１の原始７乗根を含まない素体に１の原始７乗根を付加して拡大した６次拡大体の元の逆元を計算する逆元演算方法であって，
前記６次拡大体の元で逆元を求める元が入力される第１のステップと、
前記素体の３次拡大体Ｎ［１］を求める第２のステップと、
元Ａの前記３次拡大体Ｎ［１］についての共役元全ての積を第一共役元積として計算する第３のステップと、
前記第一共役元積に元Ａをかけあわせた第一ノルムを計算する第４のステップと、
前記第一ノルムの前記素体についての共役元すべての積を第二共役元積として計算する第５のステップと、
前記第二共役元積に前記第一ノルムをかけあわせた第二ノルムを計算する第６のステップと、
第二ノルムの逆元を計算する第７のステップと、
第二ノルムの逆元と第二共役元積と第一共役元積とをかけあわせてＡの逆元を計算する第８のステップと、
Ａの逆元を出力する第９のステップと、
を備える。
【００３４】
本発明の第６の逆元演算方法は、第５の発明において、前記素体の元は情報処理装置において１ワードとして処理され、前記６次拡大体の元は６ワードとして処理されることを備える。
【００３５】
本発明の第７の逆元演算方法は、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算方法であって、
前記基礎体Ｋを拡大して前記拡大体Ｍを求める任意の拡大次数ｎ（ｎは自然数）と、
ｑ＝ｎ・ｊ＋１が素数となるようなｑ（ｊは小さい自然数）と、
ｑ次の円分分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐであって、その素数ｐを情報処理装置上の数値として表現した場合の有効ビット数が情報処理装置の処理するワード長以下でかつそれに近いビット数、ワード長の半分以下でかつそれに近いビット数，およびワード長の２倍以下でかつそれに近いビット数のいずれかの条件をもつ素数ｐと、
素体Ｚ／ｐＺを拡大して基礎体Ｋを得るための既約多項式と、
を入力する第１のステップと、
素体Ｚ／ｐＺ上の既約多項式を一つ選び、この既約多項式でＺ／ｐＺを拡大して得られる体を前記基礎体Ｋとし、既約多項式として一次式が選ばれた場合にはＫ＝Ｚ／ｐＺとするとともに、基礎体Ｋをｑ次の円分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）で拡大した体を拡大体Ｌとする時、拡大体Ｌの中間体Ｍとして
ｊ＝１の場合はＭとしてＬ自身をとり、ｊ＞１の場合は、位数がｐ^ｎのものをＭとし、逆元を計算する対象のＭの元Ａを入力する第２のステップと、
ｎの任意の約数ｎ［１］、・・・ｎ［ｋ］について、ｎ［ｉ］がｎ［ｉ＋１］を割りきるような約数列を選び、位数が（＃Ｋ）^ｎ［ｉ］であるＬの部分体をＮ［ｉ］とし、ｎ［０］＝１、Ｎ［０］＝Ｋ、Ｎ［ｋ＋１］＝Ｍ、Ａ［ｋ＋１］＝Ａとする第３のステップと、
Ｎ［ｉ］の要素Ａ［ｉ］について、Ｎ［ｉ−１］に関する共役元全ての積Ａ［ｉ］ ^＊を、
Ａ［ｉ］^＊＝Ａ［ｉ］＾｛ｐ^{ｎ［ｉ−１］}＋ｐ^{２ｎ［ｉ−１］}＋・・・＋ｐ^{ｎ［ｉ］−ｎ［ｉ−１］}｝＝（・・・（（Ａ［ｉ］＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）・・・）＾（ｐ^{ｎ［ｉ−１］}）と計算して記憶する第４のステップと、
ノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を、
Ｎ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）＝Ａ［ｉ］Ａ［ｉ］^＊と計算し、このノルムを新たにＡ［ｉ−１］とする第５のステップと、
ｉ＝ｋ＋１の拡大体Ｍの元Ａから１の基礎体Ｋまで順に、Ａ［ｉ］を入力し、
Ａ［ｉ］^＊及びノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を得る第６のステップと、
Ｎ_{Ｎ［１］／Ｎ［０］}（Ａ［１］）の逆元を求め、これをＡ［０］^−１とする第７のステップと、
第４のステップで記憶したＡ［ｉ］^＊と第７のステップのＡ［０］^−１から
Ａ^−１＝Ａ［ｋ＋１］^＊Ａ［ｋ］^＊・・・Ａ［１］^＊Ａ［０］^−１としてＡの逆元を得る第８のステップと、
を備える。
【００３６】
本発明の第１の逆元演算プログラムは、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算処理をコンピュータに実行させる逆元演算プログラムであって、
ある素数ｑがあって１の原始ｑ乗根のみを根とし前記基礎体Ｋについて既約な多項式を定義多項式として用いて前記基礎体Ｋを拡大した拡大体Ｌを得る機能と、前記基礎体Ｋと前記拡大体Ｌとの間の所与の数値ｎで前記基礎体Ｋを拡大した拡大体Ｍを求める機能と、
前記拡大体Ｍの元の逆元を前記拡大体Ｌにおけるフロベニウス写像を用いて求める機能と、
を備え、
前記ｑは、前記中間体の拡大次数ｎの整数倍に１を足した素数であることを備える。
【００３７】
本発明の第２の逆元演算プログラムは、有限体の基礎体Ｋを拡大した拡大体Ｍの元に対する逆元を求める逆元演算処理をコンピュータに実行させる逆元演算プログラムであって、
前記基礎体Ｋを拡大して前記拡大体Ｍを求める任意の拡大次数ｎ（ｎは自然数）と、
ｑ＝ｎ・ｊ＋１が素数となるようなｑ（ｊは小さい自然数）と、
ｑ次の円分分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐであって、その素数ｐを情報処理装置上の数値として表現した場合の有効ビット数が情報処理装置の処理するワード長以下でかつそれに近いビット数、ワード長の半分以下でかつそれに近いビット数，およびワード長の２倍以下でかつそれに近いビット数のいずれかの条件をもつ素数ｐと、
素体Ｚ／ｐＺを拡大して基礎体Ｋを得るための既約多項式と、
を入力する機能と、
素体Ｚ／ｐＺ上の既約多項式を一つ選び、この既約多項式でＺ／ｐＺを拡大して得られる体を前記基礎体Ｋとし、既約多項式として一次式が選ばれた場合にはＫ＝Ｚ／ｐＺとするとともに、基礎体Ｋをｑ次の円分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）で拡大した体を拡大体Ｌとする時、拡大体Ｌの中間体Ｍとして
ｊ＝１の場合はＭとしてＬ自身をとり、ｊ＞１の場合は、位数がｐ^ｎのものをＭとし、逆元を計算する対象のＭの元Ａを入力する機能と、
ｎの任意の約数ｎ［１］、・・・ｎ［ｋ］について、ｎ［ｉ］がｎ［ｉ＋１］を割りきるような約数列を選び、位数が（＃Ｋ）^ｎ［ｉ］であるＬの部分体をＮ［ｉ］とし、ｎ［０］＝１、Ｎ［０］＝Ｋ、Ｎ［ｋ＋１］＝Ｍ、Ａ［ｋ＋１］＝Ａとする機能と、
Ｎ［ｉ］の要素Ａ［ｉ］について、Ｎ［ｉ−１］に関する共役元全ての積Ａ［ｉ］ ^＊を、
Ａ［ｉ］^＊＝Ａ［ｉ］＾｛ｐ^{ｎ［ｉ−１］}＋ｐ^{２ｎ［ｉ−１］}＋・・・＋ｐ^{ｎ［ｉ］−ｎ［ｉ−１］}｝＝（・・・（（Ａ［ｉ］＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）・・・）＾（ｐ^{ｎ［ｉ−１］}）と計算して記憶する機能と、
ノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を、
Ｎ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）＝Ａ［ｉ］Ａ［ｉ］^＊と計算し、このノルムを新たにＡ［ｉ−１］とする機能と、
ｉ＝ｋ＋１の拡大体Ｍの元Ａから１の基礎体Ｋまで順に、Ａ［ｉ］を入力し、
Ａ［ｉ］^＊及びノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を得る機能と、
Ｎ_{Ｎ［１］／Ｎ［０］}（Ａ［１］）の逆元を求め、これをＡ［０］^−１とする機能と、
第４のステップで記憶したＡ［ｉ］^＊と第７のステップのＡ［０］^−１から
Ａ^−１＝Ａ［ｋ＋１］^＊Ａ［ｋ］^＊・・・Ａ［１］^＊Ａ［０］^−１としてＡの逆元を得る機能と、
を備える。
【００３８】
【発明の実施の形態】
本発明の実施の形態の構成を図１を参照して説明する。
【００３９】
本発明の実施の形態の構成は、共通鍵暗号等で使用する暗号鍵を生成する情報処理装置である暗号鍵生成装置１と、暗号鍵生成装置１と同じ構成をもつ暗号鍵生成装置２と、暗号鍵生成装置１と暗号鍵生成装置２とを接続するインターネットを含むネットワーク３と、から構成される。
【００４０】
さらに、暗号鍵生成装置１と暗号鍵生成装置２とは、キーボード等の入力手段１０と、暗号鍵生成のため楕円曲線の演算を行う暗号鍵演算装置１１と、ディスプレイやプリンタを含む出力手段１２と、暗号鍵の生成を行うソフトウェアプログラムを格納する磁気ディスク装置等の二次記憶装置１３と、から構成されている。
【００４１】
さらに、暗号鍵演算装置１１は、６４ビットアーキテクチャ、３２ビットアーキテクチャ等で設計されたＣＰＵ１１０と、予め固定された数値データ等の不揮発性データを記憶するＲＯＭ１１１と、二次記憶装置１３からロードした演算処理のプログラムを記憶するＲＡＭ１１２と、二次記憶装置１３との入出力を制御するＩＯポート１１３と、から構成されている。
【００４２】
次に、本発明の実施の形態の動作時におけるソフトウェアの構成について図２をもとに説明すると、外部からの入力データを入力手段１１によって受け付ける入力部４１と、前記入力データの数値から約数列を決定する約数列算出部４２と、前記約数列算出部から前記約数を逐次入力して共役元積とノルムとを計算し前記約数算出部４２に返却する共役元積ノルム計算部４３と、前記約数列算出部４２から入力した共役元積とノルムとから逆元を計算する逆元計算部４４と、前記逆元計算部４４で計算した逆元を出力手段１２等に出力する出力部４５とを備えている。
【００４３】
尚、本実施の形態は、共通鍵暗号処理における逆元の演算を例として説明するが、本発明は、これに限られるものでないことは明瞭である。
【００４４】
次に、本発明の実施の形態の動作について図３と図４のフローチャートを元に説明する。
【００４５】
