KR100742093B1 - A method for calculating a polynomial convolution operation for ntru encryption and decryption - Google Patents

Abstract

A method for calculating a polynomial convolution operation for NTRU encryption and description is provided to improve a speed of a polynomial convolution operation by using a previously stored value in place of an addition calculation when using a simple pattern in the convolution operation. A method for calculating a polynomial convolution operation for NTRU encryption and description includes the steps of: selecting coefficients of a second polynomial as binary coefficients; searching simple patterns having two '1' and a predetermined number of '0' between the two '1'; classifying the simple patterns according to the number of '0'; calculating and storing the coefficients of a first polynomial and all combination values; and performing convolution operations of the first polynomial and the second polynomial by referring values stored corresponding to the specific simple pattern.

Description

A METHOD FOR CALCULATING A POLYNOMIAL CONVOLUTION OPERATION FOR NTRU ENCRYPTION AND DECRYPTION}

1 is a diagram illustrating a simple form of an algorithm implementing the polynomial convolution calculation method proposed by Bailey et al.

2 is a diagram showing a simple form of an algorithm implementing the polynomial convolution calculation method according to the present invention.

<Explanation of symbols for main parts of the drawings>

Algorithm 1: Algorithm Implementing Conventional Polynomial Convolution

Algorithm 2: Algorithm Implementing Polynomial Convolution Calculation Method According to an Embodiment of the Present Invention

The present invention is a polynomial convolution operation method that can be used in NTRU encryption and decryption. More specifically, the coefficients of the randomly selectable polynomial are selected as binary coefficients, and then the predetermined number of ' Simple patterns containing two '1's with' 0 'are searched so that' 1 'is not shared with each other, and all the corresponding combination values are precomputed and stored, and the simple pattern in the actual convolution operation When used, the present invention relates to a method that can greatly speed up polynomial convolutional operations in NTRU encryption and decryption by substituting addition calculations by referring to previously stored values.

The NTRU cryptosystem, currently considered an IEEE P1363.1 standard, is a public key cryptosystem for polynomial rings, whose security is based on hard problems over lattices. Since the introduction of NTRU cryptography, a digital signature scheme using an NTRU grid called NTRUsign has also been proposed. Since Coppersmith and Shamir proposed an attack on NTRU using a lattice basis reduction algorithm, various attempts have been made to break NTRUencrypt and NTRUsign. However, none of these attempts found a significant weakness in the lattice problem used in NTRU.

On the other hand, extensive research on the efficient implementation of NTRU has been continued. Hoffstein and Silverman proposed using a special form of polynomial to reduce computations while maintaining NTRU security, and Bailey et al. Demonstrated that NTRU can be effectively implemented on resource-limited devices. Recently, Gaubatz, Kaps and Sunar proposed a hardware implementation of NTRU using only 3,000 gates or less, proving that it is possible to use public key cryptography on sensor nodes. Although these efforts have greatly reduced the amount of computation required to implement NTRU, there is still a need to reduce the computation of NTRU. In particular, there is a need to reduce the amount of computation for polynomial convolution operations, which account for the largest portion of the computation of NTRU.

The present invention derives from the recognition of this need and, on the basis of the fact that certain sub-operations are frequently repeated in polynomial convolution operations involved in NTRU encryption and decryption, greatly reducing the amount of computation. The objective is to propose a new method for reducing polynomial convolution.

Polynomial convolution calculation method for NTRU encryption and decryption, according to a feature of the present invention for achieving the above object,

In NTRU encryption and decryption, as a convolution operation method of a first polynomial (corresponding to a 'public key' or 'password') and a second polynomial that can be arbitrarily selected,

(1) a first step of selecting randomly selectable coefficients of the second polynomial as binary coefficients ('0' or '1');

(2) a simple pattern including two '1's in a bitstring enumerating the binary coefficients selected in the first step and having a predetermined number or less' 0's between the two '1s' searching for patterns) so that they do not share '1' with each other;

(3) a third step of classifying the simple patterns searched in the second step according to the number of '0's included;

(4) a fourth step of, for each simple pattern classified in the third step, pre-calculating the coefficients of the first polynomial and all possible combination values and storing the values; And

(5) In a convolution operation of the first polynomial and the second polynomial, when a specific simple pattern is used, the calculation is performed by referring to a stored value corresponding to the specific simple pattern in the fourth step. Including the fifth step is characterized in its configuration.

