JP5640531B2 - Encryption key analysis method, encryption key analysis device, and encryption key analysis program - Google Patents

Description

  The present invention relates to an encryption key analysis method, an encryption key analysis device, and an encryption key analysis program.

  In recent years, online shopping and online banking have become widespread. When performing communication in online shopping or online banking, encryption technology such as SSL (Secure Socket Layer) / TLS (Transport Layer Security) is used to prevent information leakage. Encryption methods can be broadly classified into common key encryption and public key encryption.

  Among these, common key cryptography is a scheme in which cryptographic communication is performed when the sender and the receiver have the same key. That is, in the common key encryption, the sender encrypts a certain message based on a secret encryption key and sends it to the receiver. The receiver uses this encryption key to decrypt the ciphertext and obtain a message.

  Public key cryptography is a method of encrypting and decrypting data using two pairs of keys. In other words, the sender encrypts the message with the public key published by the receiver and sends it. On the other hand, the recipient decrypts the encrypted message with the secret key. The public key is a key for encrypting a message, and the secret key is a key for decrypting information encrypted with the public key. Information encrypted with the public key can only be decrypted with the private key of the pair.

  Public key cryptography is designed based on a mathematically difficult problem in order to ensure safety even when a public key is disclosed. For example, public key cryptography includes RSA (Rivest Shamir Adleman) cryptography, El Gamal cryptography, and Elliptic Curve Cryptosystem.

  RSA cryptography is based on the difficulty of a mathematical problem called the prime factorization problem. The El Gamal cipher is based on the difficulty of a mathematical problem called the discrete logarithm problem. The elliptic curve cryptosystem is designed based on the discrete logarithm problem on the elliptic curve. A discrete logarithm problem on an elliptic curve is referred to as an “elliptic curve discrete logarithm problem”. Thus, the security of public key cryptography is based on the difficulty of mathematical problems. Therefore, the security of these mathematical problems is an indicator of the security of public key cryptography.

Elliptic curve cryptography is a cipher based on the elliptic curve discrete logarithm problem. Ciphers based on the elliptic curve discrete logarithm problem are defined in an additive group comprising a set of points on the elliptic curve and an infinite point 0 as a unit element. The number of points included in this additive group is called order r. The following are defined as operations for the points P1 and P2 on the elliptic curve.
Addition: P3 = P1 + P2 = P2 + P1
Double calculation: P2 = 2 × P1 = P1 + P1
Subtraction: P3 = P1-P2
Zero point: 0 (point at infinity) = P1-P1
Scalar multiplication: k x P = P + P + ... + P

  Here, the problem of calculating k from k × P and P is called an elliptic curve discrete logarithm problem. k corresponds to a secret key of public key cryptography. In general, when the order r is sufficiently large, it is difficult to obtain the solution k. Under the assumption that the elliptic curve logarithm problem is difficult, the elliptic curve cryptosystem can ensure high security.

In recent years, public key cryptography called pairing has attracted attention. Pairing is a kind of elliptic curve cryptography. The function of the conventional elliptic curve is expanded by using an operation called pairing for two points on the elliptic curve. In this case, in addition to the difficulty of the elliptic curve discrete logarithm problem, new assumptions regarding the difficulty of some mathematical problems are required. The difficulty of a mathematical problem called (L + 1) hyperbolic Difie-Hellman exponential problem may be assumed. The (L + 1) hyperbolic Difie-Hellman exponent problem is to obtain k and k ^{L + 1} from P, k × P, k ² × P, k ³ × P,..., K ^L × P. In this case, since there is additional information such as k ² × P, k ³ × P,..., K ^L × P, compared to the elliptic curve discrete logarithm problem for obtaining k from P and k × P, there is additional information. Is sometimes called the elliptic discrete logarithm problem.

  Here, in order to evaluate the security of public key cryptography, it is necessary to analyze the mathematical problem that forms the basis of the security. For example, one of the parameters for determining the security student is the order r. If the value of this order r is increased, the security of the public key encryption can be improved. Also, the processing load for decoding increases. For this reason, in order to find the right magnitude r that can reduce the processing load for encryption and decryption to some extent while guaranteeing safety, actual computer experiments are conducted to evaluate mathematical problems. It is important to do it.

An analysis of a mathematical problem includes an elliptic curve discrete logarithm problem with an auxiliary input for obtaining k from P, k × P, k ^d × P and d. Here, d is a divisor of (r−1). As a method for solving this problem, for example, the Cheon analysis method is known. The Cheon analysis method is an attack method using the Baby-Step Giant-Step analysis method (BSGS). In the Cheon analysis method, attacks are performed by processing BSGS twice. BSGS creates two types of tables and compares the calculation results to obtain a secret key k. As a result, the secret key k as the encryption key can be solved with a calculation amount about several times the minimum r1 ^{/ 4} .

Japanese Patent Laid-Open No. 11-288215 JP 2003-288013 A

  However, the above Cheon analysis method has a problem that the amount of calculation for obtaining the solution of the elliptic curve discrete logarithm problem is large.

  The disclosed technology has been made in view of the above, and an encryption key analysis method, an encryption key analysis device, and an encryption key analysis capable of reducing the amount of calculation for obtaining a solution of an elliptic curve discrete logarithm problem The purpose is to provide a program.

  According to an encryption key analysis method disclosed in the present application, in one aspect, a computer indicates a solution of an elliptic curve discrete logarithm problem by a power of a generator corresponding to a point on the elliptic curve, and the power of the generator is a first power part. A division step for dividing the first part into a first part and a value calculated by raising the generation source to a power when the value of the first part is changed in a predetermined range; A value calculated by raising the generator to a power when the value of the second part is changed in a predetermined range, and a value obtained by applying automorphism mapping to a part of the exponent of the generator And a second calculation step for storing the combined value in the second table, the value stored in the first table and the value stored in the second table are compared, and based on the matching value, Solve the elliptic curve discrete logarithm problem To perform an encryption key analysis step of analyzing the encryption key by out be a requirement.

  According to one aspect of the encryption key analysis method disclosed in the present application, it is possible to reduce the amount of calculation for obtaining the solution of the elliptic curve discrete logarithm problem.

FIG. 1A is a diagram for supplementing the process of comparing the Tb table and the Tg table. FIG. 1B is a diagram for explaining a specific example of BSGS. FIG. 2 is a diagram (1) for explaining a specific example of the Cheon analysis method. FIG. 3 is a diagram (2) for explaining a specific example of the Cheon analysis method. FIG. 4 is a diagram (3) for explaining a specific example of the Cheon analysis method. FIG. 5 is a flowchart showing the processing procedure of the conventional Cheon analysis method. FIG. 6 is a diagram of the configuration of the encryption key decrypting apparatus according to the first embodiment. FIG. 7 is a diagram (1) showing a range in which the elliptic curve calculation is to be executed when the automorphic mapping is applied and when it is not applied. FIG. 8 is a diagram (2) showing a range in which the elliptic curve calculation is to be executed when the automorphic mapping is applied and when it is not applied. FIG. 9 is a diagram illustrating an example of the data structure of the Tb table according to the first embodiment. FIG. 10 is a diagram illustrating an example of the data structure of the Tg table according to the first embodiment. FIG. 11 is a diagram illustrating the configuration of the table generation unit according to the first embodiment. FIG. 12 is a flowchart of the process procedure of the processing unit according to the first embodiment. FIG. 13 is a flowchart of the process procedure of the table processing unit according to the first embodiment. FIG. 14 is a diagram illustrating the configuration of the decryption apparatus according to the second embodiment. FIG. 15 is a diagram illustrating an example of the data structure of the Tb table according to the second embodiment. FIG. 16 is a diagram illustrating an example of the data structure of the Tg table according to the second embodiment. FIG. 17 is a diagram illustrating the configuration of the table generation unit according to the second embodiment. FIG. 18 is a flowchart of the process procedure of the processing unit according to the second embodiment. FIG. 19 is a diagram illustrating the configuration of the encryption key decrypting apparatus according to the third embodiment. FIG. 20 is a diagram illustrating an overview of the process of the table generation unit according to the third embodiment. FIG. 21 is a diagram illustrating an example of the data structure of the Tb table according to the third embodiment. FIG. 22 is a diagram illustrating an example of the data structure of the Tg table according to the third embodiment. FIG. 23 is a diagram illustrating the configuration of the table generation unit according to the third embodiment. FIG. 24 is a flowchart of the process procedure of the processing unit according to the third embodiment. FIG. 25 is a flowchart of the process procedure of the table generation unit according to the third embodiment. FIG. 26 is a diagram (1) illustrating a comparison result of the conventional Cheon analysis method, the number of elliptic operations in Examples 1 to 3, and the data amount of the table. FIG. 27 is a diagram (2) illustrating a comparison result of the conventional Cheon analysis method, the number of elliptic operations in Examples 1 to 3, and the data amount of the table. FIG. 28 is a diagram showing the table creation time and the table amount. FIG. 29 is a diagram illustrating a computer that executes an encryption key decryption program.

  First, the principle for explaining the technique in the encryption key decryption apparatus disclosed in the present application will be described with reference to the drawings. Below, Baby-Step Giant-Step analysis method, Cheon analysis method, automorphism map, power expression of automorphism map will be described in this order.

First, the “Baby-Step Giant-Step analysis method” will be described. Hereinafter, the Baby-Step Giant-Step analysis method is referred to as BSGS. BSGS is one of the efficient solutions for the elliptic curve discrete logarithm problem. When solving an elliptic curve logarithm problem in which an elliptic curve parameter of order r is used and an unknown value x (0 <x <r) is obtained from known x × G and G, BSGS is 2 × r ^{1/2. The} elliptic curve discrete logarithm problem can be solved by performing the elliptic curve calculation about twice. On the other hand, if the elliptic curve discrete logarithm problem is obtained by brute force without using BSGS, an average of about r / 2 times is required.

In BSGS, the unknown number x is divided into an upper value x _H and a lower value x _L in a decimal number obtained by rounding up the value of r ^1/2 , Baby-Step is executed to create a Tb table, and Giant- Execute Step to create a Tg table. In Baby-Step, “(x _L −i) × G” is sequentially calculated while sequentially changing the value of i, and the calculation results are sequentially stored in the Tb table. On the other hand, in Giant-Step, “j × G” is sequentially calculated while sequentially changing the value of j, and the calculation results are sequentially stored in the Tg table. Note that i and j are multiplied by a predetermined value in accordance with a decimal number.