暗号鍵生成装置１，２は、ネットワーク３を介して情報を交換して暗号鍵生成装置１，２の間で共有する共通暗号鍵の生成を行う。暗号鍵生成装置１、２の管理者は、暗号鍵演算装置１１のもつアーキテクチャに従って処理されるワード長以下でかつそれに近い素数ｐの持つビット数｜ｐ｜及びｐによる素体Ｚ／ｐＺによる基礎体Ｋに対する任意の拡大次数ｎ等を入力手段１０から入力する。これらの入力から楕円曲線を定義する体を決定する。
［体の選び方］
まずワード長倍数ζを１、１／２、または２とし、そこからζを選択する。ワード長倍数ζが１か１／２か２かに応じて、情報処理装置の処理するワード長以下でかつそれに近い素数ｐのビット数、ワード長の半分以下でかつそれに近い素数ｐのビット数，およびワード長の２倍以下でかつそれに近い素数ｐのビット数｜ｐ｜のいずれかが入力手段１０から与えられるとする。
【００４６】
さらに任意の拡大次数ｎが与えられたとする（ステップ１０１）。尚、一旦入力された数値は、ＲＯＭ１１１に記憶し、以降はＲＯＭ１１１に記憶した数値を取り込むようにしてもよい。
【００４７】
ｊを、ｑ＝ｎ・ｊ＋１が素数となるような整数とする（ステップ１０２）。
（なおｊは小さい方がより好ましい。）
ｑ分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐでかつｐのビット数が与えられたビット数に一致するようなｐを選ぶ。さらに、素体Ｚ／ｐＺ上の既約多項式を一つ選び、この既約多項式でＺ／ｐＺを拡大して得られる体を基礎体として固定する（ステップ１０３）。以後この基礎体をＫと書く。なお既約多項式として一次式が選ばれた場合にはＫ＝Ｚ／ｐＺとする。基礎体Ｋをｑ分多項式で拡大した体をＬとする。
【００４８】
ここで、ｑ分多項式はｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１となる。ｊ＝１の場合はＭとしてＬ自身をとる。ｊ＞１の場合は、Ｌの中間体で位数がｐ^ｎのものをＭとする（ステップ１０４）。尚、ｑ分多項式の数値ｑ及び既約多項式も入力手段１０から入力されるものとする。
【００４９】
以上説明した本発明の逆元演算に関する所与の条件を整理すると、
（１）任意の拡大次数ｎ（ｎは自然数）
（２）ｑ＝ｎ・ｊ＋１が素数となるようなｑ
（３）ｑ分多項式（ｘ^ｑ−１＋ｘ^ｑ−２＋・・・＋ｘ＋１）が素体Ｚ／ｐＺ上で既約となるような素数ｐであって、その素数ｐを情報処理装置上の数値として表現した場合の有効ビット数が情報処理装置の処理するワード長以下でかつそれに近いビット数、ワード長の半分以下でかつそれに近いビット数，およびワード長の２倍以下でかつそれに近いビット数のいずれかの条件をもつ素数ｐ
（４）素体Ｚ／ｐＺを拡大して基礎体Ｋを得るための既約多項式
となる。
【００５０】
以上の前提のもとに暗号鍵の生成処理に必要な処理プログラムが、暗号鍵演算装置１１の図示しないオペレーティングシステムによって二次記憶装置１３から読み出され、ＲＡＭ１１２に配置されて実行が開始される。この暗号鍵の生成における楕円曲線の演算にあたり、ある数値について上記体の逆元の計算が必要となった場合、暗号鍵の生成を行う本体から逆元を求める対象となる数値を引数として本発明に関する逆元演算処理の呼び出しが行われ、逆元が演算の結果として生成されると、呼び出し元にこの逆元が返却されるようになっている。
［逆元演算方法］
［準備（１）（体Ｋの２つの元の積の計算）］
Ｋの要素（ａ_１、ａ_２、、、、ａ_ｑ−１）及び（ｂ_１、ｂ_２、、、ｂ_ｑ−１）を用いてあらわされる体Ｌの要素Ａ＝ａ_１ｘ＋ａ_２ｘ^２＋・・・＋ａ_ｑ−１ｘ^ｑ−１、及びＢ＝ｂ_１ｘ＋ｂ_２ｘ^２＋・・・ｂ_ｑ−１ｘ^ｑ−１の積は、多項式ＡＢの積を求めた後、ｑ分多項式による同値関係を用いて、一意にｃ_１ｘ＋ｃ_２ｘ^２＋・・・ｃ_ｑ−１ｘ^ｑ−１とあらわすことができる。但し、（ｃ_１、ｃ_２、、、、ｃ_ｑ−１）はＺ／ｐＺの要素である。
［準備（２）（体Ｌ上の演算）］
体Ｌの任意の元ｗは、ｑ−１個のＫの元ａ_１、ａ_２、、、、ａ_ｑ−１を用いて、
ｗ＝ａ_１ｘ＋ａ_２ｘ^２＋・・・＋ａ_ｑ−１ｘ^ｑ−１とあらわすことができる。
【００５１】
以下、ａ_１ｘ＋ａ_２ｘ^２＋・・・＋ａ_ｑ−１ｘ^ｑ−１を略して（ａ_１、ａ_２、、、、ａ_ｑ−１）とも書くことにする。
【００５２】
この要素のフロベニウス写像φによるφ（ｗ）は、
φ（ｗ）＝（ａ’_１、ａ’_２、、、、ａ’_ｑ−１）と表すことができる。
但し、ａ’_ｉｐ _ｍｏｄ _ｑ＝ａ_ｉ
［準備（３）（体Ｍ上の演算）］
体Ｍは体Ｌに埋め込まれているため、体Ｍの要素に対するフロベニウス写像は、体Ｌの要素に対するフロベニウス写像と同様に計算できる。
【００５３】
また、同様に体Ｍの要素の積も計算できる。
【００５４】
この時、体Ｍは体Ｌより位数が小さいので、ｑ−１個のＺ／ｐＺの要素（ａ_１、ａ_２、、、、ａ_ｑ−１）の中には、高々ｎ個しか異なる値を含まない。これを利用すると、体Ｍの要素間の積は体Ｌのそれより簡単に計算できる。
［逆元演算］
前記［体の選び方］に記述した様に選ばれた体Ｌ，Ｍ，Ｋ，Ｚ／ｐＺ及びｎ、ｑがあるとする。そして、逆元演算対象として体Ｍの要素Ａが入力されたとする（ステップ２０１）。
【００５５】
ｎの任意の約数ｎ［１］、・・・ｎ［ｋ］を、ｎ［ｉ］がｎ［ｉ＋１］を割りきるよう複数選ぶ（ステップ２０２）。
【００５６】
位数が（＃Ｋ）^ｎ［ｉ］（Ｋの位数のｎ［ｉ］乗）で、拡大体Ｌの部分体をＮ［ｉ］と呼ぶことにする（ステップ２０３）。
【００５７】
また、ｎ［０］＝１、Ｎ［０］＝Ｋ、Ｎ［ｋ＋１］＝Ｍ、Ａ［ｋ＋１］＝Ａとする。
【００５８】
Ｎ［ｉ］の要素Ａ［ｉ］が逐次入力されたとき、
Ｎ［ｉ−１］に関するＡ［ｉ］を除くＡ［ｉ］の共役元全ての積Ａ［ｉ］ ^＊及びノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）を、
Ａ［ｉ］^＊＝Ａ［ｉ］＾｛ｐ^{ｎ［ｉ−１］}＋ｐ^{２ｎ［ｉ−１］}＋・・・＋ｐ^{ｎ［ｉ］−ｎ［ｉ−１］}｝＝（・・・（（Ａ［ｉ］＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）＾（ｐ^{ｎ［ｉ−１］}）Ａ［ｉ］）・・・）＾（ｐ^{ｎ［ｉ−１］}）、
Ｎ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）＝Ａ［ｉ］Ａ［ｉ］^＊、と計算する。
【００５９】
共役元積生成方法を利用して以下の処理をする。
【００６０】
ここでＫ＝Ｎ［０］⊂Ｎ［１］⊂・・・⊂Ｎ［ｋ＋１］＝Ｍである。
ｉ＝ｋ＋１から１まで順に（ステップ２０６）、共役元積生成方法にＡ［ｉ］を入力し、Ａ［ｉ］^＊（ステップ２０４）及びノルムＮ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）（ステップ２０５）を得、Ｎ_{Ｎ［ｉ］／Ｎ［ｉ−１］}（Ａ［ｉ］）をＡ［ｉ−１］とする。
Ｎ_{Ｎ［１］／Ｎ［０］}（Ａ［１］）の逆元を求め（ステップ２０７）これをＡ［０］^−１とする．Ａ^−１＝Ａ［ｋ＋１］^＊Ａ［ｋ］^＊・・・Ａ［１］^＊Ａ［０］^−１とする（ステップ２０８）。これがＡの逆元である（ステップ２０９）。
【００６１】
［実施例（１）］
情報処理装置の処理ワード長が３２ビットであるとし、ワード長倍数ζ１で、拡大次数ｎが８となる拡大体Ｍを選び、この体上での逆元演算を行う方法を図３と図４のフローチャートを参照しながら説明する。
【００６２】
ワード長の数値３２と拡大次数の数値８が入力される（ステップ１０１）。
８＊２＋１＝１７が素数なのでｑ＝１７とする（ステップ１０２）。
【００６３】
第１７円分多項式Φ_１７＝１＋ｘ＋ｘ^２＋・・・＋ｘ^１６がＺ／ｐＺ上既約となる素数ｐでかつｐのビット長が３２以下３２に近いｐを選ぶ（ステップ１０３）。ここでは例としてｐ＝２^２７−３９とする。
【００６４】
次にＺ／ｐＺ上の既約多項式を一つ選ぶ。ここでは一次式が選ばれたとする。よって基礎体ＫはＺ／ｐＺ自身である。Ｋを１７分多項式で拡大した体をＬとする。
Ｌの中間体でその位数がｐ^８であるものをＭとする（ステップ１０４）。
【００６５】
Ｍの要素Ａは８個のＫの要素（ａ_１，ａ_２，・・・、ａ_８）を用いて、
Ａ＝ａ_１ｘ＋ａ_２ｘ^２＋・・・＋ａ_７ｘ^７＋ａ_８ｘ^８＋ａ_８ｘ^９＋ａ_７ｘ^１０＋・・・＋ａ_２ｘ^１５＋ａ_１ｘ^１６とあらわすことができる。
Ｍの要素Ａが入力される（ステップ２０１）。
（１）ＭのＫに対する拡大次数は８である。８の約数として２，４を選ぶ（２は４を割りきる）（ステップ２０２）。以下、Ｌの中間体で位数がｐ^２であるものをＮ［１］，位数がｐ^４であるものをＮ［２］とする（ステップ２０３）。
（２）ＡのＮ［２］に関する共役元全ての積Ａ^＊を、
Ａ^＊＝Ａ＾｛ｐ^４｝として計算する（ステップ２０４）。
【００６６】
これはフロベニウス写像を４回作用させたもので
φ^４：Ａ→Ａ＾｛ｐ^４｝は成分でかくと、
φ^４：ａ_１ｘ＋ａ_２ｘ^２＋ａ_３ｘ^３＋ａ_４ｘ^４＋ａ_５ｘ^５＋ａ_６ｘ^６＋ａ_７ｘ^７＋ａ_８ｘ^８＋ａ_８ｘ^９＋ａ_７ｘ^１０＋ａ_６ｘ^１１＋ａ_５ｘ^１２＋ａ_４ｘ^１３＋ａ_３ｘ^１４＋ａ_２ｘ^１５＋ａ_１ｘ^１６
→ ａ_４ｘ＋ａ_８ｘ^２＋ａ_５ｘ^３＋ａ_１ｘ^４＋ａ_３ｘ^５＋ａ_７ｘ^６＋ａ_６ｘ^７＋ａ_２ｘ^８＋ａ_２ｘ^９＋ａ_６ｘ^１０＋ａ_７ｘ^１１＋ａ_３ｘ^１２＋ａ_１ｘ^１３＋ａ_５ｘ^１４＋ａ_８ｘ^１５＋ａ_４ｘ^１６
である。
（Ａを拡大体Ｌの要素と見ることで、フロベニウス写像が、単なるＫの要素の入れ替えとなっている。）
（３）ＡのＮ［２］に関するノルムＡ［２］を、
Ａ［２］＝Ａ・Ａ^＊ｍｏｄ Φ_１７として計算する（ステップ２０５）。
【００６７】
Ａ［２］の要素は４個のＫの要素（ｃ_１、ｃ_２、ｃ_３、ｃ_４）を用いて、
Ａ［２］＝ｃ_１ｘ＋ｃ_２ｘ^２＋ｃ_３ｘ^３＋ｃ_１ｘ^４＋ｃ_３ｘ^５＋ｃ_４ｘ^６＋ｃ_４ｘ^７＋ｃ_２ｘ^８＋ｃ_２ｘ^９＋ｃ_４ｘ^１０＋ｃ_４ｘ^１１＋ｃ_３ｘ^１２＋ｃ_１ｘ^１３＋ｃ_３ｘ^１４＋ｃ_２ｘ^１５＋ｃ_１ｘ^１６
とあらわすことができる。