Preferably, in the third step, when the number of simple patterns belonging to a specific classification is one, the specific classification may be deleted.

More preferably, in the second step, the predetermined number may be set to four.

Hereinafter, with reference to the accompanying drawings, it will be described in detail an embodiment of the present invention.

Polynomial Convolution  calculate( polynomial convolution operation )

로 정의한다. R에 속하는 원소 a는 다항식 또는 벡터로서 다음 수학식 1과 같이 적을 수 있다.Let Z be a set of integers. The polynomial ring for Z, represented by Z [X], is the set of all polynomials with coefficients of Z. Quotient ring R

Defined as The element a belonging to R is a polynomial or a vector and may be written as in Equation 1 below.

)는, 다음 수학식 2와 같이 표시되는 계수를 갖는다.Convolution product c () for elements a and b belonging to R

) Has a coefficient represented by the following expression (2).

이기 때문이다.here,

Because it is.

In principle, this operation requires N ² integer multiplications, which is expensive. However, polynomial convolutional operations used by NTRU generally have either small coefficients a or b, so the calculation of a * b can be performed very quickly.

2. NTRU  Public-key cryptosystem

There are many different types of NTRU cryptosystems, but the improved version proposed by Hoffstein or Bailey can be explained as follows:

NTRU has three public parameters (N, p, q), where p and q have a greatest common divisor of 1 and p &lt; q.

The coefficients of the polynomial are reduced to mod p or q.

을 만족하는 다항식으로서 정의된다.The inverse of mod q of polynomial f represented by f ⁻¹ mod q is

It is defined as a polynomial that satisfies.

The working draft of the IEEE P1363.1 standard proposes some typical sets of parameters for NTRU, one of which is (N, p, q) = (251, 2, 197).

2.1 Key Generation Key Generation )

와

을 계산한다. 여기서, mod q는 다항식 내의 모든 계수가 mod q로 감산됨, 즉 q로 나눈 나머지로 계산됨을 의미한다. 개인 키(private key)는 다항식 f이며, 공개 키는 다항식 h이다.Randomly select the polynomials F, g belonging to R and having small coefficients. After that,

Wow

Calculate Here, mod q means that all coefficients in the polynomial are subtracted by mod q, i.e., the remainder divided by q. The private key is polynomial f and the public key is polynomial h.

2.2 encryption ( Encryption )

을 계산한다.Let m be a polynomial that represents a message. Randomly selects N-1th order polynomial r with small coefficients, and ciphertext

Calculate

2.3 Decryption Decryption )

을 계산하되, a의 계수들이 A ≤ a_i < A + q를 만족하도록 선택한다. A의 값은 고정되며, 나머지 파라미터에 의존하 는 간단한 공식에 의해 결정된다. 그 후,

로서 평문(plaintext) m을 복구한다.first to decode e

Is calculated so that the coefficients of a satisfy A < a _i &lt; A + q. The value of A is fixed and determined by a simple formula that depends on the rest of the parameters. After that,

Restore plaintext m as

2.4 Validation of Decryption

Polynomial a calculated in 2.3 satisfies Equation 3 below.

Consider the final polynomial pr * g + m * f. By appropriately selecting the parameters, the coefficients can be adjusted to lie within an interval of length less than q. Therefore, we can recover a as in Equation 4 below.

That is, m ≡ a mod p because the exact equation holds, not for mod q.