  FIG. 1A is a diagram for supplementing the process of comparing the Tb table and the Tg table. In FIG. 1A, 1a is an upper part of the unknown x, and 1b is a lower part of the unknown x. Comparing the Tb table and the Tg table is comparing the value corresponding to the 2a portion in FIG. 1A and the value corresponding to the 2b portion.

FIG. 1B is a diagram for explaining a specific example of BSGS. Here, as an example, it is assumed that the order r = 97 and the values of G and xG are given. Note that the unknown number x = 96. In Baby-Step, BSGS sequentially changes the value of i and sequentially calculates “x _L G-iG” to generate the Tb table 10a. In the example shown in FIG. 1, the value of i is 0-9. In Giant-Step, the BSGS sequentially changes the value of j and sequentially calculates “j × 10G” to generate the Tg table 10b. In the example shown in FIG. 1, the value of j is 0-9.

In BSGS, each value of the Tb table 10a is compared with each value of the Tg table 10b, and the values of i and j when the values match are determined. Since the relationship between the unknown number x and i, j is “x = i + 10j”, the unknown number x can be calculated if the values of i and j when the values match can be determined. In the example shown in FIG. 1, the value “90” when i in the Tb table 10 a is “6” and the value “90” when j in the Tg table 10 b are “9” match. Therefore, the unknown number x is “x = 6 + 9 × 10 = 96”. In BSGS, the unknown number x is calculated in this way. The elliptic curve calculation at this time is 20 times. This number of times is almost the same as the value of “2 × r ^1/2 ” described above.

  Here, a case where the elliptic curve discrete logarithm problem is obtained by brute force will be described. When the elliptic curve discrete logarithm problem is determined by brute force, an elliptic curve calculation is performed on average r / 2 times. When the values of G and xG are given, the value of i is sequentially changed to calculate “i × G” sequentially, and the calculation result is compared with the value of xG to obtain the unknown x. For example, in the case of the unknown number x = 96, when the value of i reaches 96, the value of “i × G” matches the value of xG, so that the unknown number x = 96 can be obtained. In this case, it is necessary to perform the elliptic curve calculation 96 times.

In the case of order r, BSGS can solve the elliptic curve discrete logarithm problem by an elliptic curve calculation with an average of about 2 × r ^1/2 times, but the round robin method has an elliptic curve calculation with an average of r / 2 times. Necessary. From the above, BSGS reduces the number of elliptic curve operations when solving an elliptic curve problem compared to the round robin method.

Next, the “Cheon analysis method” will be described. The Cheon analysis method is a method of calculating a solution by applying BSGS to an elliptic discrete logarithm problem with additional information. In the BSGS, the unknown number x is obtained from G and xG, but in the Cheon analysis, the unknown number x is obtained using G, xG, x ^d G, d. d corresponds to a divisor of r-1. The Cheon analysis method reduces the amount of calculation by performing BSGS twice. If the value of d is substantially the same as the value of r ^1/2 , it is known that the number of elliptic curve calculations is approximately r ^¼ .

  Hereinafter, specific examples of the Cheon analysis method will be described. 2 to 4 are diagrams for explaining specific examples of the Cheon analysis method.

In the Cheon analysis method, the generator ζ of the order r with respect to the point G is obtained, and ^{y where} x = ζ ^y is found. Here, the value range of y is 0 to r-1. Each numerical value on the left side of FIG. 2 is the same as each numerical value shown in FIG. 1A. On the right side of FIG. 2, y _H corresponds to the quotient obtained by dividing y by (r−1) / d, and y _L corresponds to the remainder obtained by dividing y by (r−1) / d.

」であり、部分３ｂに対応する値は「ζ^ｊ×Ｇ」である。つまり、Cheon解析法では、ζの指数部分において、BSGSと同様の処理を実行することで、ｙを求める。 As shown in FIG. 2, comparing the value corresponding to the part 2a with the value corresponding to the part 2b is the same as comparing the value corresponding to the part 3a and the value corresponding to the part 3b. The value corresponding to the portion 2a is “(x _L −i) × G”, and the value corresponding to the portion 2b is “j × G”. The value corresponding to the part 3a is “

The value corresponding to the portion 3b is “ζ ^j × G”. That is, in the Cheon analysis method, y is obtained by executing the same process as BSGS in the exponent part of ζ.

In the Cheon analysis, instead of obtaining a y consisting beginning with x = zeta ^y, by dividing the y into _{y H} and _{y L,} obtaining a _{y H} and _{y L,} respectively.

First, a description will be given of a case of obtaining a _{y L.} Finding z such that x ^d G = ζ _d ^z G and finding y _L have the same mathematical meaning. However, ζ _d = ζ ^d . By applying BSGS to obtain z, z can be obtained with a calculation amount of 0 (r ^1/4 ).

」を順次算出し、Ｔｂテーブルに計算結果を順次格納する。また、Giant-Stepにおいて、ｊの値を変化させながら「ζ_ｄ ^ｊ×Ｇ」を順次算出し、Ｔｇテーブルに計算結果を順次格納する。Cheon解析法では、Ｔｂテーブルの各値とＴｇテーブルの各値とを比較し、各値が一致する場合のｉおよびｊの値を判定する。ｉとｊとの値が分かれば、ｚを求めることができる。 As shown on the right side of FIG. 3, the Cheon analysis, it divides the z to the upper z _H and z _L. And in Cheon analysis method, while changing the value of i in Baby-Step,

Are sequentially calculated, and the calculation results are sequentially stored in the Tb table. In Giant-Step, “ζ _d ^j × G” is sequentially calculated while changing the value of j, and the calculation results are sequentially stored in the Tg table. In the Cheon analysis method, each value in the Tb table is compared with each value in the Tg table, and the values of i and j are determined when the values match. If the values of i and j are known, z can be obtained.

となるｗの値を見つける。ｗの値は、ｙ_Ｈに対応するものである。ｗの値域は０〜ｄとなる。 Subsequently, in Cheon analysis, after obtaining the y _L, we obtain the remaining y _H. In Cheon analysis,

Find the value of w such that The value of w, which corresponds to the y _H. The range of w is 0 to d.

」を順次算出し、Ｔｂテーブルに計算結果を順次格納する。また、ｊの値を変化させながら「ζ_ｄ ^ｊ×Ｇ」を順次算出し、Ｔｇテーブルに計算結果を順次格納する。Cheon解析法では、Ｔｂテーブルの各値とＴｇテーブルの各値とを比較し、各値が一致する場合のｉおよびｊの値を判定する。ｉとｊとの値が分かれば、ｗを求めることができる。 As shown on the right side of FIG. 4, it divides the w to the upper _{w H} and _{w L.} And in Cheon analysis method, while changing the value of i in Baby-Step,

Are sequentially calculated, and the calculation results are sequentially stored in the Tb table. Further, “ζ _d ^j × G” is sequentially calculated while changing the value of j, and the calculation results are sequentially stored in the Tg table. In the Cheon analysis method, each value in the Tb table is compared with each value in the Tg table, and the values of i and j are determined when the values match. If the values of i and j are known, w can be obtained.

As described above, by executing the processing in FIGS. 2-4, and z corresponding to y _L, since w is obtained corresponding to y _H, the value of y is identified. In the above Cheon analysis method, an elliptic discrete logarithm problem with additional information can be analyzed with a minimum calculation amount of 0 (r1 ^{/ 4} ).

Next, the processing procedure of the conventional Cheon analysis method will be described. FIG. 5 is a flowchart showing the processing procedure of the conventional Cheon analysis method. As shown in FIG. 5, in the Cheon analysis method, an unknown number x = ζ ^y is set, and y is divided into y _H and y _L (step S10).

In the Cheon analysis method, Baby-Step is executed on the y _L portion to create a Tb table that is ζ _d ^−u1 × x ^d G (step S11). However, the range of u1 is 0 ≦ u1 <d1. Here, d1 corresponds to the rounded up value of ((r−1) / d) ^1/2 .

In the Cheon analysis method, Giant-Step is executed on the y _L portion to create a Tg table that is ζ _d ^{v1 · d1} × G (step S12). However, the value range of v1 is 0 ≦ v1 <d1.

In the Cheon analysis method, the Tb table and the Tg table are compared, and a set of u1 and v1 that ^satisfies ζ _d ^{−u 1} × x ^d G = ζ _d ^{v1 · d1} × G is calculated (step S13). In the Cheon analysis method, z is calculated by adding u1 and v1 (step S14). This z is the one corresponding to the _{y L.}

Subsequently, in the Cheon analysis method, Baby-Step is executed on the upper part to create a Tb table 141 that ^satisfies ζ ^{−u2 (r−1) / r} × xG {0 ≦ u2 <d1 ″} ( Step S15). In the Cheon analysis method, Giant-Step is executed for the upper part to calculate Tg that satisfies ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G {0 ≦ v2 <d ″}. A Tg table composed of all points is created (step S16).

In the Cheon analysis method, the Tb table and the Tg table are compared, and ζ ^{−u2 (r−1) / r} × xG =, and ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G (u2, A set of v2) is calculated (step S17). In the Cheon analysis method, the upper part w of y is calculated from w = y _H = u2 + v2d ″ (step S18). This w are those corresponding to the _{y H.} In the Cheon analysis method, y is calculated by adding z and w (r-1) / d (step S19). This y corresponds to x = ζ ^y and the unknown number x. The specific example of the Cheon analysis method has been described above. In this way, the unknown number x is calculated in the Cheon analysis method.

Next, “automorphism mapping” will be described. In some elliptic curves, the Frobenius map Φ (P) of the point P on the elliptic curve can be calculated at high speed. For example, in the elliptic curve of the finite field (3 ¹²⁷ ), the Frobenius map Φ (P) = (x ³ , y ³ ) of the point P = (x, y) is also a point on the same elliptic curve. This Frobenius map Φ (P) only requires the cube of each coordinate, and can be calculated faster than other elliptic curve calculations. Note that Φ ⁽ⁱ⁾ (P), which is a point obtained by applying Frobenius map Φ (P) i times to the point P, is described as follows. That is, Φ ⁽ⁱ⁾ (P) = Φ (Φ (... Φ (P))).

In addition, for some elliptic curves, a negative mapping can be calculated at high speed. The minus map is a map that associates the point P with the point -P. For example, in the elliptic curve in the finite field GF (3 ¹²⁷ ), the negative mapping −P = (x, −y) of the point P = (x, y) is also a point on the same elliptic curve. Below, the Frobenius map and the minus map are collectively called automorphism maps.