（４）Ｎ［２］に関する共役元、ノルムを計算したが、このＮ［２］は基礎体Ｋの元ではないので、再び共役元の積を求めるステップに行く（ステップ２０６）。
（５）Ａ［２］のＮ［１］に関する共役元全ての積Ａ［２］^＊を、
Ａ［２］^＊＝Ａ［２］＾｛ｐ^２｝と計算する（ステップ２０４）。
【００６８】
これはフロベニウス写像を２回作用させたもので
Ａ［２］＾｛ｐ^２｝＝φ^２（Ａ［２］）を、成分でかくと、
φ^２（ｃ_１ｘ＋ｃ_２ｘ^２＋ｃ_３ｘ^３＋ｃ_１ｘ^４＋ｃ_３ｘ^５＋ｃ_４ｘ^６＋ｃ_４ｘ^７＋ｃ_２ｘ^８＋ｃ_２ｘ^９＋ｃ_４ｘ^１０＋ｃ_４ｘ^１１＋ｃ_３ｘ^１２＋ｃ_１ｘ^１３＋ｃ_３ｘ^１４＋ｃ_２ｘ^１５＋ｃ_１ｘ^１６）
＝ｃ_２ｘ＋ｃ_１ｘ^２＋ｃ_４ｘ^３＋ｃ_２ｘ^４＋ｃ_４ｘ^５＋ｃ_３ｘ^６＋ｃ_３ｘ^７＋ｃ_１ｘ^８＋ｃ_１ｘ^９＋ｃ_３ｘ^１０＋ｃ_３ｘ^１１＋ｃ_４ｘ^１２＋ｃ_２ｘ^１３＋ｃ_４ｘ^１４＋ｃ_１ｘ^１５＋ｃ_２ｘ^１６
である。
（６）Ａ［２］のＮ［１］に関するノルムＡ［１］を、
Ａ［１］＝Ａ［２］・Ａ［２］^＊ｍｏｄ Φ_１７により計算する（ステップ２０５）。
Ａ［１］の要素は２個のＫの要素（ｄ_１、ｄ_２）を用いて、
Ａ［１］＝ｄ_１ｘ＋ｄ_１ｘ^２＋ｄ_２ｘ^３＋ｄ_１ｘ^４＋ｄ_２ｘ^５＋ｄ_２ｘ^６＋ｄ_２ｘ^７＋ｄ_１ｘ^８＋ｄ_１ｘ^９＋ｄ_２ｘ^１０＋ｄ_２ｘ^１１＋ｄ_２ｘ^１２＋ｄ_１ｘ^１３＋ｄ_２ｘ^１４＋ｄ_１ｘ^１５＋ｄ_１ｘ^１６
とあらわすことができる。
（７）Ｎ［１］に関する共役元、ノルムを計算したが、このＮ［１］は基礎体Ｋの元ではないので、再び共役元の積を求めるステップに行く（ステップ２０６）。
（８）Ａ［１］のＫに関する共役元全ての積Ａ［１］^＊を、
Ａ［１］^＊＝Ａ［１］＾｛ｐ｝と計算する（ステップ２０４）。
これはフロベニウス写像を１回作用させたもので、
φ（Ａ［１］）＝Ａ［１］＾｛ｐ｝は、成分でかくと、
φ（ｄ_１ｘ＋ｄ_１ｘ^２＋ｄ_２ｘ^３＋ｄ_１ｘ^４＋ｄ_２ｘ^５＋ｄ_２ｘ^６＋ｄ_２ｘ^７＋ｄ_１ｘ^８＋ｄ_１ｘ^９＋ｄ_２ｘ^１０＋ｄ_２ｘ^１１＋ｄ_２ｘ^１２＋ｄ_１ｘ^１３＋ｄ_２ｘ^１４＋ｄ_１ｘ^１５＋ｄ_１ｘ^１６）
＝ｄ_２ｘ＋ｄ_２ｘ^２＋ｄ_１ｘ^３＋ｄ_２ｘ^４＋ｄ_１ｘ^５＋ｄ_１ｘ^６＋ｄ_１ｘ^７＋ｄ_２ｘ^８＋ｄ_２ｘ^９＋ｄ_１ｘ^１０＋ｄ_１ｘ^１１＋ｄ_１ｘ^１２＋ｄ_２ｘ^１３＋ｄ_１ｘ^１４＋ｄ_２ｘ^１５＋ｄ_２ｘ^１６
である。
（９）Ａ［１］のＫに関するノルムＡ［０］を、
Ａ［０］＝Ａ［１］・Ａ［１］^＊ｍｏｄ Φ_１７を計算する（ステップ２０５）。
【００６９】
Ａ［０］の要素は１個のＫの要素（ｅ_１）を用いて、
Ａ［０］＝ｅ_１ｘ＋ｅ_１ｘ^２＋ｅ_１ｘ^３＋ｅ_１ｘ^４＋ｅ_１ｘ^５＋ｅ_１ｘ^６＋ｅ_１ｘ^７＋ｅ_１ｘ^８＋ｅ_１ｘ^９＋ｅ_１ｘ^１０＋ｅ_１ｘ^１１＋ｅ_１ｘ^１２＋ｅ_１ｘ^１３＋ｅ_１ｘ^１４＋ｅ_１ｘ^１５＋ｅ_１ｘ^１６
とあらわすことができる。
（１０）Ｋに関する共役元、ノルムを計算し終えたが、このＫは基礎体なので次の（ステップ２０７）に行く。
（１１）ｅ_１の逆元ｅ_１ ^−１を求める（ステップ２０７）。
（１２）Ａの逆元Ａ^−１を、
Ａ^−１＝ｅ_１ ^−１Ａ［１］^＊Ａ［２］^＊Ａ^＊と計算する（ステップ２０８）。
最後にＡ^−１を出力手段１２によって出力して終了する（ステップ２０９）。
【００７０】
［実施例（２）］
情報処理装置の処理ワード長が３２ビットであるとし、ワード長倍数ζが１で、拡大次数が６となる拡大体Ｍを選び、この体上での逆元演算を行う方法を図３と図４のフローチャートを参照しながら説明する。
ワード長（３２）と拡大次数（６）が入力される（ステップ１０１）。
６ｘ１＋１＝７が素数なので、ｑ＝７とする（ステップ１０２）。
【００７１】
７分多項式Φ_７＝１＋ｘ＋ｘ^２＋ｘ^３＋ｘ^４＋ｘ^５＋ｘ^６がＺ／ｐＺ上既約となる素数ｐでかつｐのビット長が３２以下３２に近いｐを選ぶ（ステップ１０３）。
【００７２】
ここでは例としてｐ＝２^２７−１１５とする。Ｚ／ｐＺ上の既約多項式を一つ選ぶ。ここでは既約多項式として一次式が選ばれたとする。よって基礎体ＫはＺ／ｐＺ自身である。
【００７３】
Ｋを７分多項式で拡大した体をＬとする。Ｌ自体をＭとする（ステップ１０４）。Ｍの要素Ａを選択すると、Ａは６個のＫの要素（ａ_１、ａ_２、ａ_３、ａ_４、ａ_５、ａ_６）を用いて、
Ａ＝ａ_１ｘ＋ａ_２ｘ^２＋ａ_３ｘ^３＋ａ_４ｘ^４＋ａ_５ｘ^５＋ａ_６ｘ^６とあらわすことができる。
Ｍの要素Ａが入力される（ステップ２０１）。
（１）ＭのＫに対する拡大次数は６である。６の約数として３を選ぶ。以下、Ｌの中間体で位数がｐ^３であるものをＮ［１］とする（ステップ２０３）。
（２）ＡのＮ［１］に関する共役元全ての積Ａ^＊を、
Ａ^＊＝Ａ＾｛ｐ^３｝として計算する（ステップ２０４）。
これはフロベニウス写像を３回作用させたもので
φ^３（Ａ）＝Ａ＾｛ｐ^３｝を成分でかくと、
φ^３（ａ_１ｘ＋ａ_２ｘ^２＋ａ_３ｘ^３＋ａ_４ｘ^４＋ａ_５ｘ^５＋ａ_６ｘ^６）＝ａ_６ｘ＋ａ_５ｘ^２＋ａ_４ｘ^３＋ａ_３ｘ^４＋ａ_２ｘ^５＋ａ_１ｘ^６である。
（３）ＡのＮ［１］に関するノルムＡ［１］を、
Ａ［１］＝Ａ・Ａ^＊ｍｏｄ Φ_７を計算する（ステップ２０５）。
Ａ［１］の要素は３個のＫの要素（ｃ_１、ｃ_２、ｃ_３）を用いて、
Ａ［１］＝ｃ_１ｘ＋ｃ_２ｘ^２＋ｃ_３ｘ^３＋ｃ_３ｘ^４＋ｃ_２ｘ^５＋ｃ_１ｘ^６
とあらわすことができる。
（４）Ｎ［１］に関する共役元、ノルムを計算したが、このＮ［１］は基礎体Ｋではないので、再び共役元の積を求めるステップに行く（ステップ２０６）。
（５）Ａ［１］のＫに関する共役元全ての積Ａ［１］^＊を、
Ａ［１］^＊＝Ａ［１］＾｛ｐ＋ｐ^２｝＝（Ａ［１］＾ｐＡ）＾ｐとして計算する（ステップ２０４）。
これはフロベニウス写像と積の演算により可能である。
ここで φ（Ａ［１］）＝Ａ［１］＾｛ｐ｝は、成分でかくと、
φ（ｃ_１ｘ＋ｃ_２ｘ^２＋ｃ_３ｘ^３＋ｃ_３ｘ^４＋ｃ_２ｘ^５＋ｃ_１ｘ^６）＝ｃ_３ｘ＋ｃ_１ｘ^２＋ｃ_２ｘ^３＋ｃ_２ｘ^４＋ｃ_１ｘ^５＋ｃ_３ｘ^６である。
（６）Ａ［１］のＫに関するノルムＡ［０］を、
Ａ［０］＝Ａ［１］・Ａ［１］^＊ｍｏｄ Φ_７として計算する（ステップ２０５）。
【００７４】
Ａ［０］の要素は１個のＫの要素（ｅ_１）を用いて、
Ａ［０］＝ｅ_１ｘ＋ｅ_１ｘ^２＋ｅ_１ｘ^３＋ｅ_１ｘ^４＋ｅ_１ｘ^５＋ｅ_１ｘ^６
とあらわすことができる。
（７）Ｋに関する共役元、ノルムを計算したが、このＫは基礎体なので次の（ステップ２０７）に行く。
（８）ｅ_１の逆元ｅ_１ ^−１を求める（ステップ２０７）。
（９）Ａの逆元Ａ^−１を、
Ａ^−１＝ｅ_１ ^−１Ａ［１］^＊Ａ^＊として計算する（ステップ２０８）。
最後にＡ^−１を出力手段１２によって出力して終了する（ステップ２０９）。
【００７５】
【発明の効果】
任意の基礎体とその任意次の拡大体に対し逆元演算が従来の技術に比べて同等かより高速に行える。
【００７６】
第１に、本発明におけるフロベニウス写像はいずれも基礎体上の要素の入れ替えにすぎないため、計算のコストは著しく低い。このような特徴を持つためには、拡大体を素数ｑによるｑ分多項式による拡大で生成するか、ｑ円分多項式で逐次拡大する必要があった。
【００７７】
このため利用できる拡大体の拡大次数が限られていたが、本発明の場合はこの制限をうけない。また、本発明におけるフロベニウス写像の計算コストはＯＥＦによる方法のそれよりも低い。
【００７８】
第２に本発明における積の計算コストはＯＥＦのそれと比較しても低い。これは、Ｍの元をＬへ埋め込まれていると見ると、ｑより次数の高い項はΦ_ｑによりより低い項と同一視できるからである。ＯＥＦの場合この高次の項は、その係数に小さい係数を乗じた低次の項と同一視できるため、乗算の計算コストが発生する。
【００７９】
第３に、本発明は逐次、より小さい中間体に関する共役元の逆元演算に帰着している。このことは、積の計算をより小さい体で行うことを可能にしている。例えば、実施例（１）ではＡのＫに関する全ての共役元の積をＭ上のフロベニウス写像と乗算を用いて求めるより、これを実施例のようにＡ^＊Ａ［１］^＊Ａ［２］^＊として求める方が効率的である。なぜならＡ［１］^＊等をより小さな中間体の積を使うことにより求めることができるからである。尚、これは逐次拡大の持つ利点と同じである。
【図面の簡単な説明】
【図１】本発明の実施の形態の構成を説明するブロック図である。
【図２】本発明の実施の形態のソフトウェア構成を説明するブロック図である。
【図３】本発明の実施例１及び実施例２の拡大体を決定する方法のフローーチャートである。
【図４】本発明の実施例１及び実施例２の逆元を求める方法のフローーチャートである。
【符号の説明】
１暗号鍵生成装置
１０入力手段
１１暗号鍵演算装置
１１０ＣＰＵ
１１１ＲＯＭ
１１２ＲＡＭ
１１３ＩＯポート
１２出力手段
１３二次記憶装置
２暗号鍵生成装置
３ネットワーク
４１入力部
４２約数列算出部
４３共役元積ノルム計算部
４４逆元計算部
４５出力部[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a method for obtaining the inverse of an element of an intermediate between a base field which is a finite field and a finite-order extension field thereof. The present invention relates to an inverse operation device, an inverse operation method, and an inverse operation program that use a primitive m-th root as a root and a root having only the primitive m-th root as a definition polynomial.