3. Conventional Polynomials Convolution

The most time consuming part of NTRU encryption is the calculation of the convolution product r (X) * h (X) mod q. Similarly, the most time consuming part of NTRU decryption is the convolution product e (X) * f (X) ≡ e (X) + pe (X) * F (X), so convolution product e (X) * This part calculates F (X).

While the coefficients of the polynomials h (X) and e (X) are distributed almost randomly, r (X) and F (X) can control their shape by arbitrarily selecting coefficients. Thus r (X) and F (X) are often chosen to have binary coefficients, i.e. 0 or 1, so that the coefficients can be calculated without a multiplication operation. For example, if r (X) is a binary polynomial with Hamming weights HW (r), i.e., HW (r) 1s, then the computation of multiplication r (X) * h (X) mod q is approximately HW (r). Requires x N operations. Here, each operation is one addition and one modulo q subtraction. Therefore, if we can use r (X) and F (X) with low Hamming weights, the encryption and decryption procedure becomes very efficient. It should be noted, however, that too small values of HW (r) and HW (F) may impair security because the space for r and f becomes too small. In the draft standard of IEEE P1363.1, approximate values for HW (r) and HW (F) are given according to the choice of public key (N, p, q).

Bailey et al. Proposed an efficient polynomial convolution calculation method under the assumption that one of the two input polynomials has binary coefficients. 1 is a diagram illustrating a simple form of an algorithm implementing the polynomial convolution calculation method proposed by Bailey et al. In the algorithm proposed by Bailey et al. Shown in FIG. 1, c (X) ∈R is a general polynomial and a (X) ∈R is a binary polynomial with HW (a) = d. That is, a (X) denotes r (X) and F (X) in the NTRU. In the algorithm shown in FIG. 1, the sixth row is repeated dN times, requiring two additions each time (one for the addition of c _k , the other for the calculation of index k + b [j]). On the other hand, row 10 is repeated N times, requiring two additions each time and one module subtraction. Thus, the total number of operations required for the algorithm shown in FIG. 1 is exactly 2 (d + 1) N additions and N modulo subtractions.

4. Improved polynomial Convolution

Now, the improved polynomial convolution calculation method according to the present invention will be described in earnest.

4.1 Basic Idea

Start by examining the structure of polynomial convolution operations. The convolution product t∈R of a∈R and c∈R has the same coefficient as Equation 5 below.

Since t may also be represented as a vector, the polynomial convolution operation may be written again as a matrix form as shown in Equation 6 below.

From the N × N matrix of Equation 6, it can be observed that each row is created by rotating the previous row by one position to the right.

을 가지며, N = 10, d = 6인 간단한 예를 생각해 보기로 한다. 단순화를 위해, 이진 다항식을 비트 스트링(bit string)으로서 적기로 하자. 이에 따르면, a(X)는 0110011011로서 다시 적을 수 있으며, a(X) * c(X)는 다음 수학식 7과 같이 적을 수 있다.Binary polynomials for ease of understanding

Let's consider a simple example where N = 10 and d = 6. For simplicity, let's write a binary polynomial as a bit string. According to this, a (X) may be rewritten as 0110011011, and a (X) * c (X) may be written as Equation 7 below.

로서 계산될 수 있으며, 6번의 덧셈을 필요로 한다(여기서는 설명의 편이를 위해, 인덱스 계산과 모듈로 q 감산에 대한 비용은 고려하지 않음). 이들 덧셈 중, 우리는 c₁ + c₂의 항에 집중할 필요가 있는데, 이 항은 t₃과 t₇의 계산에서도 발생한다는 것을 확인할 수 있다. 이것은 패턴 '11'이 a(X)의 이진 표현에서 3번 반복되기 때문이다. 정확하게는, t₀, t₃, t₇의 계산에서 c₁ + c₂는 a(X) = 011 ₁ 0011 ₂ 011 ₃ 에서 각각 11 ₃ , 11 ₁ , 11 ₂ 에 해당한다. 항 c₁ + c₂가 3번 발생하므로, 우리는 이 항을 단지 한 번만 계산하고 그 값을 룩업 테이블(look-up table)에 저장한 후 그 값이 요구될 때 재사용함으로써, 덧셈의 수를 2만큼 감소시킬 수 있다. 이와 같은 감소는 패턴 ‘11’과 관련된 다른 항들에서도 적용될 수 있다. 예를 들어, t₁, t₄, t₈의 계산에서는 항 c₂ + c₃이 발생하고, t₂, t₅, t₉의 계산에서는 항 c₃ + c₄가 발생하며, t₃, t₆, t₀의 계산에서는 항 c₄ + c₅가 발생하는 식이다. 따라서 패턴 ‘11’에 의한 전체 절약은 2 x N = 20이 된다.Where t ₀ is