Next, the “expression of the automorphism map” will be described. In the case of an elliptic curve in the finite field GF (q ^m ), when the Frobenius map is applied to an arbitrary point m times, the original point is restored. That is, Φ ^(m) (P) = P. In addition, when a negative mapping of an arbitrary point is applied twice, the original point is restored. That is, (−1) ² × P = P.

When the automorphism map is expressed as the power of the generator ζ, the automorphism map is (−1) ⁽ⁱ⁾ Φ ^(j) P = ζ ^{(i · m + 2 · c · j) (r−1) / 2m} × P can be expressed. Here, c is a constant uniquely determined by the elliptic curve and the value of the generation source. The values of i and j are i = 0 to 1 and j = 0 to m-1.

In particular, regarding the point P on the finite field GF (3 ¹²⁷ ) elliptic curve where the minus point and the Frobenius map are also on the same elliptic curve, the generation source ζ = 3, m = 127, c = 110 Can be expressed as (−1) ⁽ⁱ⁾ Φ ^(j) P = ζ ^{(127 · i + 220 · j) (r−1) / 254} × P.

  The principle for explaining the technology in the encryption key decryption apparatus disclosed in the present application has been described above. Hereinafter, embodiments of an encryption key decryption apparatus disclosed in the present application will be described in detail with reference to the drawings. The invention is not limited to the embodiment.

  The encryption key decryption apparatus according to the first embodiment will be described. FIG. 6 is a diagram of the configuration of the encryption key decrypting apparatus according to the first embodiment. The encryption key decryption device 100 is a device that calculates a secret key for public key cryptography by solving an elliptic curve discrete logarithm problem. As illustrated in FIG. 6, the encryption key decryption apparatus 100 includes an input unit 110, an output unit 120, a processing unit 130, and a storage unit 140.

  The input unit 110 inputs information from the outside. For example, the input unit 110 receives an instruction from the user and inputs the received instruction to the processing unit 130. In addition, the input unit 110 receives various parameters used when deciphering the elliptic curve discrete logarithm problem, and inputs the received parameters to the processing unit 130. The output unit 120 outputs a decoding result of the elliptic discrete logarithm problem.

  The processing unit 130 includes a parameter acquisition unit 131, a table generation unit 132, a table comparison unit 133, an unknown number calculation unit 134, and a control unit 135.

  The parameter acquisition unit 131 is a processing unit that acquires parameters from the input unit 110 and outputs the acquired parameters to the table generation unit 132. The parameter acquisition unit 131 may store the parameter in the storage unit 140 and acquire the parameter stored in the storage unit 140 when an instruction from the user is received.

Here, an example of the parameters will be described. The parameters include G ^* , ζ ^* , m, d ″. Among these, G ^* is a point on the elliptic curve. ζ ^* is a generator of the order r. m is the expansion order. d ″ designates the creation range of the table. Specifically, when obtaining y _H using an automorphism, G ^* = G _d , ζ ^* = ζ _d , d ″ is “((r−1) / d / 2m) ^{1 /} It becomes a value of ² rounded up ". When y _H is obtained using an automorphism, G ^* = G, ζ ^* = ζ ^{(r−1) / d} , d ″ is a value of “(d / 2m) ^1/2 . Is the value rounded up. When using a self-isomorphism, it is often used only in either case of obtaining the case and y _H to obtain the y _L. Therefore, in the following, especially when there is no description will be described for the case of the production of y _L.

  The table generation unit 132 is a processing unit that executes Baby-Step and Giant-Step in the manner of the Cheon analysis method, and generates a Tb table and a Tg table. In particular, when the table generation unit 132 executes Giant-Step to create a Tg table, the table generation unit 132 applies the automorphism mapping to a part of the elliptic curve calculation, thereby reducing the amount of calculation.

In order to apply the automorphism map to the Cheon analysis method, it is necessary to express the automorphism map by the exponent multiplication of the generator ζ. When the automorphism map is expressed by exponent multiplication of the generation source ζ, (−1) ⁽ⁱ⁾ Φ ^(j) × P = ζ _d ^{(i · m + 2 · c · j) d ″} P. d is a divisor of r−1, and d is a value selected so as not to include the divisors 2 and m. By applying the automorphism map, the range in which the elliptic curve calculation should be performed can be reduced. This selection would use an automorphism to determine yL.

  Here, the range in which the elliptic curve calculation is performed when the automorphic mapping is applied and when it is not applied will be described. FIG. 7 and FIG. 8 are diagrams showing ranges where the elliptic curve calculation should be executed when the automorphic mapping is applied and when it is not applied. The upper part of FIG. 7 corresponds to a conventional Cheon analysis method that does not apply automorphism mapping. The lower part of FIG. 7 corresponds to the present idea of applying the automorphism mapping.

FIG. 7 shows a case where the search range is divided into upper d and lower (r−1) / d. For example, as shown in the upper part of FIG. 7, when searching the range of (r−1) / d, elliptic curve calculation is performed on the range of (r−1) / d to calculate z. There was a need. When calculating z, as explained in FIG. 3, z is divided into z _H and z _L , Baby-Step and Giant-Step are executed, and the Tb table and the Tg table are compared. , Z is calculated.

On the other hand, when the automorphism mapping is applied, it is not necessary to perform the elliptic curve calculation on the range of (r−1) / d. As shown in the lower part of FIG. 7, the range for executing the elliptic curve calculation may be (r−1) / d / 2m, and the remaining range uses the automorphism map “(−1) ⁱ Φ ^j ”. Find it.

  As shown in FIG. 8, the range for executing Baby-Step is 20b, and the range for executing Giang-Step is 20a. Since the range 20b for executing Baby-Step does not include the range to which automorphism mapping is applied, a Tb table is created in the same manner as in the Cheon analysis method. On the other hand, the range 20b in which Giant-Step is executed includes a range to which automorphism mapping is applied. For this reason, when Giant-Step is executed, a Tg table is created by applying an automorphism to a part of the elliptic curve calculation.

Processing when the table generation unit 132 executes Baby-Step will be described. The table generation unit 132 creates a Tb table by sequentially calculating “ζ _d ^{−u 1} × x ^d G” while changing the value of u 1. Note that the range of u1 is “0 ≦ u1 <d1 ″”.

FIG. 9 is a diagram illustrating an example of the data structure of the Tb table according to the first embodiment. As illustrated in FIG. 9, the Tb table 141 stores a value of k and a point of ζ _d ^−k × x ^d G corresponding to the value of k in association with each other. K in the Tb table 141 is a value corresponding to u1.

Processing when the table generation unit 132 executes Giang-Step will be described. The table generation unit 132 sequentially calculates “(−1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{v1 · d1} × G)” while sequentially changing the values of v1, i, and j. 142 is created. The value range of v1 is “0 ≦ v1 <d1 ″”. The range of i is “0, 1”. The range of j is “0 ≦ j <m−1”.

FIG. 10 is a diagram illustrating an example of the data structure of the Tg table according to the first embodiment. As shown in FIG. 10, the Tg table 142 includes (−1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{k · d1} × × corresponding to the values of k, i, j and the values of k, i, j. G) is stored in association with the point. K in the Tg table is a value corresponding to v1.

  Here, the configuration of the table generation unit 132 will be described. FIG. 11 is a diagram illustrating the configuration of the table generation unit according to the first embodiment. As illustrated in FIG. 11, the table generation unit 132 includes a table generation control unit 150, a scalar multiplication unit 151, and an automorphic mapping calculation unit 152.

The table generation control unit 150 uses the scalar multiplication unit 151 and the automorphism mapping calculation unit 152 to create “ζ _d ^{−u 1} × x ^d G”, “(−1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{v1 · d1} × G) ”is calculated, and the Tb table 141 and the Tg table 142 are created.

The table generation control unit 150 acquires parameters d1 ″, ζ ^* , G ^* , m, and T ^* . The table generation control unit 150 determines to generate the Tb table 141 or the Tg table 142 according to T ^* . T ^* is information for identifying whether the Tb table 141 is created or the Tg table 142 is created. The table generation control unit 150 acquires T ^* from the control unit 135.

A case where the table generation control unit 150 generates the Tb table 141 will be described. The table generation control unit 150 sequentially inputs ζ ^* , G ^* , and k to the scalar multiplication unit 151 and sequentially acquires (ζ ^* ) ^k G ^* from the scalar multiplication unit 151. K when generating the Tb table 141 corresponds to u1. The table generation control unit 150 registers k and (ζ ^* ) ^k G ^* in association with each other in the Tb table 141.

A case where the table generation control unit 150 generates the Tg table 142 will be described. The table generation control unit 150 sequentially inputs ζ ^* , G ^* , k to the scalar multiplication unit 151 and sequentially acquires (ζ ^* ) ^k G ^* from the scalar multiplication unit 151. K when generating the Tg table 142 corresponds to the above v1. After obtaining (ζ ^* ) ^k G ^* , the table generation control unit 150 sequentially inputs i, j, (ζ ^* ) ^k G ^* to the automorphic map calculation unit 152, and from the automorphism map calculation unit 152 ( -1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) is acquired. The table generation control unit 150 associates i, j, k, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) with each other and registers them in the Tg table 142.

The scalar multiplication unit 151 is a processing unit that receives ζ ^* , G ^* , k from the table generation control unit 150 and calculates (ζ ^* ) ^k G ^* . The scalar multiplication unit 151 outputs (ζ ^* ) ^k G ^* to the table generation control unit 150.

The automorphic map calculation unit 152 receives i, j, (ζ ^* ) ^k G ^* from the table generation control unit 150, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ). Is a processing unit for calculating. The automorphic mapping calculation unit 152 outputs (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) to the table generation control unit 150.

  By the way, the table generation part 132 shall perform said process with respect to the low-order part of the unknown y, and a high-order part, respectively. The lower part of the unknown y corresponds to the range (r−1) / d shown in FIG. Further, the upper part of the unknown y corresponds to the range of d shown in FIG. When obtaining the lower part, the amount of calculation is reduced by applying an automorphic mapping to a part of the elliptic curve calculation. When obtaining the upper part, the same calculation as before without using the automorphic mapping operation is performed.