[0002]
[Prior art]
In elliptic curve cryptography and codes, an operation for finding the inverse of an element of a finite field that is not necessarily a prime field may be used. In many cases, this operation requires more calculation time than other operations such as multiplication and addition.
[0003]
Patent Literature 1 describes this content.
Here is an example of elliptic curve cryptography. The calculations required for the addition of points on an elliptic curve defined on a certain finite field are three multiplications on the definition field and one inverse operation when the points are represented by the affine coordinates. When the definition field is a prime field, the amount of calculation required for the inverse operation is 10 times or more the multiplication, and the ratio of the inverse operation in the calculation required for adding points is large. Therefore, speeding up the inverse operation has become an important issue.
[0004]
Several methods are known for improving the inverse operation of a definition field by making the definition field a finite field that is not a prime field. As such an efficiency improving method, for example, an OEF method, a successively expanding OEF method, a method of expanding a circle, and the like are known.
[0005]
The OEF method is a method described in Non-Patent Document 1.
The successive expansion OEF method is a method described in Non-Patent Document 2.
[0006]
The method of enlarging a circle is a method described in Non-Patent Document 3.
[0007]
First, an OEF method will be described. Assuming that the extension degree of the definition field from the prime field is m, the element of the definition field can be regarded as m elements of the prime field. The word length processed by the information processing device is u. In OEF, the order p of the definition field is 2^uLess than and the order is 2^uMust be close to Furthermore, the definition polynomial of the definition field is given by an integer w
X^mUse something that can be written in -w form. The smaller the absolute value of the integer w, the faster the operation.
[0008]
The multiplication and the inverse operation in the OEF method will be described. For example, it is assumed that the word length is 32 (32-bit information processing device) and the extension degree m is 7.
The number of bits of the order p of the definition field is 32 or less. The element of Z / pZ can be written in one word. When the element A of the definition field is arbitrarily taken, A is an element a of Z / pZ.₀, A₁, A₂, A₃, A₄, A₅, A₆Using,
a₀+ A₁X + a₂X²+ A₃X³+ A₄X⁴+ A₅X⁵+ A₆X⁶Can be expressed as Let another element B of the definition field be b₀+ B₁X + b₂X²+ B₃X³+ B₄X⁴+ B₅X⁵+ B₆X⁶Then, in order to obtain the product AB of the two elements, first, the product as a polynomial of the two elements is obtained. The result is a twelfth order polynomial, the element c of Z / pZ₀, C₁, C₂, C₃, C₄, C₅, C₆, C₇, C₈, C₉, C₁₀, C₁₁, C₁₂Using c₀+ C₁X + c₂X²+ C₃X³+ C₄X⁴+ C₅X⁵+ C₆X⁶+ C₇X⁷+ C₉X⁸+ C₉X⁹+ C₁₀X¹⁰+ C₁₁X¹¹+ C₁₂X¹²I will show you.
[0009]
This is represented by the irreducible polynomial X⁷Use -w to reduce to a 6th order polynomial. That is, the operation “c” for n of 7 or more_nXⁿ→ wc_nX^n-7And obtain a sixth-order polynomial. The obtained sixth order equation is the product AB of the two elements A and B on the extended field.
[0010]
Next, the method of the inverse operation will be described. ＾
First, A^-1= (A^{(P ＾ (m−1) + p ＾ (m−2) +,... + P + 1)})^-1A^{(P ＾ (m-1) + p ＾ (m-2) +,... + P)}Is known to be. A first^{(P ＾ (m-1) + p ＾ (m-2) +,... + P)}Ask for.
[0011]
In the OEF, the Frobenius map A → A^pThis calculation can be done quickly, since can be easily calculated.
[0012]
In particular,
A^{(P ＾ (m-1) + p ＾ (m-2) +,... + P)}= (... ((A^pA)^pA). . . )^p, The value is calculated by alternately using the Frobenius mapping and the operation for taking the product of A. Then multiply this by A^{(P ＾ (m−1) + p ＾ (m−2) +,... + P + 1)}Ask for. Since this value is an element of the prime field, it is sufficient to calculate the inverse element on the basic field.
[0013]
The first advantage of using the OEF is that the above-described calculation for obtaining a polynomial product can be performed with a product and a sum of numbers within a word length processed by the information processing device, so that a multiple length operation is not required. In the case of software implementation, the speed is increased.
[0014]
The second advantage is that when the 12th-order polynomial is dropped to the 6th order, each Z / pZ need only be multiplied by a small value of w. If this is a prime field having the same order of magnitude as the extension field, the computation cost required for division corresponding to the same operation is very large.
[0015]
A third advantage is that the calculation of the inverse is easy. The inverse operation on the prime field is very expensive if the field is large, but in the case of OEF, the inverse operation required when calculating the inverse of the expanded field is the inverse operation on the small prime field Only costs are low.
[0016]
Next, a method using the successively enlarged OEF will be described. The method based on the successive expansion OEF uses a body expanded by repeatedly applying the same expansion as the method based on the OEF. As an example, a case where the image is enlarged twice will be described.
[0017]
First, one finite field K is taken and its expanded field M is taken. What is further enlarged from the enlarged body M will be referred to as an enlarged body L. The extension order of M from K is n ', and the extension order of L from M is n. Take an element A of L arbitrarily. A method of obtaining the inverse of the element A by the successively enlarged OEF will be described.
[0018]
As with OEF
A^-1= (A^{(P ＾ (n−1) + p ＾ (n−2) +,... + P + 1)})^-1A^{(P ＾ (n-1) + p ＾ (n-2) +,... + P)}Take advantage of that.
Where B = A^{(P ＾ (n−1) + p ＾ (n−2) +,... + P + 1)}Then, B is an element of M.
Then again
B^-1= (B^{(P ＾ (n′−1) + p ＾ (n′−2) +,... + P + 1)})^-1B^{(P ＾ (n'-1) + p ＾ (n'-2) +,... + P)}Will stand out.
[0019]
Where C = B^{(P ＾ (n′−1) + p ＾ (n′−2) +,... + P + 1)}In particular, C is an element of the base body K. Therefore A^-1= A^{(P ＾ (n-1) + p ＾ (n-2) +,... + P)}B^{(P ＾ (n'-1) + p ＾ (n'-2) +,... + P)}C^-1It is.
[0020]
Using this equation, A^-1Ask for. If the number of times of enlargement is larger than 2, the same method may be repeated for each of the enlarged fields.
The advantage of using the method based on the successive expansion OEF will be described in the above example.
Equation A^-1= A^{(P ＾ (n-1) + p ＾ (n-2) +,... + P)}B^{(P ＾ (n'-1) + p ＾ (n'-2) +,... + P)}C^-1Using the formula A^-1In the calculation on the right side, the operation of multiplying A is an operation on the field L, but the operation of multiplying B is an operation on the field M. Since the field M is smaller than the field L, the latter operation can be performed more efficiently. It is assumed that there is a relation of m = nn 'between m in the OEF method and n, n' in the present method. This is an appropriate assumption to make the ciphers of similar strength when these bodies are used for the ciphers.
[0021]
The expanded field used in the OEF is denoted by L '. In the case of OEF, the necessary operations for the inverse operation are m multiplications over the field L ′ and the inverse operation on the prime field, and in the case of the successively expanded OEF, n multiplications over the field L and on the field M Multiplication is n 'inverse operations on the base field. Since the cost of multiplication on the field L and the cost of multiplication on the field L 'are almost the same, the sequentially expanded OEF as a whole has a lower computation cost. However, in the case of the successively expanded OEF, the expansion order of the field can be written as nn ', so that the expansion order needs to be a composite number.
[0022]
Finally, a method using the circle enlargement will be described. With respect to the finite field K, a polynomial on K with a primitive m-th root and only the root is referred to as an m-th circle polynomial on K. The fact that K does not include a primitive mth root of 1 is a necessary and sufficient condition for an m-th order circular polynomial on K to be irreducible. In the method using the circle enlargement, it is expected that the Frobenius mapping is faster in addition to the effect almost equivalent to the OEF. However, selectable expansion fields are limited to those whose expansion degree is one smaller than a prime number.
[0023]
[Patent Document 1]
JP-A-2000-214768 (4-4, FIG. 1)
[Non-patent document 1]
Daniel V., Bailey, Christof Paar, "Optimal Extension Field for Fast Arismetic in Public Key Algorithms. Crypt 98, Springer Lecture Notes in Computer Science, 1996 ( Optimal Extension Fields for Fast Arithmetic in Public-Key Algorithms, CRYPTO '98. Springer Lecture Notes in Computer Sciences, 1996.).
[Non-patent document 2]
Tetsutaro Kobayashi, Kazumaro Aoki, Literature by Hoshino Literature "Successive Expansion OEF, SCIS2000-B02"
[Non-Patent Document 3]
Shigetake Yanagisawa, Kazuto Matsuo, Shinki Cho, Document by Shigeo Tsujii, "Hardware Implementation of Elliptic Cryptography, SCIS'98-10.1.C."
[0024]
[Problems to be solved by the invention]
As of 2003, many computers use 32-bit CPUs.
[0025]
Therefore, in order to implement software for elliptic curve cryptography at high speed, the unit of the operation is 32 bits or less and the value is 2 bits.³²It is desirable to be close to At the same time, the standard number of bits for the security constant of the elliptic curve cryptosystem is 160 bits. This means that the order of the body used is 2^160-1It is required to be more than that. If a prime field of about 32 bits is selected, the extension degree must be 5 or 6 so that the order of the extension field is the above value. In order for the extension degree to be 5, the number of bits of the base field needs to be exactly 32 (= 160/5). If the extension degree is 6, the number of bits of the basic field may be 27 (> 160/6) bits or more.
[0026]
In the prior art, it is concluded that in order to speed up the Frobenius mapping, it is preferable that the field expansion be performed by a circular polynomial, and that in order to perform multiplication with a small field, sequential expansion be preferable. However, when 5 is selected as the expansion degree, 5 cannot be a sequential expansion because 5 is a prime number, and 5 + 1 is not a prime number, so that expansion by a circular polynomial cannot be performed. When 6 is selected as the expansion order, 6 = 2 × 3, so that the expansion can be performed sequentially. However, since 3 + 1 is a composite number, the expansion of the 4th order cannot be performed by the circular polynomial.
[0027]
The present invention makes it possible to apply a magnification using a circular polynomial to an extension field of any extension degree, and to calculate the Frobenius mapping of the extension field at high speed. It is an object of the present invention to provide an inverse operation device, an inverse operation method, and an inverse operation program which can also have advantages.
[0028]
[Means for Solving the Problems]
A first inverse operation device of the present invention is an inverse operation device for obtaining an inverse element of an element of an enlarged field M obtained by enlarging a base field K of a finite field,
An input unit that receives input data from the outside, a divisor sequence calculator that determines a divisor sequence from the numerical values of the input data, and calculates the conjugate product and norm by sequentially inputting the divisor from the divisor sequence calculator A conjugate element product norm calculation section returned to the divisor sequence calculation section; an inverse element calculation section that calculates an inverse element from the conjugate element product and the norm input from the divisor sequence calculation section; And an output unit for outputting the inverted element,
The input unit includes an arbitrary expansion degree n (n is a natural number) for obtaining the expansion field M by expanding the basic field K, and q (j is a small natural number) such that q = n · j + 1 is a prime number. , Q-th circular fraction polynomial (x^q-1+ X^q-2+ ... + x + 1) is a prime p that is irreducible in the prime field Z / pZ, and the number of effective bits when the prime p is expressed as a numerical value on the information processing device is equal to the processing of the information processing device. A prime number p having any of the following conditions: the number of bits that is less than or equal to the word length, the number of bits that is less than or equal to half the word length, and the number of bits that is less than or equal to twice the word length and closer thereto.