It can be calculated as, and requires six additions (for the sake of explanation, the cost of index calculation and modulo q subtraction are not taken into account here). Of these additions, we need to focus on the terms c ₁ + c ₂ , which can be seen in the calculation of t ₃ and t ₇ . This is because the pattern '11' is repeated three times in the binary representation of a (X). To be precise, c ₁ + c ₂ corresponds to 11 ₃ , 11 ₁ , 11 ₂ in a (X) = 0 11 ₁ 00 11 ₂ 0 11 ₃ in the calculation of t ₀ , t ₃ , t ₇ . Since the term c ₁ + c ₂ occurs three times, we compute this term only once, store the value in a look-up table, and reuse the value when needed, so we can add the number of additions. Can be reduced by 2. This reduction can be applied to other terms related to the pattern '11'. For example, the term c ₂ + c ₃ occurs in the calculation of t ₁ , t ₄ , t ₈ , and the term c ₃ + c ₄ occurs in the calculation of t ₂ , t ₅ , t ₉ , and t ₃ , t _In the calculation of ₆ , t ₀ , the term c ₄ + c ₅ occurs. Thus, the overall savings by the pattern '11' is 2 x N = 20.

Note that the idea can also be applied to other patterns such as '101', '1001', '111', etc. if one can find these patterns so as not to share '1' in the binary representation of the polynomial. do.

In general, if a pattern containing n '1's occurs n times in a binary representation of a polynomial with N coefficients, then the number of integer additions is given as N (m−) as the cost of memory for storing N temporary integers. It can be easily seen that it can be reduced by (n-1). Therefore, finding a pattern that contains a large number of '1's and occurs multiple times is important to save computations.

4.2 Pattern Search

The pattern retrieval method proposed by the present invention considers only patterns having a number less than or equal to zero (including zero) between two 1s, that is, '11', '101', '1001', and the like. Patterns containing '1' are not searched. The analysis and experimental results that underlie these decisions are presented below. First define the distance between two bit positions as the difference in index for each position. For example, the distance between two '1's in string 1001 is three. In this case, assuming that the coefficients of the binary polynomials are selected by independently repeating the operation of selecting one bit according to a distribution having a probability that '1' is selected, p for a distance Z between two adjacent '1's. Equation 8 can be easily proved.

Pr [Z = d] = (1-p) ^d-1 p

According to the aforementioned draft standard of IEEE P1363.1, the binary polynomials F (X) and r (X) are arbitrarily chosen such that dF and dr coefficients are 1, and the remaining coefficients are 0. This situation is not exactly the same as the assumption for the polynomial coefficient selection method above, but approximating p ≒ dF / N or p ≒ dr / N shows a behavior similar to the actual distribution. Table 1 shows the distribution of the distance d between two adjacent 1s in the polynomial F (X) and polynomial r (X). Table 1 shows the experimental results using the parameter values presented in the draft of IEEE P1363.1. It can be seen that the value is almost equal to the values predicted from Equation 8 (where p = dF / N = dr / N).