Returning to the description of FIG. The table comparison unit 133 compares the Tb table 141 and the Tg table 142, and
ζ _d ^{−u 1} × x ^d G = (− 1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{v1 · d1} × G)
(U1, v1, i, j) is a processing unit for obtaining a set. The table comparison unit 133 outputs the obtained set (u1, v1, i, j) to the unknown number calculation unit 134.

  The Tb table 141 and the Tg table 142 are created corresponding to the lower part and the upper part of the unknown y, respectively. For this reason, the table comparison unit 133 outputs a set of (u1, v1, i, j) to the unknown number calculation unit 134 for each part.

  The unknown number calculation unit 134 acquires a set of (u1, v1, i, j) from the table comparison unit 133, and calculates a secret key. Here, the lower part of the unknown y is z, and the upper part of the secret key is w.

Based on the set (u1, v1, i, j) obtained from the lower part, the unknown number calculation unit 134 converts the lower part of the unknown y to z = u1 + v1 · d1 ″ + (i · m + 2 · c · j). Calculated by d ″. In this ^case, since the _{^{x d G = ζ d z G}} , a ^{x _d} = ^{ζ d z z} is obtained.

  The unknown number calculation unit 134 calculates the upper part of the unknown y by w = u2 + v2 · d1 ″ based on the set (u2, v2) obtained from the upper part. Here, d ″ = d2 (conventional value).

The unknown number calculation unit 134 obtains z and w, and then obtains y = z + w (r−1) / d. There is a relationship of x = ζ ^y between the secret keys x and y. The unknown number calculation unit 134 obtains the secret key x from the relationship between the secret keys x and y, and outputs information on the obtained secret key x to the output unit 120.

The control unit 135 is a processing unit that controls the parameter acquisition unit 131, the table generation unit 132, the table comparison unit 133, and the unknown number calculation unit 134 to perform the operations described above. For example, the control unit 135 inputs T ^* to the table generation unit 132 and creates the Tb table 141 or the Tg table 142. After the Tb table 141 and the Tg table 142 are created, the control unit 135 instructs the table comparison unit 133 to compare the Tb table 141 with the Tg table 142.

  The storage unit 140 is a storage unit that stores the Tb table 141 and the Tg table 142. The data structure of the Tb table 141 is as shown in FIG. The data structure of the Tg table 142 is as shown in FIG.

Next, a processing procedure of the processing unit 130 according to the first embodiment will be described. FIG. 12 is a flowchart of the process procedure of the processing unit according to the first embodiment. For example, the process illustrated in FIG. 12 is executed when an instruction to solve the elliptic curve discrete logarithm problem is received from the input unit 110. As illustrated in FIG. 12, the processing unit 130 sets the secret key x = ζ ^y and divides y into an upper part and a lower part (step S101).

The processing unit 130 executes Baby-Step on the lower part, and creates the Tb table 141 that ^satisfies ζ _d ^−u1 × x ^d G {0 ≦ u1 <d1 ″} (step S102). The processing unit 130 executes Giant-Step on the lower part, and ζ _d ^{v1 · d1} × G {0 ≦ v1 <d1 ″}, and an automorphism map of each point (−1) ⁽ⁱ⁾ Φ ^{( j)} (ζ _d ^{v1 · d1} × G) is calculated, and a Tg table 142 composed of all points is created (step S103).

The processing unit 130 compares the Tb table 141 and the Tg table 142 to ^obtain ζ _d ^{−u 1} × x ^d G = (− 1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{v1 · d1} × G) (u1 , V1, i, j) is calculated (step S104). The processing unit 130 calculates the lower part z of y by z = u1 + v1 · d1 ″ + (i · m + 2 · c · j) d ″ (step S105).

The processing unit 130 executes Baby-Step on the upper part, and creates the Tb table 141 that ^satisfies ζ ^{−u2 (r−1) / r} × xG {0 ≦ u2 <d1 ″} (step S106). . The processing unit 130 executes Giant-Step on the upper part, calculates Tg such that ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G {0 ≦ v2 <d ″}, A Tg table consisting of the points is created (step S107).

The processing unit 130 compares the Tb table and the Tg table, and ^becomes ζ ^{−u2 (r−1) / r} × xG =, ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G (u2, A set of v2) is calculated (step S108). The processing unit 130 calculates the upper part w of y by w = y _H = u2 + v2d ″ (step S109). D ″ is obtained by rounding up the value of d ^1/2 .

The processing unit 130 calculates the value of y by y = z + w (r−1) / d (step S110). The processing unit 130 obtains x from the relationship x = ζ ^y (step S111), and outputs the secret key x (step S112).

  Next, a process procedure in which the table generation unit 132 according to the first embodiment generates the Tb table 141 and the Tg table 142 will be described. FIG. 13 is a flowchart of the process procedure of the table generation unit according to the first embodiment.

As shown in FIG. 13, the table generating unit 132 acquires parameters d1 ″, ζ ^* , G ^* , m, and T ^* (step S201), and sets k to an initial value (step S202). The table generation unit 132 executes scalar multiplication (ζ ^* ) ^k G ^* (step S203), and outputs {k, (ζ ^* ) ^k G ^* } to the storage unit 140 (step S204).

The table generation unit 132 performs automorphism mapping calculation (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) for i = 0 to 1, j = 0 to m−1. (Step S205). The table generation unit 132 outputs {k, i, j, (−1) ⁽ⁱ⁾ Φ ^(j) (ζ ^* ) ^k × G ^* } to the storage unit 140 (step S206).

  The table generating unit 132 calculates k = k + 1 (step S207), and determines whether the value of k is larger than the value of d ″ −1 (step S208). If the value of k is equal to or less than the value of d ″ −1 (No at Step S208), the table generating unit 132 proceeds to Step S203. On the other hand, when the value of k is larger than the value of d ″ −1 (step S208, Yes), the table generating unit 132 ends the process.

Next, effects of the decryption apparatus 100 according to the first embodiment will be described. When the decryption apparatus 100 according to the first embodiment executes Giant-Step to generate the Tb table 141, the decryption apparatus 100 performs the elliptic curve calculation by applying the automorphism mapping to a part of the elliptic curve calculation. The range to be executed can be reduced. Compared with the conventional Cheon analysis method, the calculation amount of the lower part can be reduced to 1 / (2 m) ^1/2 . For example, in the case of an elliptic curve on a finite field GF (3 m), since m = 127, the calculation amount of the lower part is (1/16) ^1/2 = 1 as compared with the conventional Cheon analysis method. / 4 or so.

  By the way, the configuration of the encryption key decryption apparatus 100 shown in FIG. 6 is an example, and the encryption key decryption apparatus 100 does not necessarily have all the processing units shown in FIG. For example, the encryption key decryption apparatus 100 only needs to have a dividing unit, a first calculation unit, a second calculation unit, and an encryption key analysis unit.

  Of these, the dividing unit is a processing unit that indicates a solution of the elliptic curve discrete logarithm problem by a power of a generator corresponding to a point on the elliptic curve, and divides the power part of the generator into a first part and a second part. . The first calculation unit is a processing unit that stores, in the first table, a value calculated by raising the generation source to a power when the value of the first part is changed in a predetermined range. The second calculation unit applies an automorphism mapping to a value calculated by raising the power of the generator when the value of the second part is changed in a predetermined range, and a part of the power of the generator And a processing unit that stores a value that is a combination of the calculated value and the second table in the second table. The dividing unit, the first calculation unit, and the second calculation unit correspond to the table generation unit 132.

  The encryption key analysis unit compares the value stored in the first table with the value stored in the second table, and calculates the encryption key by calculating a solution of the elliptic curve discrete logarithm problem based on the matched value. A processing unit to analyze. This encryption key analysis unit corresponds to the table comparison unit 133 and the unknown number calculation unit 134.

  By the way, in the first embodiment, although the calculation amount can be greatly reduced as compared with the conventional Cheon analysis method, the data amount of the Tg table 242 increases about eight times as compared with the conventional one. In the second embodiment described below, an encryption key decryption device that can reduce the calculation amount without increasing the data amount will be described.

  FIG. 14 is a diagram illustrating the configuration of the encryption key decrypting apparatus according to the second embodiment. As illustrated in FIG. 14, the encryption key decryption apparatus 200 includes an input unit 210, an output unit 220, a processing unit 230, and a storage unit 240.

  Among these, the description regarding the input unit 210 and the output unit 220 is the same as the description regarding the input unit 110 and the output unit 120 illustrated in FIG. 1.

  The processing unit 230 includes a parameter acquisition unit 231, a table generation unit 232, a table comparison unit 233, an unknown number calculation unit 234, and a control unit 235.

The parameter acquisition unit 231 is a processing unit that acquires parameters from the input unit 210 and outputs the acquired parameters to the table generation unit 232. The parameters include G ^* , ζ ^* , m, and d ″ as in the first embodiment. The parameter acquisition unit 231 may store the parameters in the storage unit 240 and acquire the parameters stored in the storage unit 240 when receiving an instruction from the user.

  The table generation unit 232 is a processing unit that executes Baby-Step and Giant-Step and generates the Tb table 241 and the Tg table 242 in the manner of the Cheon analysis method. In particular, when the table generation unit 232 executes Giant-Step to create the Tb table 241, the table generation unit 232 applies the automorphism mapping to a part of the elliptic curve calculation, thereby reducing the amount of calculation.

By the way, the table generation unit 132 according to the first embodiment executes Baby-Step, and sequentially calculates “ζ _d ^−u1 × x ^d G” while changing the value of u1 from “0 to ^d1 ″”. It was. Also, by executing the Giant-Step and changing the value of v1 from “0 to ^d1 ″”, “ζ _d ^{v1 · d1} × G” was sequentially calculated. That is, in the first embodiment, the value range of u1 and the value range of v1 are “0 to d1 ″” in common.

On the other hand, the table generation unit 232 sets the value range of u1 and the value range of v1 non-uniformly. Specifically, the table generation unit 232 executes Baby-Step and sequentially calculates “ζ _d ^−u1 × x ^d G” while changing the value of u1 from “0 to d1 _b ”. Here, d1 _b = ((r−1) / d) ^1/2 . Further, the table generation unit 232 executes Giant-Step to sequentially calculate “ζ _d ^{v1 · d1} × G” while changing the value of v1 to “0 to d1 _g ”. Here, d1 _g = ((r−1) / d / 2m) / d1 _b ).