And an irreducible polynomial for expanding the prime field Z / pZ to obtain the basic field K,
A base field K is generated based on the prime number p and the irreducible polynomial, and the base field K is expanded by n to expand the field M, and the base field K is expanded by the q-th circular polynomial to determine an expanded field L. , An element A for performing an inverse operation on the element of the extension field M is input,
The divisor sequence calculator selects a divisor sequence such that n [i] divides n [i + 1] for divisors n [1],..., N [k] of n. Let n [i] be the subfield of L that is the power of n [i], n [0] = 1, n [k + 1] = n, N [0] = K, N [k + 1] = M, A [k + 1] ] = A, the divisors n [i] and n [i + 1] of n and A [i] are sequentially provided to the conjugate product norm calculation unit until i starts from k and becomes 1; The conjugate element product A [i] returned from the conjugate element product norm calculation unit as^*Remember
The conjugate element product norm calculation unit uses divisors n [i], n [i + 1] and A [i],
The product A [i] of all conjugate elements of A [i] except for A [i] with respect to N [i-1]^*To
A [i]^*= A [i] ＾｛p^{n [i-1]}+ P^{2n [i-1]}+ ... + p^{n [i] -n [i-1]}｝ = (... ((A [i] ＾ (p^{n [i-1]}) A [i]) ＾ (p^{n [i-1]}) A [i]) ...) ＾ (p^{n [i-1]}), And calculate,
Norm N_{N [i] / N [i-1]}(A [i])
N_{N [i] / N [i-1]}(A [i]) = A [i] A [i]^*, And calculate this norm
A [i-1] is newly set and the conjugate product A [i]^*And returned to the divisor sequence calculator,
The inverse element calculation unit, all the conjugate element products stored in the divisor sequence calculation unit,
The inverse element A [0] of the norm output by the conjugate element product norm calculation section when the divisor series calculation section last called^-1With the product
A^-1= A [k + 1]^*A [k]^*... A [1]^*A [0]^-1Calculated as
The output unit outputs a calculation result of the inverse calculation unit,
It is prepared.
[0029]
A first inverse operation method of the present invention is an inverse operation method for finding an inverse element of an element of an extended field M obtained by enlarging a base field K of a finite field,
A first step of obtaining an extended field L obtained by enlarging the basic field K by using an irreducible polynomial as a defining polynomial for the basic field K having only a primitive q-th root having a certain prime q,
A second step of determining an extension M that is an extension of the foundation K with a given extension order n between the foundation K and the extension L;
A third step of determining the original inverse of the extension field M using the Frobenius mapping in the extension field L;
With
The q is a prime number obtained by adding 1 to an integral multiple of the extension degree n of the intermediate.
[0030]
The second inverse element calculation method of the present invention is an inverse element calculation method for calculating an inverse element to an element of an enlarged field M obtained by expanding a basic field K of a finite field. When there is an extension field M, an extension field L obtained by enlarging the base field is obtained by a qth-order circular polynomial obtained by a prime number q obtained by adding 1 to an integer multiple of the extension degree n, and Frobenius mapping in the extension field M is performed. Is obtained from the Frobenius mapping in the extended field L by using the fact that the inverse is obtained.
[0031]
The third inverse operation method according to the second aspect of the present invention is the method according to the second aspect, wherein, when obtaining the inverse of the element A of the extension field M, the extension degree n between the extension field M and the base field K is determined. An arbitrary divisor n [1],... N [k] is selected such that n [i] divides n [i + 1],
The order is (#K)^{n [i]}Is the subfield N [i],
K = N [0] ⊂N [1] ⊂... N [k] ⊂N [k + 1] = M,
The method comprises first finding the product and norm of all the conjugate elements of A with respect to the subfield N [k] immediately below M, and repeatedly calculating this until it reaches the base field K to find the inverse element.
[0032]
A fourth inverse operation method according to the present invention is an inverse operation method for calculating an inverse element of an element of an extended field M obtained by enlarging a base field K of a finite field,
An expansion degree n of the expansion body M;
a prime number q obtained by q = n · j + 1 (j is a small natural number);
q-th circle polynomial (x^q-1+ X^q-2+ ... + x + 1) is a prime p that is irreducible in the prime field Z / pZ, and the number of effective bits when the prime p is expressed as a numerical value on the information processing device is equal to the processing of the information processing device. A prime number p having one of the following conditions: the number of bits less than or equal to the word length, the number of bits less than or equal to half the word length, and the number of bits less than or equal to twice the word length and
An irreducible polynomial for expanding the prime field Z / pZ to obtain the basic field K;
A first step of inputting an element A for obtaining an inverse element in the expanded field;
A second step of selecting, for any divisor n [1],... N [k] of the extension degree n, a divisor sequence such that n [i] divides n [i + 1];
The order is (#K) between the extension body M and the base body K.^{n [i]}A third step for determining an intermediate sequence that is
A fourth step of obtaining a conjugate element product obtained by multiplying all of the conjugate elements of the element A with respect to the intermediate immediately below the extension field M of the intermediate string by anything other than itself, and storing the result;
A fifth step of calculating the norm of A by multiplying the conjugate element product and the element A and setting this as A ';
The fourth step and the fifth step are executed for the intermediate that is shifted down by one stage from M in the intermediate row for A ′ of the fifth step, and the norm is similarly set to the value of the basic body K. A sixth step that repeats this finite times until it comes back,
A seventh step of finding the inverse of the norm for the basic field, calculating the product of the intermediate products stored in the fourth step with the conjugate element products for all the intermediate sequences, and using this as the inverse of A;
Is provided.
[0033]
The fifth inverse element calculation method according to the present invention is directed to a sixth order element obtained by adding a primitive 7th root of 1 to a prime field having a prime number of 27 bits or more and 32 bits or less and excluding a primitive 7th root of 1 An inverse operation method for calculating an original inverse of an extension field,
A first step of inputting an element for obtaining an inverse element in the element of the sixth degree extension field;
A second step of obtaining a tertiary extension field N [1] of the prime field;
A third step of calculating the product of all the conjugate elements of the element A for the tertiary extension field N [1] as a first conjugate element product;
A fourth step of calculating a first norm obtained by multiplying the first conjugate element product by the element A;
A fifth step of calculating the product of all conjugate elements of the first norm for the prime field as a second conjugate element product;
A sixth step of calculating a second norm obtained by multiplying the second conjugate product by the first norm;
A seventh step of calculating the inverse of the second norm;
An eighth step of calculating the inverse of A by multiplying the inverse of the second norm by the second conjugate element and the first conjugate element;
A ninth step of outputting the inverse of A;
Is provided.
[0034]
According to a sixth aspect of the present invention, in the fifth aspect, in the fifth aspect, the element of the prime field is processed as one word in the information processing device, and the element of the sixth extension field is processed as six words. Prepare.
[0035]
A seventh inverse operation method of the present invention is an inverse operation method for calculating an inverse element of an element of an enlarged field M obtained by enlarging a basic field K of a finite field,
An arbitrary expansion order n (n is a natural number) for obtaining the expansion field M by expanding the base field K;
q (j is a small natural number) such that q = n · j + 1 is a prime number;
q-th order circle polynomial (x^q-1+ X^q-2+ ... + x + 1) is a prime p that is irreducible in the prime field Z / pZ, and the number of effective bits when the prime p is expressed as a numerical value on the information processing device is equal to the processing of the information processing device. A prime number p having any of the following conditions: the number of bits that is less than or equal to the word length, the number of bits that is less than or equal to half the word length, and the number of bits that is less than or equal to twice the word length and closer thereto.
An irreducible polynomial for expanding the prime field Z / pZ to obtain a basic field K;
A first step of inputting
If one irreducible polynomial on the prime field Z / pZ is selected, and a field obtained by expanding Z / pZ with this irreducible polynomial is the base field K, and a linear expression is selected as the irreducible polynomial, K = Z / pZ, and the base field K is defined as a q-th circular polynomial (x^q-1+ X^q-2+ ... + x + 1), when the expanded body is defined as an expanded body L, as an intermediate M of the expanded body L
When j = 1, L is taken as M, and when j> 1, the order is pⁿA second step of inputting an element A of M for which the inverse is to be calculated,
For any arbitrary divisor n [1],... n [k] of n, select a divisor sequence such that n [i] divides n [i + 1], and the order is (#K).^{n [i]}A third subfield of N [i], n [0] = 1, N [0] = K, N [k + 1] = M, A [k + 1] = A,
For an element A [i] of N [i], the product A [i] of all conjugate elements for N [i−1]^*To
A [i]^*= A [i] ＾｛p^{n [i-1]}+ P^{2n [i-1]}+ ... + p^{n [i] -n [i-1]}｝ = (... ((A [i] ＾ (p^{n [i-1]}) A [i]) ＾ (p^{n [i-1]}) A [i]) ...) ＾ (p^{n [i-1]}A) calculating and storing;
Norm N_{N [i] / N [i-1]}(A [i])
N_{N [i] / N [i-1]}(A [i]) = A [i] A [i]^*A fifth step in which the norm is newly set to A [i-1];
Input A [i] in order from the element A of the extended field M of i = k + 1 to the basic field K of 1;
A [i]^*And norm N_{N [i] / N [i-1]}A sixth step of obtaining (A [i]);
N_{N [1] / N [0]}The inverse of (A [1]) is obtained, and this is expressed as A [0]^-1A seventh step,
A [i] stored in the fourth step^*And A [0] of the seventh step^-1From
A^-1= A [k + 1]^*A [k]^*... A [1]^*A [0]^-1An eighth step of obtaining the inverse of A as
Is provided.
[0036]
A first inverse operation program according to the present invention is an inverse operation program for causing a computer to execute an inverse operation process for calculating an inverse element of an element of an enlarged field M obtained by enlarging a base field K of a finite field,
A function of obtaining an extended field L obtained by enlarging the basic field K by using a primitive polynomial as a defining polynomial with only a primitive q-th root having a certain prime number q as a root and the basic field K; A function for obtaining an extension field M obtained by enlarging the base field K by a given numerical value n between the extension field L and
A function of calculating the original inverse of the expansion field M using the Frobenius mapping in the expansion field L;
With
The q is a prime number obtained by adding 1 to an integral multiple of the extension degree n of the intermediate.
[0037]
The second inverse operation program according to the present invention is an inverse operation program for causing a computer to execute an inverse operation process for finding an inverse element of an element of an enlarged field M obtained by enlarging a base field K of a finite field,
An arbitrary expansion order n (n is a natural number) for obtaining the expansion field M by expanding the base field K;
q (j is a small natural number) such that q = n · j + 1 is a prime number;
q-th order circle polynomial (x^q-1+ X^q-2+ ... + x + 1) is a prime p that is irreducible in the prime field Z / pZ, and the number of effective bits when the prime p is expressed as a numerical value on the information processing device is equal to the processing of the information processing device. A prime number p having any of the following conditions: the number of bits that is less than or equal to the word length, the number of bits that is less than or equal to half the word length, and the number of bits that is less than or equal to twice the word length and closer thereto.
An irreducible polynomial for expanding the prime field Z / pZ to obtain a basic field K;
Function to input
If one irreducible polynomial on the prime field Z / pZ is selected, and a field obtained by expanding Z / pZ with this irreducible polynomial is the base field K, and a linear expression is selected as the irreducible polynomial, K = Z / pZ, and the base field K is defined as a q-th circular polynomial (x^q-1+ X^q-2+ ... + x + 1), when the expanded body is defined as an expanded body L, as an intermediate M of the expanded body L
When j = 1, L is taken as M, and when j> 1, the order is pⁿA function of inputting an element A of M for which an inverse element is to be calculated,
For any arbitrary divisor n [1],... n [k] of n, select a divisor sequence such that n [i] divides n [i + 1], and the order is (#K).^{n [i]}A function of n [0] = 1, N [0] = K, N [k + 1] = M, and A [k + 1] = A;
For an element A [i] of N [i], the product A [i] of all conjugate elements for N [i−1]^*To
A [i]^*= A [i] ＾｛p^{n [i-1]}+ P^{2n [i-1]}+ ... + p^{n [i] -n [i-1]}｝ = (... ((A [i] ＾ (p^{n [i-1]}) A [i]) ＾ (p^{n [i-1]}) A [i]) ...) ＾ (p^{n [i-1]}) And the function of calculating and storing
Norm N_{N [i] / N [i-1]}(A [i])
N_{N [i] / N [i-1]}(A [i]) = A [i] A [i]^*And a function that newly sets this norm to A [i-1];
Input A [i] in order from the element A of the extended field M of i = k + 1 to the basic field K of 1;
A [i]^*And norm N_{N [i] / N [i-1]}(A [i]);
N_{N [1] / N [0]}The inverse of (A [1]) is obtained, and this is expressed as A [0]^-1Function and
A [i] stored in the fourth step^*And A [0] of the seventh step^-1From
A^-1= A [k + 1]^*A [k]^*... A [1]^*A [0]^-1Function to obtain the inverse of A as
Is provided.