Parameter set (N, dF = dr) d = 1 d = 2 d = 3 d = 4 d = 5 d = 6 ees251ep6 (251, 48) 0.191 0.156 0.126 0.101 0.083 0.066 ees347ep2 (347, 66) 0.191 0.155 0.125 0.102 0.082 0.067 ees397ep1 (397, 74) 0.186 0.152 0.124 0.101 0.082 0.067 ees491ep1 (491, 91) 0.186 0.152 0.123 0.101 0.082 0.067 ees587ep1 (587, 108) 0.184 0.151 0.123 0.101 0.082 0.067 ees787ep1 (787, 140) 0.177 0.147 0.120 0.099 0.081 0.067

Equation 8 and Table 1 show that for the actual parameter sets given in the standard draft of IEEE P1363.1, the distance between two adjacent ones is less than five with a probability of nearly two thirds. Thus, patterns such as '11', '101', '1001', '10001', and '100001' cover significant positions of F (X) and r (X), resulting in a method according to the present invention. It can be seen that a significant speedup can be expected (if the number of '0's included between two adjacent'1's is 4 or less). These patterns are defined as simple patterns each having a length of 2 to 6. On the other hand, patterns containing more than two 1 occur so rarely that it is not necessary to consider these patterns. For example, the probability that the next two bits are all 1 for a fixed position of '1', that is, the probability of creating a pattern '111', is very small, p ² ≒ 0.037 for N = 251 and d = 48. As the number of 1s included in the pattern increases, the probability has a smaller value.

Therefore, when one of the two operands of the convolution operation is a binary polynomial, the binary polynomial is represented as a bit string and then the simple patterns '11', '101', '1001', '10001' and '100001' are found. Storing the location of can be used for the computational savings method described in 4.1. Specifically, an array storing the indices of the rightmost positions where the simple patterns '11', '101', '1001', '10001', and '100001' appear in the bit string representing the binary polynomial is b ₁ , b ₂ , Let b ₃ , b ₄ , and b ₅ (define the leftmost position of the bit string at index 0). However, since there may be an isolated '1' in the bit string that cannot be paired with a simple pattern because the distance from the adjacent '1' is far, let 'b' define an array storing these positions as b ₀ . If the number of '1' in the bit string is d and the number of elements in the array b _i (0 <= i <= 5) is d _i , the following equation (9) is established.

d = d ₀ + 2 (d ₁ + d ₂ + d ₃ + d ₄ + d ₅ )

For example, the bit string '10000110010001001010101110001000001' with N = 35 may be divided into '100001 1001 000 1001 0 101 0 11 10001 00000 1', where the arrays b _i and d, d _i The values are determined as follows.

b ₀ = [34], b ₁ = [23], b ₂ = [20], b ₃ = [16, 9], b ₄ = [28], b ₅ = [5]

d = 13, d ₀ = 1, d ₁ = 1, d ₂ = 1, d ₃ = 2, d ₄ = 1, d ₅ = 1

4.3 New Polynomials Convolution  algorithm

Given a position for simple patterns by the pattern retrieval method presented in 4.2, a new polynomial convolution calculation method according to the present invention can be used. 2 is a diagram illustrating a simple form of an algorithm implementing the polynomial convolution calculation method according to the present invention. The algorithm according to the present invention may be regarded as an improved version of the algorithm implementing the polynomial convolution calculation method proposed by Bailey et al. This improved algorithm takes as input the positions of the simple patterns retrieved from the bit string representation of the binary polynomial a (X) by the pattern retrieval method presented in 4.2, and also accepts the convolution t (X) as input. ) = a (X) * c (X) However, in order to make the algorithm more general, the parameter w is added, which indicates the maximum length of the pattern to be searched by the pattern search method in 4.2. That is, when searching for the simple patterns' 11 ',' 101 ',' 1001 ',' 10001 ', and' 100001 'as described in 4.2, and ignoring a pattern having five or more consecutive zeros between adjacent'1's, w = 6 In addition, to simplify the technique, a simple pattern is written as p ₁ = '11', p ₂ = '101', p ₃ = '1001', p ₄ = '10001', p ₅ = '100001'. In addition, an isolated '1' not included in the simple pattern was denoted by p ₀ . In the algorithm of Fig. 2, rows 1 to 8 are precomputation steps and require integer addition of 2 (w-1) N + (w-1) times including index calculation. On the other hand, rows 9 to 26 of the algorithm shown in FIG. 2 are convolution steps, which require 2 (d ₀ + d ₁ +… + d _{w −1} + 1) N additions and N modular subtractions. Shall be. Therefore, the total amount of calculation required for the algorithm shown in Figure _{2, 2 (d 0 + d 1} + ... + d w -1 + w) N + (w - 1) is the addition and subtraction of the number N single modular. Recall that the conventional algorithm shown in FIG. 1 required 2 (d + 1) N additions and N modular subtractions. Generally d ₀ + d ₁ +... Since + d _{w −1} + w is much smaller than d + 1, a significant speedup can be expected by the algorithm according to the invention shown in FIG. 2.