Since the range 0 to d1 _b of u1 when executing Baby-Step is the same as the range of the conventional Cheon analysis method and the algorithm is also common, the calculation amount and the data amount of the Tb table 241 are the conventional ones. Will be the same. In contrast, the range of the v1 when running Giant-Step is 0～D1 _g, since there is a relation of d1 g = d1 / 2m, compared with the conventional, the calculation amount of about 1 / 2. The data amount of the Tg table 242 is the same as that of the conventional Cheon analysis method. That is, the table generation unit 232 according to the second embodiment can reduce the calculation amount to ½ without increasing the data amount when compared with the conventional Cheon analysis method.

Processing when the table generation unit executes Baby-Step will be described. The table generation unit 232 generates the Tb table 241 by sequentially calculating “ζ _d ^{−u 1} × x ^d G” while changing the value of u 1. Note that the value range of u1 is “0 ≦ u1 <d1 _b ” as described above.

FIG. 15 is a diagram illustrating an example of the data structure of the Tb table according to the second embodiment. As illustrated in FIG. 15, the Tb table 241 stores a value of k in association with a point of ζ _d ^−k × x ^d G corresponding to the value of k. K in the Tb table 241 is a value corresponding to u1.

」を順次算出することで、Ｔｇテーブル２４２を作成する。なお、ｖ１の値域を「０≦ｖ１＜ｄ１_ｇ」とする。ｉの値域を「０、１」とする。ｊの値域を「０≦ｊ＜ｍ−１」とする。 Processing when the table generation unit 232 executes Giang-Step will be described. The table generation unit 232 changes the values of v1, i, j sequentially,

”Are sequentially calculated to create the Tg table 242. Note that the value range of v1 is “0 ≦ v1 <d1 _g ”. The range of i is “0, 1”. The range of j is “0 ≦ j <m−1”.

」の点とを対応付けて記憶する。Ｔｇテーブル２４２でのｋは、ｖ１に対応する値である。 FIG. 16 is a diagram illustrating an example of the data structure of the Tg table according to the second embodiment. As shown in FIG. 16, the Tg table 242 includes “k”, “i”, “j” values, and “k”, “i”, “j” values.

Are stored in association with each other. K in the Tg table 242 is a value corresponding to v1.

  Here, the configuration of the table generation unit 232 will be described. FIG. 17 is a diagram illustrating the configuration of the table generation unit according to the second embodiment. As illustrated in FIG. 17, the table generation unit 232 includes a table generation control unit 250, a scalar multiplication unit 251, and an automorphic mapping calculation unit 252.

The table generation control unit 250 acquires parameters d1 ″, ζ ^* , G ^* , m, and T ^* . The table generation control unit 250 determines to generate the Tb table 241 or the Tg table 242 according to T ^* . T ^* is information for identifying whether the Tb table 241 is created or the Tg table 242 is created. The table generation control unit 250 acquires T ^* from the control unit 235.

A case where the table generation control unit 250 generates the Tb table 241 will be described. The table generation control unit 250 sequentially inputs ζ ^* , G ^* , and k to the scalar multiplication unit 251 and sequentially acquires (ζ ^* ) ^k G ^* from the scalar multiplication unit 251. K in the case of generating the Tb table 241 corresponds to the above u1. The table generation control unit 250 associates k with (ζ ^* ) ^k G ^* and registers them in the Tb table 241.

A case where the table generation control unit 250 generates the Tg table 242 will be described. The table generation control unit 250 sequentially inputs ζ ^* , G ^* , and k to the scalar multiplication unit 251 and sequentially acquires (ζ ^* ) ^k G ^* from the scalar multiplication unit 251. K in the case of generating the Tg table 242 corresponds to the above v1 · d1 _b . After acquiring (ζ ^* ) ^k G ^* , the table generation control unit 250 sequentially inputs i, j, (ζ ^* ) ^k G ^* to the automorphic mapping calculation unit 252, and from the automorphic mapping calculation unit 252 ( -1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) is acquired. The table generation control unit 250 associates i, j, k, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) with each other and registers them in the Tg table 242.

The scalar multiplication unit 251 is a processing unit that receives ζ ^* , G ^* , k from the table generation control unit 250 and calculates (ζ ^* ) ^k G ^* . The scalar multiplication unit 251 outputs (ζ ^* ) ^k G ^* to the table generation control unit 250.

The automorphic map calculation unit 252 receives i, j, (ζ ^* ) ^k G ^* from the table generation control unit 250, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ). Is a processing unit for calculating. The automorphic mapping calculation unit 252 outputs (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) to the table generation control unit 250.

  By the way, the table generation part 232 shall perform said process with respect to the low-order part of the unknown y, and a high-order part, respectively. The lower part of the unknown y corresponds to the range (r−1) / d shown in FIG. Further, the upper part of the unknown y corresponds to the range of d shown in FIG. In either case, when Giant-Step is executed, the calculation amount is reduced by applying the automorphism mapping to a part of the elliptic curve calculation.

となる（ｕ１、ｖ１、ｉ、ｊ）の組を求める処理部である。テーブル比較部２３３は、求めた（ｕ１、ｖ１、ｉ、ｊ）の組を未知数算出部２３４に出力する。 Returning to the description of FIG. The table comparison unit 233 compares the Tb table 241 and the Tg table 242, and

(U1, v1, i, j) is a processing unit for obtaining a set. The table comparison unit 233 outputs the obtained (u1, v1, i, j) set to the unknown number calculation unit 234.

  The Tb table 241 and the Tg table 242 are created corresponding to the lower part and the upper part of the unknown y, respectively. For this reason, the table comparison unit 233 outputs a set of (u1, v1, i, j) to the unknown number calculation unit 234 for each part.

  The unknown number calculation unit 234 acquires a set of (u1, v1, i, j) from the table comparison unit 233, and calculates a secret key. Here, the lower part of the unknown y is z, and the upper part of the secret key is w.

Based on the set (u1, v1, i, j) obtained from the lower part, the unknown number calculation unit 234 converts the lower part of the unknown y to z = u1 + v1 · d1 _b + (i · m + 2 · c · j) d. Calculate with ''. In this ^case, since the ^{_{x d G = ζ d z G}} , a ^{x _d} = ^{ζ d z z} is obtained.

  The unknown number calculation unit 234 calculates the upper part of the unknown y by w = u2 + v2 · d ″ based on the set (u2, v2) obtained from the upper part.

The unknown number calculation unit 234 obtains the unknown number y by y = z + w (r−1) / d after obtaining z and w. There is a relationship of x = ζ ^y between the secret keys x and y. The unknown number calculation unit 234 obtains the secret key x from the relationship between the secret keys x and y, and outputs information on the obtained secret key x to the output unit 220.

The control unit 235 is a processing unit that controls the parameter acquisition unit 231, the table generation unit 232, the table comparison unit 233, and the unknown quantity calculation unit 234 to perform the operations described above. For example, the control unit 235 inputs T ^* to the table generation unit 232 to create the Tb table 241 or the Tg table 242. After the Tb table 241 and the Tb table 242 are created, the control unit 235 instructs the table comparison unit 233 to compare the Tb table 241 and the Tg table 242.

  The storage unit 240 is a storage unit that stores the Tb table 241 and the Tg table 242. The data structure of the Tb table 241 is as shown in FIG. The data structure of the Tg table 242 is as shown in FIG.

  Next, a processing procedure of the processing unit 230 according to the second embodiment will be described. FIG. 18 is a flowchart of the process procedure of the processing unit according to the second embodiment. The process shown in FIG. 18 is executed when an instruction to solve the elliptic curve discrete logarithm problem is received from the input unit 210.

」｛０≦ｖ１＜ｄ１_ｂ｝と、各点の自己同型写像「

」を算出し、全ての点からなるＴｇテーブル１４２を作成する（ステップＳ３０３）。 As illustrated in FIG. 18, the processing unit 230 sets the secret key x = ζ ^y and divides y into an upper part and a lower part (step S301). The processing unit 230 executes Baby-Step on the lower part and creates a Tb table 241 that ^satisfies ζ _d ^−u1 × x ^d G {0 ≦ u1 <d1 _b } (step S302). The processing unit 230 executes Giant-Step on the lower part, and “

{0 ≦ v1 <d1 _b } and the automorphism map of each point “

Is calculated and a Tg table 142 composed of all points is created (step S303).

」となる（ｕ１、ｖ１、ｉ、ｊ）の組を算出する（ステップＳ３０４）。処理部２３０は、ｚ＝ｕ１＋ｖ１・ｄ１_ｂ＋（ｉ・ｍ＋２・ｃ・ｊ）ｄ’’により、ｙの下位部分ｚを算出する（ステップＳ３０５）。 The processing unit 230 compares the Tb table 241 and the Tg table 242, and determines “

(U1, v1, i, j) is calculated (step S304). The processing unit 230 calculates the lower part z of y by z = u1 + v1 · d1 _b + (i · m + 2 · c · j) d ″ (step S305).

The processing unit 230 executes Baby-Step on the upper part, and creates the Tb table 141 that ^satisfies ζ ^{−u2 (r−1) / r} × xG {0 ≦ u2 <d1 ″} (step S306). . The processing unit 230 executes Giant-Step on the upper part, calculates Tg such that ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G {0 ≦ v2 <d ″}, A Tg table consisting of the points is created (step S307).

The processing unit 230 compares the Tb table with the Tg table, and ^becomes ζ ^{−u2 (r−1) / r} × xG =, ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G (u2, A set of v2) is calculated (step S308). The processing unit 230 calculates the upper part w of y by w = y _H = u2 + v2d ″ (step S309).

The processing unit 230 calculates the value of y by y = z + w (r−1) / d (step S310). The processing unit 230 obtains x from the relationship x = ζ ^y (step S311), and outputs the secret key x (step S312).