[0038]
BEST MODE FOR CARRYING OUT THE INVENTION
The configuration of the embodiment of the present invention will be described with reference to FIG.
[0039]
The configuration of the embodiment of the present invention includes an encryption key generation device 1 that is an information processing device that generates an encryption key used in common key encryption or the like, and an encryption key generation device 2 that has the same configuration as the encryption key generation device 1. And a network 3 including the Internet for connecting the encryption key generation device 1 and the encryption key generation device 2 to each other.
[0040]
Further, the encryption key generation device 1 and the encryption key generation device 2 include an input unit 10 such as a keyboard, an encryption key operation device 11 that performs an elliptic curve operation for generating an encryption key, and an output unit 12 including a display and a printer. And a secondary storage device 13 such as a magnetic disk device for storing a software program for generating an encryption key.
[0041]
Further, the encryption key operation device 11 includes a CPU 110 designed with a 64-bit architecture, a 32-bit architecture, a ROM 111 storing nonvolatile data such as numerical data fixed in advance, and an operation loaded from the secondary storage device 13. The RAM 112 includes a RAM 112 that stores a processing program, and an IO port 113 that controls input and output to and from the secondary storage device 13.
[0042]
Next, the configuration of software at the time of operation of the embodiment of the present invention will be described with reference to FIG. 2. An input unit 41 for receiving input data from the outside by the input unit 11, a divisor sequence from the numerical value of the input data And a conjugate element product norm calculation section 43 that sequentially inputs the divisors from the divisor sequence calculation section, calculates a conjugate element product and a norm, and returns the norm to the divisor calculation section 42. An inverse calculator 44 for calculating an inverse from the conjugate element product and the norm input from the divisor sequence calculator 42, and an output unit for outputting the inverse calculated by the inverse calculator 44 to the output unit 12 or the like. 45.
[0043]
In the present embodiment, an inverse operation in symmetric key cryptography will be described as an example, but it is clear that the present invention is not limited to this.
[0044]
Next, the operation of the embodiment of the present invention will be described based on the flowcharts of FIGS.
[0045]
The encryption key generation devices 1 and 2 exchange information via the network 3 and generate a common encryption key shared between the encryption key generation devices 1 and 2. The manager of the cryptographic key generation devices 1 and 2 prepares a basis based on the prime field Z / pZ by the number of bits | p | An arbitrary expansion order n or the like for the field K is input from the input means 10. From these inputs, the field that defines the elliptic curve is determined.
[How to choose a body]
First, the word length multiple ζ is set to 1, 1/2, or 2, and ζ is selected therefrom. The number of bits of the prime number p which is equal to or less than the word length to be processed by the information processing apparatus and the number of bits of the prime number p which is equal to or less than half the word length and which are close to the word length to be processed by the information processing apparatus depending on whether the word length multiple ζ is 1 or 1/2 or , And a bit number | p | of a prime number p that is less than or equal to twice the word length and that is close to the word length, is given from the input means 10.
[0046]
Further, it is assumed that an arbitrary expansion order n is given (step 101). The numerical value once input may be stored in the ROM 111, and thereafter, the numerical value stored in the ROM 111 may be fetched.
[0047]
Let j be an integer such that q = n · j + 1 is a prime number (step 102).
(Note that j is preferably smaller.)
q-minute polynomial (x^q-1+ X^q-2+ ... + x + 1) is selected such that the prime number p is irreducible on the prime field Z / pZ, and p is such that the number of bits of p matches the given number of bits. Further, one irreducible polynomial on the prime field Z / pZ is selected, and a field obtained by expanding Z / pZ with this irreducible polynomial is fixed as a base field (step 103). Hereinafter, this basic body will be referred to as K. When a linear expression is selected as the irreducible polynomial, K = Z / pZ. Let L be a field obtained by expanding the base field K by a q-minute polynomial.
[0048]
Here, the q-minute polynomial is x^q-1+ X^q-2+ ... + x + 1. When j = 1, L is taken as M. If j> 1, the intermediate of L is of order pⁿIs set to M (step 104). It is assumed that the numerical value q of the q-th polynomial and the irreducible polynomial are also input from the input means 10.
[0049]
When the given conditions regarding the inverse element operation of the present invention described above are arranged,
(1) Arbitrary expansion degree n (n is a natural number)
(2) q such that q = n · j + 1 is a prime number
(3) q-minute polynomial (x^q-1+ X^q-2+ ... + x + 1) is a prime p that is irreducible in the prime field Z / pZ, and the number of effective bits when the prime p is expressed as a numerical value on the information processing device is equal to the processing of the information processing device. A prime number p that has one of the following conditions: the number of bits less than or equal to the word length, the number of bits less than or equal to half the word length, and the number of bits less than or equal to twice the word length
(4) An irreducible polynomial for expanding the prime field Z / pZ to obtain the basic field K
Becomes
[0050]
Based on the above assumptions, a processing program required for the encryption key generation processing is read from the secondary storage device 13 by an operating system (not shown) of the encryption key operation device 11, placed in the RAM 112, and executed. . In the calculation of the elliptic curve in the generation of the encryption key, if it is necessary to calculate the inverse of the above field for a certain numerical value, the present invention uses the numerical value for which the inverse is to be obtained from the main unit that generates the encryption key as an argument. When an inverse operation process is called and the inverse is generated as a result of the operation, the inverse is returned to the caller.
[Inverse operation method]
[Preparation (1) (Calculation of product of two elements of field K)]
The element of K (a₁, A₂,,,, a_q-1) And (b)₁, B₂,,, b_q-1), The element A = a of the field L₁x + a₂x²+ ... + a_q-1x^q-1, And B = b₁x + b₂x²+ ... b_q-1x^q-1Is obtained by calculating the product of the polynomials AB and then using the equivalence relation by the q-minute polynomial to uniquely obtain c.₁x + c₂x²+ ... c_q-1x^q-1Can be represented. However, (c₁, C₂,,,, c_q-1) Is the element of Z / pZ.
[Preparation (2) (operation on body L)]
An arbitrary element w of the field L is q-1 elements a of K₁, A₂,,,, a_q-1Using,
w = a₁x + a₂x²+ ... + a_q-1x^q-1Can be represented.
[0051]
Hereinafter, a₁x + a₂x²+ ... + a_q-1x^q-1Abbreviation (a₁, A₂,,,, a_q-1).
[0052]
Φ (w) by Frobenius mapping φ of this element is
φ (w) = (a ′₁, A '₂,,, a '_q-1)It can be expressed as.
Where a '_ip  _mod  _q= A_i
[Preparation (3) (operation on body M)]
Since the field M is embedded in the field L, the Frobenius mapping for the elements of the field M can be calculated in the same manner as the Frobenius mapping for the elements of the field L.
[0053]
Similarly, the product of the elements of the field M can be calculated.
[0054]
At this time, since the order of the field M is smaller than that of the field L, q-1 elements of the Z / pZ (a₁, A₂,,,, a_q-1) Contains at most n different values. Using this, the product between elements of the field M can be calculated more easily than that of the field L.
[Inverse operation]
It is assumed that there are fields L, M, K, Z / pZ, and n and q selected as described in [How to select fields]. Then, it is assumed that the element A of the field M is input as an inverse element operation target (step 201).
[0055]
A plurality of arbitrary divisors n [1],... n [k] of n are selected such that n [i] divides n [i + 1] (step 202).
[0056]
The order is (#K)^{n [i]}The subfield of the extended field L is called N [i] by (the order of K raised to the power n [i]) (step 203).
[0057]
Also, n [0] = 1, N [0] = K, N [k + 1] = M, and A [k + 1] = A.
[0058]
When elements A [i] of N [i] are sequentially input,
The product A [i] of all conjugate elements of A [i] except for A [i] with respect to N [i-1]^*  And norm N_{N [i] / N [i-1]}(A [i])
A [i]^*= A [i] ＾｛p^{n [i-1]}+ P^{2n [i-1]}+ ... + p^{n [i] -n [i-1]}｝ = (... ((A [i] ＾ (p^{n [i-1]}) A [i]) ＾ (p^{n [i-1]}) A [i]) ...) ＾ (p^{n [i-1]}),
N_{N [i] / N [i-1]}(A [i]) = A [i] A [i]^*, And calculate.
[0059]
The following processing is performed using the conjugate element product generation method.
[0060]
Here, K = N [0] {N [1]}... {N [k + 1] = M.
In order from i = k + 1 to 1 (step 206), A [i] is input to the conjugate element product generation method, and A [i]^*(Step 204) and norm N_{N [i] / N [i-1]}(A [i]) (step 205) is obtained,_{N [i] / N [i-1]}(A [i]) is defined as A [i-1].
N_{N [1] / N [0]}The inverse of (A [1]) is obtained (step 207), and this is converted to A [0]^-1And A^-1= A [k + 1]^*A [k]^*... A [1]^*A [0]^-1(Step 208). This is the inverse of A (step 209).
[0061]
[Example (1)]
Assuming that the processing word length of the information processing apparatus is 32 bits, an extension field M having a word length multiple ワード 1 and an extension degree n of 8 is selected, and a method of performing an inverse element operation on this field is shown in FIGS. This will be described with reference to the flowchart of FIG.
[0062]
The numerical value 32 of the word length and the numerical value 8 of the expansion degree are input (step 101).
Since 8 * 2 + 1 = 17 is a prime number, q = 17 (step 102).
[0063]
17th circle polynomial Φ₁₇= 1 + x + x²+ ... + x¹⁶Is a prime number p that is irreducible on Z / pZ, and a bit length of p is 32 or less and close to 32 (step 103). Here, for example, p = 2²⁷-39.
[0064]
Next, one irreducible polynomial on Z / pZ is selected. Here, it is assumed that a linear expression is selected. Therefore, the base body K is Z / pZ itself. Let L be the field obtained by expanding K by a 17-minute polynomial.
Is an intermediate of L and its order is p⁸Is M (step 104).
[0065]
The element A of M is composed of eight K elements (a₁, A₂, ..., a₈)Using,
A = a₁x + a₂x²+ ... + a₇x⁷+ A₈x⁸+ A₈x⁹+ A₇x¹⁰+ ... + a₂x^Fifteen+ A₁x¹⁶Can be represented.
The element A of M is input (step 201).
(1) The expansion degree of M with respect to K is 8. 2, 4 is selected as a divisor of 8 (2 is divided by 4) (step 202). Hereinafter, the order of the intermediate of L is p²Is N [1] and the order is p⁴Is defined as N [2] (step 203).
(2) The product A of all conjugate elements of A with respect to N [2]^*To
A^*= A ＾｛p⁴計算 is calculated (step 204).
[0066]
This is the Frobenius mapping applied four times.
φ⁴： A → A ＾｛p⁴｝ Is an ingredient,
φ⁴: A₁x + a₂x²+ A₃x³+ A₄x⁴+ A₅x⁵+ A₆x⁶+ A₇x⁷+ A₈x⁸+ A₈x⁹+ A₇x¹⁰+ A₆x¹¹+ A₅x¹²+ A₄x^Thirteen+ A₃x¹⁴+ A₂x^Fifteen+ A₁x¹⁶
→ a₄x + a₈x²+ A₅x³+ A₁x⁴+ A₃x⁵+ A₇x⁶+ A₆x⁷+ A₂x⁸+ A₂x⁹+ A₆x¹⁰+ A₇x¹¹+ A₃x¹²+ A₁x^Thirteen+ A₅x¹⁴+ A₈x^Fifteen+ A₄x¹⁶
It is.