5. Experimental Results

When w = 5, i.e., using only the simple patterns '11', '101', '1001', and '10001', one embodiment of the present invention for various parameter sets given in the standard draft of IEEE P1363.1 Experimental results are shown in Table 2 below.

Parameter set (N, p, q, dF = dr) Existing Algorithm Algorithm according to the present invention encryption Decrypt encryption Decrypt ees251ep6 (251, 2, 197, 48) 1043 1045 766 783 ees347ep2 (347, 2, 269, 66) 1937 2001 1380 1392 ees397ep1 (397, 2, 307, 74) 2510 2523 1783 1796 ees491ep1 (491, 2, 367, 91) 3760 3796 2649 2650 ees587ep1 (587, 2, 439, 108) 5327 5379 3685 3742 ees787ep1 (787, 2, 587, 140) 9343 9419 6420 6408

Table 2 shows the performance of NTRU encryption and decryption operations on a Pentium 4 3.0 GHz CPU with 1.0 GB RAM. Show by comparison. The C language and the Microsoft Visual Studio .NET 1.0 environment were used. The third column and the fourth column of Table 2 indicate the time required for performing encryption and decryption using an existing algorithm, respectively, and the unit is microsecond (μsec). Columns 5 and 6 indicate the time required when using the algorithm according to the present invention. From the experimental results of Table 2, it can be seen that the algorithm according to the present invention improves the calculation speed by 25% to 32% compared to the conventional algorithm.

The present invention described above may be variously modified or applied by those skilled in the art, and the scope of the technical idea according to the present invention should be defined by the following claims.

According to the polynomial convolution calculation method of the present invention, after selecting the coefficients of the arbitrarily selectable polynomial as binary coefficients, the selected coefficients include two '1's having a predetermined number or less' 0' therebetween. Simple patterns are searched so that '1' is not shared with each other, and all the corresponding combination values are calculated and stored in advance. By substituting addition calculations, the speed of polynomial convolution operations in NTRU encryption and decryption can be greatly improved.

Claims (3)

In NTRU encryption and decryption, as a convolution operation method of a first polynomial (corresponding to a 'public key' or 'password') and a second polynomial that can be arbitrarily selected, (1) a first step of selecting randomly selectable coefficients of the second polynomial as binary coefficients ('0' or '1'); (2) a simple pattern including two '1's in a bitstring enumerating the binary coefficients selected in the first step and having a predetermined number or less' 0's between the two '1s' searching for patterns) so that they do not share '1' with each other; (3) a third step of classifying the simple patterns searched in the second step according to the number of '0's included; (4) a fourth step of, for each simple pattern classified in the third step, pre-calculating the coefficients of the first polynomial and all possible combination values and storing the values; And (5) In a convolution operation of the first polynomial and the second polynomial, when a specific simple pattern is used, the fourth step replaces the calculation by referring to a stored value corresponding to the specific simple pattern. 5th step How to include. The method of claim 1, In the third step, if the number of simple patterns belonging to a specific classification is one, the method of deleting the specific classification. The method according to claim 1 or 2, In the second step, setting a predetermined number to four.

Images