」との全ての組み合わせをＴｇテーブル２４２に格納する必要がある。このため、

のｖ１の値域を制限してやれば、「

」の演算結果の数が減るので、結果として、自己同型写像「（−１）^（ｉ）Φ^（ｊ）」と、「

」との全ての組み合わせ数が減り、Ｔｇテーブル２４２のデータ量を削減することができる。したがって、本実施例２にかかる暗号解読装置２００によれば、従来のCheon解析法と比較して、テーブル量を増加させることなく、計算量を削減することができる。 Next, effects of the decryption apparatus 200 according to the second embodiment will be described. When the decryption apparatus 200 according to the second embodiment executes Giant-Step to generate the Tb table 241, the decryption apparatus 200 applies the automorphism mapping to a part of the elliptic curve calculation. Furthermore, the decryption apparatus 200 sets the value range of u1 when executing Baby-Step and the value range of v1 when executing Giant-Step to be non-uniform. When the automorphism map is applied to the elliptic curve calculation, the automorphism map “(−1) ⁽ⁱ⁾ Φ ^(j) ” and “

All combinations with “” must be stored in the Tg table 242. For this reason,

If the range of v1 is limited,

As a result, the automorphism map “(−1) ⁽ⁱ⁾ Φ ^(j) ” and “

”And the data amount of the Tg table 242 can be reduced. Therefore, according to the cryptanalysis apparatus 200 according to the second embodiment, the amount of calculation can be reduced without increasing the table amount, as compared with the conventional Cheon analysis method.

  An encryption key decrypting apparatus according to a third embodiment will be described. In the first and second embodiments, the automorphism map is applied to the Giant-Step side. However, in the third embodiment, by applying the automorphism map to the Baby-Step side and the Giant-Step side, the calculation amount is increased. And reduce table volume.

  FIG. 19 is a diagram illustrating the configuration of the encryption key decrypting apparatus according to the third embodiment. As illustrated in FIG. 19, the encryption key decryption apparatus 300 includes an input unit 310, an output unit 320, a processing unit 330, and a storage unit 340.

  Among these, the description regarding the input part 310 and the output part 320 is the same as the description regarding the input part 110 and the output part 120 shown in FIG.

  The processing unit 330 includes a parameter acquisition unit 331, a table generation unit 332, a table comparison unit 333, an unknown number calculation unit 334, and a control unit 335.

The parameter acquisition unit 331 is a processing unit that acquires parameters from the input unit 310 and outputs the acquired parameters to the table generation unit 332. The parameters include G ^* , ζ ^* , m, and d ″ as in the first embodiment. The parameter acquisition unit 331 may store the parameters in the storage unit 340 and acquire the parameters stored in the storage unit 340 when receiving an instruction from the user.

  The table generation unit 332 is a processing unit that executes Baby-Step and Giant-Step in the manner of the Cheon analysis method, and generates a Tb table 341 and a Tg table 342. In particular, the table generation unit 332 reduces the amount of calculation by applying an automorphic mapping to a part of the elliptic curve calculation in the case of Baby-Step and Giant-Step.

FIG. 20 is a diagram illustrating an overview of the process of the table generation unit according to the third embodiment. FIG. 20 shows a case where the search range is divided into upper d and lower (r−1) / d. When the table generation unit 332 executes Baby-Step for the range of (r−1) / d, the elliptic curve calculation is executed for the range 30a and the automorphism mapping is executed for the range 40b. To do. Here, the range 40b corresponds to the upper part of the automorphism map “(−1) ⁽ⁱ⁾ Φ ^{(j” )} . ”The table generation unit 332 combines the result of the automorphism map and the result of the elliptic curve calculation. The combined value is stored in the Tb table 341.

When the table generation unit 332 executes Giant-Step for the range of (r−1) / d, the elliptic curve calculation is executed for the range 30b and the automorphism mapping is executed for the range 40a. To do. Here, the range 40b corresponds to the lower part of the automorphism map “(−1) ⁱ Φ ^j ”. The table generation unit 332 stores a value obtained by combining the automorphic mapping result and the elliptic curve calculation result in the Tg table 342.

Processing when the table generation unit 332 executes Baby-Step will be described. The table generation unit 332 sequentially calculates “(−1) ^(ib) Φ ^(jb) (ζ _d ^u1 × G)” while sequentially changing the values of u1, ib, and jb, and creates the Tb table 341. . However, the selection condition of i and j is “− (2m) ^1/2 <(i · m + j · c · 2) mod 2m ≦ 0”. That is, the table generation unit 332 calculates only the value of “(−1) ^(ib) Φ ^(jb) (ζ _d ^u1 × G)” corresponding to the combination of i and j that satisfies the selection condition. Note that the range of u1 is “0 ≦ u1 <d1 ″”.

FIG. 21 is a diagram illustrating an example of the data structure of the Tb table according to the third embodiment. As shown in FIG. 21, the Tb table 341 includes (−1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^−k x ^d ) corresponding to the values of k, i, j and the values of k, i, j. G) is stored in association with the point. K in the Tb table 341 is a value corresponding to u1. i and j correspond to ib and jb, respectively.

Processing when the table generation unit 332 executes Giant-Step will be described. The table generation unit 332 sequentially calculates “(−1) ^(ig) Φ ^(jg) (ζ _d ^{v1 · d ″} × G)” while sequentially changing the values of v1, ig, and jg, and the Tb table. 342 is created. However, the selection condition of i and j is “(m · ig + 2c · jg) mod 2m = 0”. That is, the table generation unit 332 calculates only the value of “(−1) ^(ig) Φ ^(jg) (ζ _d ^{v1 · d ″} × G)” corresponding to the combination of i and j that satisfies the above selection conditions. To do. The value range of v1 is “0 ≦ v1 <d1 ″”.

FIG. 22 is a diagram illustrating an example of the data structure of the Tg table according to the third embodiment. As shown in FIG. 22, the Tg table 342 includes (−1) ⁽ⁱ⁾ Φ ^(j) (ζ _d ^{−k · d1} ) corresponding to the values of k, i, j and the values of k, i, j. G) is stored in association with the point. K in the Tg table 342 is a value corresponding to v1. i and j correspond to ig and jg, respectively.

  Here, the configuration of the table generation unit 332 will be described. FIG. 23 is a diagram illustrating the configuration of the table generation unit according to the third embodiment. As illustrated in FIG. 23, the table generation unit 232 includes a table generation control unit 350, a scalar multiplication 351, an automorphism mapping calculation unit 352, and an automorphism mapping selection unit 353.

The table generation control unit 350 acquires selection conditions for the parameters d1 ″, ζ ^* , G ^* , m, T ^* , i, j. Among these, the selection conditions for i and j are “− (2m) ^1/2 <(i · m + j · c · 2) mod 2m ≦ 0” and “(m · ig + 2c · jg) mod 2m = 0”. .

The table generation control unit 350 determines to generate the Tb table 341 or the Tg table 342 according to T ^* . T ^* is information for identifying whether the Tb table 341 is created or the Tg table 342 is created. The table generation control unit 350 acquires T ^* from the control unit 235.

A case where the table generation control unit 350 generates the Tb table 341 will be described. Table generation control unit 350, the scalar multiplication 351, zeta ^{*, G} *, sequentially inputs the k, ^(* zeta) from the scalar multiplication unit 351 ^k G ^* sequentially acquires. K in the case of generating the Tb table 341 corresponds to the above u1.

After obtaining (ζ ^* ) ^k G ^* , the table generation control unit 350 sequentially inputs i, j, (ζ ^* ) ^k G ^* to the automorphic mapping calculation unit 352, and from the automorphic mapping calculation unit 352 ( -1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) is acquired. The table generation control unit 350 associates i, j, k, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) with each other and registers them in the Tb table 341.

The table generation control unit 350 inputs the selection conditions of i and j and the combination of i and j to the automorphism mapping selection unit 353, and the combination of i and j satisfies the selection conditions of i and j. If there is, the set of i and j and (ζ ^* ) ^k G ^* are input to the automorphism mapping calculation unit 352. When the Tb table 341 is generated, the selection conditions for i and j are “− (2m) ^1/2 <(i · m + j · c · 2) mod 2m ≦ 0”.

A case where the table generation control unit 350 generates the Tg table 342 will be described. Table generating unit 350, the scalar multiplication unit 351, zeta ^{*, G} *, sequentially inputs the k, ^(* zeta) from the scalar multiplication unit 251 ^k G ^* sequentially acquires. K in the case of generating the Tg table 342 corresponds to the above v1.

After obtaining (ζ ^* ) ^k G ^* , the table generation control unit 350 sequentially inputs i, j, (ζ ^* ) ^k G ^* to the automorphic mapping calculation unit 352, and from the automorphic mapping calculation unit 352 ( -1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) is acquired. The table generation control unit 350 associates i, j, k, and (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k × G ^* ) with each other and registers them in the Tg table 342.

The table generation control unit 350 inputs the selection conditions of i and j and the combination of i and j to the automorphism mapping selection unit 353, and the combination of i and j satisfies the selection conditions of i and j. If there is, the set of i and j and (ζ ^* ) ^k G ^* are input to the automorphism mapping calculation unit 352. When the Tg table 341 is generated, the selection conditions for i and j are “(m · ig + 2c · jg) mod 2m = 0”.

  By the way, it is assumed that the table generation unit 332 executes the above-described processing for the lower part and the upper part of the unknown number y. This corresponds to the range of (r−1) / d shown in FIG. Further, the upper part of the unknown y corresponds to the range of d shown in FIG. In either case, when Baby-Step and Giant-Step are executed, the amount of calculation is reduced by applying an automorphic mapping to a part of the elliptic curve calculation.

Returning to the description of FIG. The table comparison unit 333 compares the Tb table 341 and the Tg table 342, and
(-1) ^(ib) Φ ^(jb) (ζ _d ^u1 × G) = (− 1) ^(ig) Φ ^(jg) (ζ _d ^{v1 · d ″} × G)
(U1, v1, ib, jb, ig, jg). The table comparison unit 333 outputs the obtained set (u1, v1, ib, jb, ig, jg) to the unknown number calculation unit 334.

  The unknown number calculation unit 334 obtains a set of (u1, v1, ib, jb, ig, jg) from the table comparison unit 333, and calculates a secret key. Here, the lower part of the unknown y is z, and the upper part of the secret key is w.

The unknown number calculation unit 334 obtains the lower part z of the unknown y based on the set (u1, v1, ib, jb, ig, jg) obtained from the lower part. z is obtained by z = u1 + (ib · m + 2 · c · jb) + v1 · d1 ″ + (ig · m + 2 · c · jg) · d ″. In this ^case, since the _{^{x d G = ζ d z G}} , a ^{x _d} = ^{ζ d z z} is obtained.

  The unknown number calculation unit 334 calculates the upper part of the unknown y by w = u2 + v2 · d ″ based on the set (u2, v2) obtained from the upper part.

The unknown number calculation unit 334 obtains z and w and then obtains y = z + w (r−1) / d. There is a relationship of x = ζ ^y between the secret keys x and y. The unknown number calculation unit 334 obtains the secret key x from the relationship between the secret keys x and y, and outputs information on the obtained secret key x to the output unit 320.