(By seeing A as an element of the enlarged field L, the Frobenius mapping is simply a replacement of the element of K.)
(3) The norm A [2] for N [2] of A is
A [2] = A · A^*  mod Φ₁₇(Step 205).
[0067]
The element of A [2] is composed of four K elements (c₁, C₂, C₃, C₄)Using,
A [2] = c₁x + c₂x²+ C₃x³+ C₁x⁴+ C₃x⁵+ C₄x⁶+ C₄x⁷+ C₂x⁸+ C₂x⁹+ C₄x¹⁰+ C₄x¹¹+ C₃x¹²+ C₁x^Thirteen+ C₃x¹⁴+ C₂x^Fifteen+ C₁x¹⁶
Can be represented.
(4) The conjugate element and norm relating to N [2] are calculated. However, since N [2] is not an element of the base field K, the process goes to the step of calculating the product of the conjugate elements again (step 206).
(5) Product A [2] of all conjugate elements of N [1] of A [2]^*To
A [2]^*= A [2] ＾｛p²計算 is calculated (step 204).
[0068]
This is the Frobenius mapping applied twice.
A [2] ＾｛p²｝ = Φ²(A [2]) is replaced with a component,
φ²(C₁x + c₂x²+ C₃x³+ C₁x⁴+ C₃x⁵+ C₄x⁶+ C₄x⁷+ C₂x⁸+ C₂x⁹+ C₄x¹⁰+ C₄x¹¹+ C₃x¹²+ C₁x^Thirteen+ C₃x¹⁴+ C₂x^Fifteen+ C₁x¹⁶)
= C₂x + c₁x²+ C₄x³+ C₂x⁴+ C₄x⁵+ C₃x⁶+ C₃x⁷+ C₁x⁸+ C₁x⁹+ C₃x¹⁰+ C₃x¹¹+ C₄x¹²+ C₂x^Thirteen+ C₄x¹⁴+ C₁x^Fifteen+ C₂x¹⁶
It is.
(6) The norm A [1] of N [1] of A [2] is given by
A [1] = A [2] · A [2]^*  mod Φ₁₇(Step 205).
The element of A [1] is composed of two K elements (d₁, D₂)Using,
A [1] = d₁x + d₁x²+ D₂x³+ D₁x⁴+ D₂x⁵+ D₂x⁶+ D₂x⁷+ D₁x⁸+ D₁x⁹+ D₂x¹⁰+ D₂x¹¹+ D₂x¹²+ D₁x^Thirteen+ D₂x¹⁴+ D₁x^Fifteen+ D₁x¹⁶
Can be represented.
(7) The conjugate element and norm for N [1] are calculated. However, since this N [1] is not the element of the base field K, the procedure goes to the step of calculating the product of the conjugate elements again (step 206).
(8) A [1] of all conjugate elements of A [1] with respect to K^*To
A [1]^*= A [1] {p} (step 204).
This is a Frobenius mapping that is applied once,
φ (A [1]) = A [1] {p} is a component,
φ (d₁x + d₁x²+ D₂x³+ D₁x⁴+ D₂x⁵+ D₂x⁶+ D₂x⁷+ D₁x⁸+ D₁x⁹+ D₂x¹⁰+ D₂x¹¹+ D₂x¹²+ D₁x^Thirteen+ D₂x¹⁴+ D₁x^Fifteen+ D₁x¹⁶)
= D₂x + d₂x²+ D₁x³+ D₂x⁴+ D₁x⁵+ D₁x⁶+ D₁x⁷+ D₂x⁸+ D₂x⁹+ D₁x¹⁰+ D₁x¹¹+ D₁x¹²+ D₂x^Thirteen+ D₁x¹⁴+ D₂x^Fifteen+ D₂x¹⁶
It is.
(9) The norm A [0] of A [1] with respect to K is
A [0] = A [1] · A [1]^*  mod Φ₁₇Is calculated (step 205).
[0069]
The element of A [0] is one K element (e₁)Using,
A [0] = e₁x + e₁x²+ E₁x³+ E₁x⁴+ E₁x⁵+ E₁x⁶+ E₁x⁷+ E₁x⁸+ E₁x⁹+ E₁x¹⁰+ E₁x¹¹+ E₁x¹²+ E₁x^Thirteen+ E₁x¹⁴+ E₁x^Fifteen+ E₁x¹⁶
Can be represented.
(10) The conjugate element and norm for K have been calculated, but since this K is a basic field, go to the next (Step 207).
(11) e₁The inverse of e₁ ^-1Is obtained (step 207).
(12) Inverse A of A^-1To
A^-1= E₁ ^-1A [1]^*A [2]^*A^*Is calculated (step 208).
Finally A^-1Is output by the output means 12 and the process is terminated (step 209).
[0070]
[Example (2)]
Assuming that the processing word length of the information processing apparatus is 32 bits, a method of selecting an extension field M whose word length multiple １ is 1 and the extension degree is 6 and performs an inverse operation on this field is shown in FIGS. This will be described with reference to the flowchart of FIG.
The word length (32) and the expansion degree (6) are input (step 101).
Since 6x1 + 1 = 7 is a prime number, q is set to 7 (step 102).
[0071]
7-minute polynomial Φ₇= 1 + x + x²+ X³+ X⁴+ X⁵+ X⁶Is a prime number p that is irreducible on Z / pZ, and a bit length of p is 32 or less and close to 32 (step 103).
[0072]
Here, for example, p = 2²⁷-115. Choose one irreducible polynomial on Z / pZ. Here, it is assumed that a linear expression is selected as an irreducible polynomial. Therefore, the base body K is Z / pZ itself.
[0073]
Let L be a field obtained by expanding K by a 7-minute polynomial. Let L be M (step 104). If an element A of M is selected, A becomes 6 elements of K (a_1,a_2,a_3,a_4,a_5,a₆)Using,
A = a₁x + a₂x²+ A₃x³+ A₄x⁴+ A₅x⁵+ A₆x⁶Can be represented.
The element A of M is input (step 201).
(1) The extension degree of M with respect to K is 6. Choose 3 as a divisor of 6. Hereinafter, the order of the intermediate of L is p³Is set to N [1] (step 203).
(2) The product A of all conjugate elements of A with respect to N [1]^*To
A^*= A ＾｛p³計算 is calculated (step 204).
This is the Frobenius map applied three times.
φ³(A) = A ＾｛p³｝ With the ingredients,
φ³(A₁x + a₂x²+ A₃x³+ A₄x⁴+ A₅x⁵+ A₆x⁶) = A₆x + a₅x²+ A₄x³+ A₃x⁴+ A₂x⁵+ A₁x⁶It is.
(3) The norm A [1] for N [1] of A is
A [1] = A · A^*  mod Φ₇Is calculated (step 205).
The element of A [1] is composed of three K elements (c₁, C₂, C₃)Using,
A [1] = c₁x + c₂x²+ C₃x³+ C₃x⁴+ C₂x⁵+ C₁x⁶
Can be represented.
(4) The conjugate element and norm for N [1] are calculated. However, since N [1] is not the base field K, the process goes to the step of obtaining the product of the conjugate elements again (step 206).
(5) The product A [1] of all conjugate elements of A [1] with respect to K^*To
A [1]^*= A [1] ＾｛p + p²｝ = (A [1] ＾ pA) ＾ p is calculated (step 204).
This is possible by calculating the Frobenius map and the product.
Here, φ (A [1]) = A [1] {p} is a component,
φ (c₁x + c₂x²+ C₃x³+ C₃x⁴+ C₂x⁵+ C₁x⁶) = C₃x + c₁x²+ C₂x³+ C₂x⁴+ C₁x⁵+ C₃x⁶It is.
(6) The norm A [0] of A [1] with respect to K is
A [0] = A [1] · A [1]^*  mod Φ₇(Step 205).
[0074]
The element of A [0] is one K element (e₁)Using,
A [0] = e₁x + e₁x²+ E₁x³+ E₁x⁴+ E₁x⁵+ E₁x⁶
Can be represented.
(7) The conjugate element and norm for K are calculated. Since this K is a basic field, go to the next (step 207).
(8) e₁The inverse of e₁ ^-1Is obtained (step 207).
(9) Inverse A of A^-1To
A^-1= E₁ ^-1A [1]^*A^*(Step 208).
Finally A^-1Is output by the output means 12 and the process is terminated (step 209).
[0075]
【The invention's effect】
Inverse operations can be performed on an arbitrary basic field and an arbitrary-order extension field at a speed equal to or higher than that of the conventional technique.
[0076]
First, the computational cost is significantly lower because the Frobenius mapping in the present invention is merely an exchange of elements on the foundation. In order to have such a feature, it is necessary to generate an expansion field by expansion by a q-minute polynomial with a prime number q or to sequentially expand by a q-circle polynomial.
[0077]
For this reason, the available expansion degree of the expansion body is limited, but the present invention is not limited to this. Also, the computational cost of the Frobenius mapping in the present invention is lower than that of the OEF method.
[0078]
Second, the calculation cost of the product in the present invention is lower than that of the OEF. This means that if we look at the elements of M embedded in L, the terms higher in order than q are Φ_qThis is because it can be identified with a lower term. In the case of OEF, this higher-order term can be identified with a lower-order term obtained by multiplying its coefficient by a small coefficient, so that the calculation cost of multiplication occurs.
[0079]
Third, the present invention sequentially reduces to the inverse operation of the conjugate element for smaller intermediates. This allows the product calculation to be performed in a smaller field. For example, in the embodiment (1), the product of all conjugate elements of A with respect to K is obtained by using the Frobenius mapping on M and multiplication.^*A [1]^*A [2]^*It is more efficient to ask for Because A [1]^*Etc. can be obtained by using the product of smaller intermediates. This is the same as the advantage of the successive enlargement.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a software configuration according to an embodiment of the present invention.
FIG. 3 is a flow chart of a method for determining an enlarged object according to the first and second embodiments of the present invention.
FIG. 4 is a flow chart of a method for obtaining an inverse of Embodiments 1 and 2 of the present invention.
[Explanation of symbols]
1 Encryption key generation device
10 Input means
11 Cryptographic key operation device
110 CPU
111 ROM
112 RAM
113 IO port
12 Output means
13 Secondary storage device
2 Encryption key generation device
3 network
41 Input unit
42 Divisor sequence calculation unit
43 Conjugate product norm calculator
44 Inverse calculation unit
45 Output unit

Claims

An inverse operation device for calculating an inverse element of an element of an extension field M obtained by enlarging a base field K of a finite field,
An input unit that receives input data from the outside, a divisor sequence calculator that determines a divisor sequence from the numerical values of the input data, and calculates the conjugate product and norm by sequentially inputting the divisor from the divisor sequence calculator A conjugate element product norm calculation section returned to the divisor sequence calculation section; an inverse element calculation section that calculates an inverse element from the conjugate element product and the norm input from the divisor sequence calculation section; And an output unit for outputting the inverted element,
The input unit includes an arbitrary expansion degree n (n is a natural number) for obtaining an expansion field M by expanding the basic field K, q (j is a small natural number) such that q = n · j + 1 is a prime number, and q The following circle-dividing polynomial (x ^q−1 + x ^q−2 +... + X + 1) is a prime number p that is irreducible on the prime field Z / pZ, and the prime number p is stored in the information processing device. The number of effective bits when expressed as a numerical value is equal to or less than the word length processed by the information processing device, the number of bits equal to or less than half the word length and equal to or less than twice the word length, and the number of bits equal to or less than twice the word length A prime number p having any condition of numbers,
And an irreducible polynomial for expanding the prime field Z / pZ to obtain the basic field K,
A base field K is generated based on the prime number p and the irreducible polynomial, and the base field K is expanded by n to expand the field M, and the base field K is expanded by the q-th circular polynomial to determine an expanded field L. , An element A for performing an inverse operation on the element of the extension field M is input,
The divisor sequence calculator selects a divisor sequence such that n [i] divides n [i + 1] for divisors n [1],..., N [k] of n. Let n [i] be the subfield of L that is the power of n [i], n [0] = 1, n [k + 1] = n, N [0] = K, N [k + 1] = M, A [k + 1] ] = A, the divisors n [i] and n [i + 1] of n and A [i] are sequentially provided to the conjugate product norm calculation unit until i starts from k and becomes 1; And stores the conjugate element product A [i] ^* returned from the conjugate element product norm calculation unit as
The conjugate element product norm calculation unit uses divisors n [i], n [i + 1] and A [i],
The product A [i] ^* of all conjugate elements of A [i] excluding A [i] with respect to N [i-1] is
A [i] ^* = A [i] @pn ^[i-1] + ^{p2n [i-1]} + ... + ^{pn [i] -n [i-1]} } = (... (( A [i] ＾ ( ^{pn [i-1]} ) A [i]) ＾ ( ^{pn [i-1]} ) A [i]) ...) ＾ ( ^{pn [i-1]} ) Calculate,
The norm NN _{[i] / N [i-1]} (A [i]) is expressed as
NN _{[i] / N [i-1]} (A [i]) = A [i] A [i] ^* , and this norm is newly set as A [i-1], and the conjugate product A [ i] and ^*
The inverse element calculation unit,
All the conjugate element products stored by the divisor sequence calculation unit,
The product of the inverse element A [0] ^{−1 of} the norm output by the conjugate element product norm calculation unit when the divisor sequence calculation unit last called is
A- ¹ = A [k + 1] ^* A [k] ^* ... A [1] ^* A [0] ^-1
The output unit outputs a calculation result of the inverse calculation unit,
An inverse operation device characterized by the above-mentioned.