The control unit 335 is a processing unit that controls the parameter acquisition unit 331, the table generation unit 332, the table comparison unit 333, and the unknown number calculation unit 334 so as to perform the operations described above. For example, the control unit 335 inputs T ^* to the table generation unit 332 and creates the Tb table 341 or the Tg table 342. After the Tb table 341 and the Tb table 342 are created, the control unit 335 instructs the table comparison unit 333 to compare the Tb table 341 and the Tg table 342.

  The storage unit 340 is a storage unit that stores the Tb table 341 and the Tg table 342. The data structure of the Tb table 341 is as shown in FIG. The data structure of the Tg table 342 is as shown in FIG.

Next, a processing procedure of the processing unit 330 according to the third embodiment will be described. FIG. 24 is a flowchart of the process procedure of the processing unit according to the third embodiment. For example, the process shown in FIG. 24 is executed when an instruction to solve the elliptic curve discrete logarithm problem is received from the input unit 310. As shown in FIG. 24, the processing unit 330 sets the secret key x = ζ ^y and divides y into an upper part and a lower part (step S401).

The processing unit 330 executes Baby-Step on the lower part, and ζ _d ^{−u 1} × x ^d G {0 ≦ u 1 <d 1 ″} and the automorphism mapping of each point (−1) ^(ib) Φ ^{( Jb )} (ζ _d ^−u1 × x ^d G) is calculated, and a Tb table 341 composed of all points is created (step S402).

The processing unit 330 stores, in the Tb table 341, only the points where the set of ib and jb satisfies “− (2m) ^1/2 <(ib · m + 2 · c · jb) mod 2m ≦ 0” among the calculated points. (Step S403).

The processing unit 330 performs a Giant-Step on the lower part, and ζ _d ^{v1 · d1 ″} × G {0 ≦ v1 <d1 ″}, and an automorphism map of each point (−1) ^(ig) Φ ^(jg) (ζ _d ^{v1 · d1 ″} × G) is calculated, and a Tg table 342 composed of all points is created (step S404).

  The processing unit 330 stores, in the Tg table 342, only the points where the set of ig and jg is (m · ig + 2c · jg) mod 2m = 0 ”among the calculated points (step S405).

The processing unit 330 compares the Tb table 341 and the Tg table 342, and (-1) ^(ib) Φ ^(jb) (ζ _d ^−u1 × x ^d G) = (− 1) ^(ig) Φ ^(jg) A set of (u1, v1, ib, jb, ig, jg) that is (ζ _d ^{v1 · d1 ″} × G) is calculated (step S406). The processing unit 330 calculates z by z = u1 + (ib · m + 2 · c · jb) + v1 · d1 ″ + (ig · m + 2 · c · jg) · d ″ (step S407).

The processing unit 330 executes Baby-Step on the upper part and executes Baby-Step on the upper part, and ζ ^{−u2 (r−1) / r} × xG {0 ≦ u2 <d1 ″}. A Tb table 141 is created (step S408).

The processing unit 330 performs a Giant-Step on the upper part, calculates Tg such that ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G {0 ≦ v2 <d ″}, A Tg table consisting of these points is created (step S409).

The processing unit 330 compares the Tb table with the Tg table, and ^becomes ζ ^{−u2 (r−1) / r} × xG =, ζ ^k1 ζ ^{r2 · d2 · (r−1) / r} × G (u2, A set of v2) is calculated (step S410). The processing unit 330 calculates the upper part w of y by w = y _H = u2 + v2d ″ (step S411).

The processing unit 330 calculates the value of y by y = z + w (r−1) / d (step S412). The processing unit 330 obtains x from the relationship x = ζ ^y (step S413) and outputs the secret key x (step S414).

  Next, a process procedure in which the table generation unit 332 according to the third embodiment generates the Tb table 341 and the Tg table 342 will be described. FIG. 25 is a flowchart of the process procedure of the table generation unit according to the third embodiment.

As shown in FIG. 25, the table generation unit 332 acquires the conditions of parameters d1 ″, ζ ^* , G ^* , m, T ^* , (i, j) (step S501), and sets k to an initial value. (Step S502). The table generation unit 332 executes scalar multiplication (ζ ^* ) ^k G ^* (step S503).

The table generation unit 332 calculates automorphism mapping (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ) for i = 0 to 1 and j = 0 to m−1 that satisfy the condition (i, j). ^* ) ^K G ^* ) is executed (step S504). The table generation unit 332 outputs {i, j, k, (−1) ⁽ⁱ⁾ Φ ^(j) ((ζ ^* ) ^k G ^* )} to the storage unit 340 (step S505).

  The table generation unit 332 calculates k = k + 1 (step S506), and determines whether the value of k is larger than the value of d ″ −1 (step S507). When the value of k is equal to or less than the value of d ″ −1 (No at Step S507), the table generating unit 332 proceeds to Step S503. On the other hand, when the value of k is larger than the value of d ″ −1 (step S507, Yes), the table generation unit 332 ends the process.

Next, effects of the decryption apparatus 300 according to the third embodiment will be described. When executing the Baby-Step and the Giant-Step, the cryptanalysis apparatus 300 according to the third embodiment applies the automorphism mapping to a part of the elliptic curve calculation, thereby performing the elliptic curve calculation. Can be reduced. As a result, the amount of calculation for solving the elliptic curve discrete logarithm problem can be reduced to 1 / (2 m) ^1/2 as compared with the conventional Cheon analysis method. For example, in the case of an elliptic curve on a finite field GF (3 m), since m = 127, the amount of calculation is 1/16 compared to the conventional Cheon analysis method.

  Also, the cryptographic apparatus 300 according to the third embodiment obtains the calculation result of the automorphism mapping corresponding to the combination of i = 0 to 1 and j = 0 to m−1 that does not satisfy the selection conditions of i and j. Not stored in the Tb table 341 and the Tg table 342. As a result, the data amounts of the Tb table 341 and the Tg table 342 can be suppressed to the same amount as that of the conventional Cheon analysis method.

  Next, comparison results of the conventional Cheon analysis method, the number of elliptic operations in Examples 1 to 3 and the data amount of the table are shown. FIG. 26 and FIG. 27 are diagrams showing a comparison result of the conventional Cheon analysis method, the number of elliptic operations in Examples 1 to 3, and the data amount of the table.

As shown in FIG. 26, assuming that the number of elliptic operations in the conventional Cheon analysis method is 1, the number of elliptic operations in the first embodiment is 1 / (2m) ^1/2 and the number of elliptic operations in the second embodiment is 1/2. Thus, the number of elliptic operations in the third embodiment is 1 / (2m) ^1/2 . If the table amount of the conventional Cheon analysis method is 1, the table amount of the first embodiment is 1 / (2m) ^1/2 , the table amount of the second embodiment is 1, and the table amount of the third embodiment is 1. Become.

A comparison result of the conventional Cheon analysis method, the number of elliptic operations in Examples 1 to 3, and the data amount of the table in the case of an elliptic curve on the finite field GF (3 ¹²⁷ ) is shown. As shown in FIG. 27, when the number of elliptic operations in the conventional Cheon analysis method is 1, the number of elliptic operations in the first embodiment is about 1/16, and the number of elliptic operations in the second embodiment is about 1/2. The number of elliptic operations in Example 3 is about 1/16. If the table amount of the conventional Cheon analysis method is 1, the table amount of the first embodiment is about eight times, and the table amounts of the second and third embodiments are almost the same.

The theoretical value was evaluated by the number of elliptic operations, but the actual table creation also takes time to calculate the automorphism map. Therefore, here, as an example, the conventional Cheon analysis method using an elliptic curve on the finite field GF (3 ¹²⁷ ) and the experimental results of the table creation time of Example 3 will be described. FIG. 28 is a diagram showing the table creation time and the table amount.

  As shown in FIG. 28, in the conventional Cheon analysis method, the table creation time is 7 hours and the table amount is 15.78 MByte. On the other hand, in the third embodiment, the table creation time is 44 minutes and the table amount is 15.85 MByte. Therefore, it can be seen that Example 3 can create a table in 1 / 9.5 times as long as the conventional Cheon analysis method, and the table amount is almost the same at 1.004 times.

  The various processes of the encryption key decryption apparatuses 100, 200, and 300 described in the above embodiments can also be realized by executing a program prepared in advance on a computer system such as a personal computer or a workstation. . Therefore, an example of a computer that executes an encryption key decryption program having the same function as the encryption key decryption apparatuses 100, 200, and 300 described in the above embodiment will be described below with reference to FIG. FIG. 29 is a diagram illustrating a computer that executes an encryption key decryption program.

  As shown in the figure, a computer 400 includes an input / output control unit 410, an HDD (Hard Disk Drive) 420, a RAM (Random Access Memory) 430, and a CPU (Central Processing Unit) 440 as the encryption key decryption devices 100 and 200. . Each device 410 to 440 is configured by being connected by a bus 450.

  Here, the input / output control unit 410 controls input / output of various types of information. The HDD 420 stores information necessary for the CPU 440 to execute various processes. The RAM 430 temporarily stores various information. The CPU 440 executes various arithmetic processes.

  The HDD 420 stores encryption key decryption system data in advance. The encryption key decryption system data includes an encryption key decryption program that exhibits the same function as each processing unit of the encryption key decryption apparatuses 100, 200, and 300 shown in FIGS. The encryption key decryption system data includes encryption key decryption data including various parameters necessary for processing. The encryption key decryption system data can be appropriately distributed and stored in a storage unit of another computer that is communicably connected via a network.

  Then, the CPU 440 reads out this encryption key decryption system data from the HDD 420 and expands it in the RAM 430, so that the encryption key decryption system data functions as an encryption key decryption system. The encryption key decryption system includes an encryption key decryption process.

  That is, the encryption key decryption system and the encryption key decryption process installed therein read out the encryption key decryption data from the HDD 420, expand it in the area allocated to itself in the RAM 430, and perform various processes based on the expanded data. Execute.

  Note that the encryption key decryption system and the encryption key decryption process correspond to the processing executed in each functional unit shown in FIGS. 6, 14, and 19. For example, the encryption key decryption process corresponds to the parameter acquisition unit 131, the table generation unit 132, the table comparison unit 133, and the unknown number calculation unit 134.

  Note that the above-described encryption key decryption program does not necessarily need to be stored in the HDD 420 from the beginning.

  For example, each program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, and an IC card inserted into the computer 400. Then, the computer 400 may read and execute each program from these.

  Further, each program is stored in “another computer (or server)” connected to the computer 400 via a public line, the Internet, a LAN, a WAN, or the like. Then, the computer 400 may read and execute each program from these.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific state of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the table generation unit 132 and the table comparison unit 133 illustrated in FIG. 6 may be integrated. Further, the table comparison unit 133 and the unknown number calculation unit 134 may be integrated.

  The processing units 130, 230, and 330 shown in FIGS. 6, 14, and 19 correspond to integrated devices such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array). Alternatively, each processing unit 130, 230, 330 corresponds to an electronic circuit such as a CPU or MPU (Micro Processing Unit). The storage units 140, 240, and 340 shown in FIGS. 6, 14, and 19 are, for example, semiconductor memory elements such as RAM, ROM (Read Only Memory), and flash memory (Flash Memory), or hard disks, optical disks, and the like. Corresponds to the storage device.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Supplementary note 1)
A splitting step for indicating a solution of the elliptic curve discrete logarithm problem by a power of a generator corresponding to a point on the elliptic curve, and dividing the power part of the generator into a first part and a second part;
A first calculation step of storing, in a first table, a value calculated by raising the generation source when the value of the first part is changed in a predetermined range;
A value calculated by raising the power of the generator when the value of the second part is changed in a predetermined range and a value obtained by applying automorphism mapping to a part of the power of the generator are combined. A second calculation step of storing the combined values in the second table;
A cryptographic key for analyzing a cryptographic key by comparing a value stored in the first table with a value stored in the second table and calculating a solution of the elliptic curve discrete logarithm problem based on the matched value An encryption key analysis method comprising: performing an analysis step.

(Supplementary Note 2) The second calculation step is calculated by raising the generator to a power when the value of the first part is changed by a value range different from the predetermined value range to be changed by the first calculation step. The encryption key analysis method according to claim 1, wherein a value obtained by combining a value obtained by applying an automorphism map to a part of the power-source part of the generation source is stored in the second table.

(Supplementary note 3) The first calculation step changes a value satisfying a predetermined condition among values obtained by applying automorphism mapping to a part of the power-source part of the generation source, and a value of the second part within a predetermined range. In this case, a value combined with a value calculated by raising the power of the generator is stored in the first table, and the second calculation step includes an automorphism in a part of the power of the generator. A value obtained by combining a value satisfying a predetermined condition among values to which mapping is applied and a value calculated by raising the generation source when the value of the first portion is changed in a predetermined range. The encryption key analysis method according to appendix 1 or 2, wherein the encryption key is stored in the second table.

(Supplementary Note 4) The dividing step divides the power-source part of the generation source into an upper part and a lower part, and divides the upper part and the lower part into a first part and a second part, respectively, and the second calculation step includes 4. The encryption key analysis method according to appendix 1, 2, or 3, wherein an automorphism mapping is applied to either the second part of the upper part or the second part of the lower part.

(Supplementary Note 5) A dividing unit that indicates a solution of the elliptic curve discrete logarithm problem as a power of a generator corresponding to a point on the elliptic curve, and divides the power part of the generator into a first part and a second part;
A first calculation unit that stores, in a first table, a value calculated by raising the generation source when the value of the first part is changed in a predetermined range;
A value calculated by raising the power of the generator when the value of the second part is changed in a predetermined range and a value obtained by applying automorphism mapping to a part of the power of the generator are combined. A second computing unit for storing the combined values in the second table;
A cryptographic key for analyzing a cryptographic key by comparing a value stored in the first table with a value stored in the second table and calculating a solution of the elliptic curve discrete logarithm problem based on the matched value An encryption key analysis apparatus comprising: an analysis unit.

(Additional remark 6) When the value of the said 1st part is changed by the value range different from the predetermined value range which the said 1st calculating part changes, the said 2nd calculating part is calculated by raising the said origin to a power 6. The encryption key analyzing apparatus according to claim 5, wherein a value obtained by combining a value obtained by applying an automorphic mapping to a part of the power-source part of the generation source is stored in the second table.

(Supplementary note 7) The first calculation unit changes a value satisfying a predetermined condition among values obtained by applying automorphism mapping to a part of the power-source part of the generation source and a value of the second part within a predetermined range. A value combined with a value calculated by raising the power of the generator is stored in the first table, and the second arithmetic unit is automorphic to a part of the power of the generator A value obtained by combining a value satisfying a predetermined condition among values to which mapping is applied and a value calculated by raising the generation source when the value of the first portion is changed in a predetermined range. The encryption key analysis apparatus according to appendix 5 or 6, wherein the encryption key analysis apparatus is stored in the third table.

(Supplementary Note 8) The dividing unit divides the power-source part of the generation source into an upper part and a lower part, and divides the upper part and the lower part into a first part and a second part, respectively. The encryption key analysis apparatus according to appendix 5, 6 or 7, wherein an automorphism mapping is applied to either the second part of the upper part or the second part of the lower part.

(Supplementary note 9) A dividing procedure for indicating to the computer the solution of the elliptic curve discrete logarithm problem as a power of a generator corresponding to a point on the elliptic curve, and dividing the power part of the generator into a first part and a second part;
A first calculation procedure for storing, in a first table, a value calculated by raising the generation source when the value of the first portion is changed in a predetermined range;
A value calculated by raising the power of the generator when the value of the second part is changed in a predetermined range and a value obtained by applying automorphism mapping to a part of the power of the generator are combined. A second calculation procedure for storing the combined values in the second table;
A cryptographic key for analyzing a cryptographic key by comparing a value stored in the first table with a value stored in the second table and calculating a solution of the elliptic curve discrete logarithm problem based on the matched value An encryption key analysis program characterized by causing an analysis procedure to be executed.

(Supplementary Note 10) The second calculation procedure is calculated by raising the generator to a power when the value of the first part is changed by a value range different from the predetermined value range to be changed by the first calculation step. The encryption key analysis program according to appendix 9, wherein a value obtained by combining a value obtained by applying an automorphism map to a part of the power-source part of the generation source is stored in the second table.

(Additional remark 11) The said 1st calculation procedure changes the value of the said 2nd part with the value which satisfy | fills a predetermined condition among the values which applied the automorphism map to a part of the power-source part of the said production | generation, and a predetermined range In this case, a value combined with a value calculated by raising the power of the generator is stored in the first table, and the second calculation procedure includes an automorphism in a part of the power of the generator. A value obtained by combining a value satisfying a predetermined condition among values to which mapping is applied and a value calculated by raising the generation source when the value of the first portion is changed in a predetermined range. The encryption key analysis program according to appendix 9 or 10, wherein the encryption key analysis program is stored in the second table.

(Supplementary Note 12) In the dividing procedure, the power-source part of the generation source is divided into an upper part and a lower part, and the upper part and the lower part are respectively divided into a first part and a second part, and the second calculation procedure is The encryption key analysis program according to appendix 9, 10 or 11, wherein an automorphism mapping is applied to either the second part of the upper part or the second part of the lower part.

131 Parameter acquisition unit 132 Table generation unit 133 Table comparison unit 134 Unknown number calculation unit 135 Control unit

Claims (5)

Computer
A splitting step for indicating a solution of the elliptic curve discrete logarithm problem by a power of a generator corresponding to a point on the elliptic curve, and dividing the power part of the generator into a first part and a second part;
A first calculation step of associating and storing in the first table a value of the first part that changes in a predetermined value range and a value calculated by raising the generation source to a power by the value of the first part ;
The value of the second part that changes in an area different from the area where the value of the first part changes and the value of the automorphism map corresponding to the value of the second part are stored in the second table in association with each other . A second calculation step;
The value calculated by raising the generator stored in the first table to a power and the value of the automorphism stored in the second table are compared, and the first part associated with the matched value And a cryptographic key analysis step of analyzing the cryptographic key by calculating a solution of the elliptic curve discrete logarithm problem based on the value of the second part and the value of the second part . The first calculation step is performed when a value satisfying a predetermined condition among values obtained by applying automorphism mapping to a part of the power-source part of the generation source and a value of the first part are changed in a predetermined range. A value combined with a value calculated by raising the power of the generator is stored in the first table, and the second calculation step applies an automorphism mapping to a part of the power of the generator Among the values, a value obtained by combining a value satisfying a predetermined condition and a value calculated by raising the generation source when the value of the second portion is changed in a predetermined value range is the second table. The encryption key analysis method according to claim 1 , wherein the encryption key analysis method stores the encryption key. The dividing step divides the power-source part of the generation source into an upper part and a lower part, and divides the upper part and the lower part into a first part and a second part, respectively, and the second computing step includes the upper part the second portion or to one of either the second portion of the lower portion, encryption key analysis method according to claim 1 or 2, characterized by applying the automorphism mapping. A dividing unit that indicates a solution of the elliptic curve discrete logarithm problem as a power of a generator corresponding to a point on the elliptic curve, and divides the power part of the generator into a first part and a second part;
A first calculation unit that associates and stores in the first table a value of the first part that changes in a predetermined range and a value calculated by raising the power of the generation source by the value of the first part ;
The value of the second part that changes in an area different from the area where the value of the first part changes and the value of the automorphism map corresponding to the value of the second part are stored in the second table in association with each other . A second computing unit;
The value calculated by raising the generator stored in the first table to a power and the value of the automorphism stored in the second table are compared, and the first part associated with the matched value And an encryption key analysis unit for analyzing the encryption key by calculating a solution of the elliptic curve discrete logarithm problem based on the value of the second part and the value of the second part . A dividing procedure for indicating to the computer a solution of the elliptic curve discrete logarithm problem by a power of a generator corresponding to a point on the elliptic curve, and dividing the power part of the generator into a first part and a second part;
A first calculation procedure for associating and storing in the first table a value of the first part that changes in a predetermined range and a value calculated by raising the power of the generator by the value of the first part ;
The value of the second part that changes in an area different from the area where the value of the first part changes and the value of the automorphism map corresponding to the value of the second part are stored in the second table in association with each other . A second calculation procedure;
The value calculated by raising the generator stored in the first table to a power and the value of the automorphism stored in the second table are compared, and the first part associated with the matched value And a cryptographic key analysis procedure for analyzing the cryptographic key by calculating a solution of the elliptic curve discrete logarithm problem based on the value of the second part and the value of the second part .

Images