An inverse element calculation method for finding an inverse element to an element of an extended field M obtained by expanding a basic field K of a finite field,
A first step of using an irreducible polynomial as a definition polynomial for a base field K having only a primitive q-th root having a certain prime number q as a definition polynomial to obtain an expanded field L obtained by expanding the base field K;
A second step of finding an extension M between the base K and the extension L, which is an extension of the base K by a given extension n;
A third step of finding the original inverse of the extension field M using the Frobenius mapping in the extension field L;
With
The method according to claim 1, wherein q is a prime number obtained by adding 1 to an integral multiple of the extension degree n.

An inverse element calculation method for finding an inverse element to an element of an extended field M obtained by expanding a basic field K of a finite field,
When there is an arbitrary base field K and an expansion field M with an arbitrary expansion degree n, an expansion obtained by expanding the base field K by a q-th circle polynomial obtained by a prime number q obtained by adding 1 to an integer multiple of the expansion degree n. An inverse element calculation method, wherein a field L is obtained, and an inverse element is obtained by utilizing the fact that the Frobenius map in the enlarged field M is naturally obtained from the Frobenius map in the enlarged field L.

In claim 3, in obtaining the inverse of the element A of the extension field M, an arbitrary divisor sequence n [1],... N [k] of the extension degree n, and n [i] is n [i + 1] Choose to divide,
When a partial field whose order between the extension field M and the base field K is (#K) ^{n [i]} (the order of the finite field K raised to the power n [i]) is N [i],
K⊂N [1] ⊂... ⊂N [k] ⊂M,
First, the product and norm of all the conjugate elements of A with respect to the subfield N [k] immediately below the extension field M are obtained, and this is repeatedly calculated until the base field K is reached to obtain the inverse element. Inverse element calculation method.

An inverse element calculation method for finding an inverse element to an element of an extended field M obtained by expanding a basic field K of a finite field,
An extension degree n of the extension field M;
a prime number q obtained by q = n · j + 1 (j is a small natural number);
The q-th circle polynomial (x ^q−1 + x ^q−2 +... + x + 1) is a prime p that is irreducible on the prime field Z / pZ, and the prime p is a numerical value on the information processing device. The number of effective bits when expressed as is less than or equal to the word length processed by the information processing device, less than or equal to half the word length and equal to or less than twice the word length and equal to or less than twice the word length A prime p with any of the conditions
An irreducible polynomial for expanding the prime field Z / pZ to obtain a basic field K;
A first step of inputting an element A for obtaining an inverse element in the extension field;
A second step of selecting, for any divisor n [1],... N [k] of the extension degree n, a divisor sequence such that n [i] divides n [i + 1];
A third step of finding an intermediate sequence having an ^{order of} (#K) ^{n [i]} between the extension field M and the base field K;
A fourth step of obtaining a conjugate element product obtained by multiplying all of the conjugate elements of the element A with respect to the intermediate immediately below the extended field M of the intermediate sequence by anything other than itself, and storing the result;
A fifth step of calculating the norm of A by multiplying the conjugate product and the element A and setting this as A ';
For A ′ of the fifth step, for the intermediate that is shifted down by one stage from M in the intermediate row, the A of the fourth step and the fifth step is replaced with A ′ and executed. A sixth step of repeating this finite times until the norm is an element of the base field K;
A seventh step of finding the inverse of the norm for the basic field, calculating the product of the intermediate products stored in the fourth step with the conjugate element products for all the intermediate sequences, and using this as the inverse of A;
An inverse element calculation method comprising:

A prime number of 27 bits or more and 32 bits or less is used as a characteristic, and the original inverse element of a sixth-order extended field M obtained by adding a primitive 7th root of 1 to a prime field P not including the 7th root of 1 is calculated. An inverse element operation method,
A first step of inputting an element A for obtaining an inverse element under a sixth order extension field M;
A second step of obtaining a tertiary extension field N [1] of the prime field P;
A third step of calculating a product of all conjugate elements of the cubic extension field N [1] of the element A as a first conjugate element product;
A fourth step of calculating a first norm obtained by multiplying the first conjugate element product by the element A;
A fifth step of calculating a product of all conjugate elements of the first norm for the prime field as a second conjugate element product;
A sixth step of calculating a second norm obtained by multiplying the second conjugate product by the first norm;
A seventh step of calculating the inverse of the second norm;
An eighth step of multiplying the inverse of the second norm by the second conjugate element and the first conjugate element to calculate the inverse A ^-1 of A;
A ninth step of outputting the inverse A ^-1 of A;
An inverse element calculation method comprising:

7. The inverse element calculation method according to claim 6, wherein the element of the prime field P is processed as one word in the information processing apparatus, and the element of the sixth-order expanded field M is processed as six words.

An inverse element calculation method for finding an inverse element to an element of an extended field M obtained by expanding a basic field K of a finite field,
An arbitrary expansion degree n (n is a natural number) for obtaining an expansion field M by expanding the base field K;
q (j is a small natural number) such that q = n · j + 1 is a prime number;
The qth-order circular fraction polynomial (x ^q−1 + x ^q−2 +... + x + 1) is a prime p that is irreducible on the prime field Z / pZ, and the prime p is processed on the information processing apparatus. The number of effective bits when expressed as a numerical value of is less than or equal to the word length processed by the information processing device, less than or equal to half the word length and equal to or less than twice the word length A prime p having any condition of the number of bits;
An irreducible polynomial for expanding the prime field Z / pZ to obtain a basic field K;
A first step of inputting
One irreducible polynomial on the prime field Z / pZ is selected, and a field obtained by expanding Z / pZ with this irreducible polynomial is set as a base field K. If a linear expression is selected as the irreducible polynomial, K = Z / pZ, and when the field obtained by expanding the basic field K with the q-th circular polynomial (x ^q−1 + x ^q−2 +... + X + 1) is the expanded field L, the intermediate of the expanded field L If j = 1 as the field M, take L itself as M, and if j> 1, take M with an ^order of ^pn and input the element A of M for which the inverse element is to be calculated. Steps and
For any divisor n [1],... n [k] of n, select a divisor sequence such that n [i] divides n [i + 1], and order n [i A third step in which a subfield of L that is the power is N [i], n [0] = 1, N [0] = K, N [k + 1] = M, and A [k + 1] = A;
For the element A [i] of N [i], the product A [i] ^* of all conjugate elements for N [i−1] is
A [i] ^* = A [i] @pn ^[i-1] + ^{p2n [i-1]} + ... + ^{pn [i] -n [i-1]} } = (... (( A [i] ＾ ( ^{pn [i-1]} ) A [i]) ＾ ( ^{pn [i-1]} ) A [i]) ...) ＾ ( ^{pn [i-1]} ) A fourth step of storing and storing
The norm NN _{[i] / N [i-1]} (A [i]) is expressed as
A fifth step of calculating _{NN [i] / N [i-1]} (A [i]) = A [i] A [i] ^*, and newly setting this norm to A [i-1]; ,
Input A [i] in order from the element A of the extended field M of i = k + 1 to the basic field K of 1;
A sixth step of obtaining A [i] ^* and norm N _{N [i] / N [i−1]} (A [i]);
A seventh step of ^finding the inverse of _{NN [1] / N [0]} (A [1]) and setting this to A [0] ^-1 ;
A [i] ^* stored in the fourth step and A [0] ^{−1 in} the seventh step to A− ¹ = A [k + 1] ^* A [k] ^* ... A [1] ^* A [0 An eighth step of obtaining the inverse of A as ^-1 ;
An inverse element calculation method comprising:

An inverse operation program for causing a computer to execute an inverse operation process for calculating an inverse of an element of an enlarged field M obtained by enlarging a basic field K of a finite field,
A function of obtaining an extended field L obtained by enlarging the basic field K by using a primitive polynomial as a defining polynomial with only a primitive q-th root having a certain prime number q as a root and the basic field K and the extended field A function for obtaining an expanded field M obtained by expanding the base field K by a given numerical value n between L and
A function for calculating the original inverse of the extension field M using the Frobenius mapping in the extension field L;
With
q is a prime element operation program, wherein q is a prime number obtained by adding 1 to an integral multiple of the extension degree n of the intermediate.

An inverse operation program for causing a computer to execute an inverse operation process for calculating an inverse of an element of an enlarged field M obtained by enlarging a basic field K of a finite field,
An arbitrary expansion degree n (n is a natural number) for obtaining an expansion field M by expanding the base field K;
q (j is a small natural number) such that q = n · j + 1 is a prime number;
The qth-order circular fraction polynomial (x ^q−1 + x ^q−2 +... + x + 1) is a prime p that is irreducible on the prime field Z / pZ, and the prime p is processed on the information processing apparatus. The number of effective bits when expressed as a numerical value of is less than or equal to the word length processed by the information processing device, less than or equal to half the word length and equal to or less than twice the word length A prime p having any condition of the number of bits;
An irreducible polynomial for expanding the prime field Z / pZ to obtain a basic field K;
Function to input
One irreducible polynomial on the prime field Z / pZ is selected, and a field obtained by expanding Z / pZ with this irreducible polynomial is set as a base field K. If a linear expression is selected as the irreducible polynomial, K = Z / pZ, and when the field obtained by expanding the basic field K with the q-th circular polynomial (x ^q−1 + x ^q−2 +... + X + 1) is the expanded field L, the intermediate of the expanded field L When j = 1 as a field M, take L itself as M, and when j> 1, assume that M has an ^order of ^pn , and input an element A of M for which an inverse element is to be calculated; ,
For any divisor n [1],... n [k] of n, a divisor sequence is selected such that n [i] divides n [i + 1], and the order is (#K) ^{n [i]} A function of n [0] = 1, N [0] = K, N [k + 1] = M, and A [k + 1] = A;
For the element A [i] of N [i], the product A [i] ^* of all conjugate elements for N [i−1] is
A [i] ^* = A [i] @pn ^[i-1] + ^{p2n [i-1]} + ... + ^{pn [i] -n [i-1]} } = (... (( A [i] ＾ ( ^{pn [i-1]} ) A [i]) ＾ ( ^{pn [i-1]} ) A [i]) ...) ＾ ( ^{pn [i-1]} ) And memorize,
The norm NN _{[i] / N [i-1]} (A [i]) is expressed as
NN _{[i] / N [i-1]} (A [i]) = A [i] A [i] ^* , and a function to newly set this norm to A [i-1];
Input A [i] in order from the element A of the extended field M of i = k + 1 to the basic field K of 1;
A [i] ^* and a function to obtain norm N _{N [i] / N [i−1]} (A [i]);
A function of calculating the inverse of _{NN [1] / N [0]} (A [1]) and setting this to A [0] ^-1 ;
A [i] ^* stored in the fourth step and A [0] ^{−1 in} the seventh step to A− ¹ = A [k + 1] ^* A [k] ^* ... A [1] ^* A [0 A function of obtaining the inverse of A as ⁻¹ ,
An inverse operation program characterized by comprising: