KR20010000048A - Efficient and fast multiple points scalar multiplication method over elliptic curve using m-ary method - Google Patents

Abstract

PURPOSE: A constant times operating method of multiple points on an elliptic curve using an m-ary method is provided to reduce a less calculated amount than a Chamiere-ElGamal method. CONSTITUTION: Constants to be a secret and points to be operated as constant are selected on an elliptic curve. Each figure value of m-ary constants is arranged in a reference table of m row. Pre-calculated values are systematically stored in a storing device. Indexes corresponding to the order of the pre-calculated values are generated. Each m row of the reference table is operated 2¬m times. The 2¬m times operated results are mixed with the corresponding pre-calculated values.

Description

Constant Fast Computation Method of Multiple Points on Elliptic Curve Using M-ary Method {EFFICIENT AND FAST MULTIPLE POINTS SCALAR MULTIPLICATION METHOD OVER ELLIPTIC CURVE USING M-ARY METHOD}

The present invention relates to an implementation of a cryptographic system and a cryptographic protocol, and more particularly, to a method capable of processing multi-point operations at high speed in a public key cryptographic system based on an elliptic curve.

With the development of information and communication network, various information is exchanged through network. When a sender wants to deliver a valuable message through an e-mail or electronic document delivery system, the sender needs to check whether the right recipient has received the right information, and from the recipient's point of view, the message creator is the right sender. Mechanism is needed. One of the methods for effectively providing such a function includes a public key cryptosystem where each user has a secret key and a public key as two key information.

Public key cryptosystems generally rely on safety for computationally infeasible problems such as prime factorization problems or discrete logarithmic problems. For example, RSA public key cryptosystems rely on the security of the difficulty of prime factorization problems, and ElGamal public key cryptosystems rely on the safety of discrete algebraic problems on finite bodies.

However, since implementing a public key-based cryptosystem basically requires a large amount of time and memory, an efficient solution for a public key cryptosystem has been studied.

Recently, the elliptic curve public key cryptosystem based on the discrete algebra problem on the elliptic curve is known to be much more difficult than the solution of the discrete algebra problem on the finite body. Compared to the public key system based on the finite-discrete discrete algebraic problem, it has attracted much attention because it guarantees high security even with a small key size.

Implementing a cryptographic protocol based on public key cryptosystems requires a modular power operation that performs multiplication repeatedly. Especially in public key cryptosystems based on discrete algebraic problems on elliptic curves, multiplying multipoints by multiplying a few points on an elliptic curve with a constant that you want to keep secret is an important part of calculation. For example, the Elgarmal digital signature scheme implemented on the elliptic curve, the Digital Signature Standard (DSS) signature scheme, the signature verification portion of the Korean standard digital signature algorithm (KCDSA), and the elliptic curve. The key generation part of Cramer-Shoup's public key cryptographic algorithm, and the constant multiple of multiple points such as the decryption process and the signature verification part of the signature on the elliptic curve are essential. As the algorithm for the constant multiples of multiple points, the method that extends the binary technique proposed by Shamir and Elgarmal to the operation of multi-elements is most commonly used.

Various methods have been proposed until now because the constant multiple of the point on the elliptic curve is a very important calculation part in the implementation of digital signature and public key cryptography. They are binary methods that represent integers to be multiplied by a binary number and are multiplied by squares and multiplications, and m-ary methods that multiply by m squares with m numbers. In order to minimize the number of multiplications by representing integers as binary numbers, the binary window method is performed by dividing binary numbers into a window of a constant size. Signed binary window method for reducing the number of

However, a constant multiple of multiple points, for example, any point selected on an elliptic curve, Wow about " Operations such as ", where Wow Is a constant, Wow Is the point on the elliptic curve, There are not many heuristic solutions to the method. As a widely used method, the binary multipoint operation method proposed by Shamir and Elgarmal is used.

1 is a flow diagram illustrating a method for calculating a binary multipoint constant multiple of Shamir-Elgarmal.

In step 11, the combinations of possible multiple points on the elliptic curve are constructed and calculated. For example, two points, for example, a point ( )Wow ( When performing constant multiple operations of) Calculate the elliptic curve and store it in order.

Here, the point O is the same as the identity circle in the calculation of the elliptic curve group, and may be represented as an infinite origin or a coordinate value (0, 0), and the point ( )Wow ( ) Is a randomly selected point on the elliptic curve. ) And ( ) May be indicated. Elliptic curve defined on GF (p) If (P + Q) is expressed by the following equation.

Then, the constant table is calculated by representing the constants that you want to keep secret in binary (step 12). For example, two points on an elliptic curve , ) Is selected, and the constants to be multiplied are 12 and 5, the constant multiply is " ", , It is represented by, to create a constant table as shown in Table 1.

One One 0 0 0 One 0 One

Now, in Table 1, the index (I) is formed by representing the number of binary value entries of each column in decimal form from the first column to the last column of binary values (step 13). In this case, the entry values in the index , , , Becomes

Then, the process of initializing the index values (step 14), and doubling operations in each column from the first column of the constant table 1 are performed to find the points with indices that match the order of the points stored in the precomputation. Add (step 15). That is, since the index value of the first column is "1", the corresponding precomputed value " To double the " ". The index value of the next column is" 3 ", so this index corresponds to" "And calculated earlier" In addition to " "Calculate. Double this point again," "After you get the point that corresponds to the index in the same way" "And double again by" ". The point corresponding to the index of the last column is" "Because the final result plus "Is obtained (step 16).

The above-described method for calculating a binary multipoint constant multiple of Shamere-Elgarmal can perform an efficient calculation than adding a constant multiple for each point when calculating a multipoint. However, since the constants to be multiplied are expressed in binary, the Hamming weight of the binary number that can be expressed generally corresponds to 1.5 times its length, thereby increasing the calculation unit. This is because the amount of computation of the constant multiple operations depends mainly on the length of the constant when expressed in binary.

It is therefore an object of the present invention to provide a multi-point constant multiplication operation method that requires less computation than the method of Shamir-Elgarmal.

In order to achieve the above object, a method for calculating a multipoint on an elliptic curve according to the present invention is to be kept secret. Constants ( ) And each constant Points ( Selecting on the elliptic curve; Arranging each digit of the m-number constant, the constants of which are respectively expanded in m (= 2 ^k ) notation, in a reference table of m columns; Sequentially storing pre-calculated values (Q _i ), which are generated by pre-calculating the 2 ^ml P _i values and the sum of these values for i values, in storage means; Generating _m indexes (I _m ) corresponding to the order of precomputed values (Q _i ) stored in the storage means; Characterized in that it comprises the step of mixing operations with the pre-calculated value (Q _i) corresponding to the reference table every m columns, each 2 ^m times calculated and indexes of each of 2 ^m times the calculation result (I _m).

1 is a flowchart illustrating a multipoint multiplication operation using a typical binary method;

2 is a block diagram of a public key cryptosystem used in the present invention;

FIG. 3 is a flow chart illustrating a multipoint multiplication operation on an elliptic curve using the m-based method in the public key cryptosystem illustrated in FIG.

<Explanation of symbols for main parts of drawing>

100: encryption device 200: decryption device

220: key generation unit 240: decryption unit

260: Reference Table 280: Memory

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is a schematic block diagram of a public key cryptosystem used in the present invention. The public key cryptosystem includes a cryptographic apparatus 100 on the sender side and a decryption apparatus 200 on the receiver side. ) Includes a key generation unit 220 and a decryption unit 240.

The encryption apparatus 100 on the sender side and the decryption apparatus 200 on the receiver side use a public key encryption algorithm on an elliptic curve. The key generation unit 220 of the receiver side decryption apparatus 200 calculates a public key and a secret key based on an elliptic curve, and announces the public key and keeps the private key secret. In this case, the key generation unit 220 selects an arbitrary multipoint on the elliptic curve according to an elliptic curve-based encryption algorithm, and performs a multipoint constant multiplication operation by multiplying the selected multipoint with a secret constant desired to be secret. The secret constant is expanded in m (= 2 ^k ) notation and used to generate the secret and public keys. At this time, the public key is a value obtained by multiplying secret constants to multiple points.

The encryption apparatus 100 on the sender side encrypts the plain text message to be encrypted using the public key generated on the receiver side, and then transmits the encrypted ciphertext to the decryption apparatus 200 on the receiver side. The decryption unit 240 in the receiver side decryption apparatus 200 decrypts the cipher text provided from the sender 100 using a secret key corresponding to the public key generated by the key generation unit 220 and transmits the decrypted text from the encryption apparatus 100 on the sender side. Restore an original plain text message.

3 is a flowchart illustrating a process of performing a multi-point constant multiple operation based on an elliptic curve in the public key cryptosystem of FIG. 2.

The multipoint constant multiplication procedure of the present invention is described as follows with reference to FIGS. 2 and 3.

First, in step 110, the decryption apparatus 200 of the public key cryptosystem is a plurality of arbitrary on an elliptic curve. Points ( ), And keep it secret Secret constants Select). In this case, the result of the multi-point calculation by the key generation unit 20 ( ) Will be

In the next step 120, the decryption apparatus 200 of the public key cryptosystem is a secret constant ( ) Are each expressed in m (= 2 ^k ) notation to form a constant table as shown in Table 2 below in a reference table 260 of column m, which may be implemented as a lookup table memory.

..... ..... ... ... ..... ... .....

Next, as in step 130, the decoding apparatus 200 performs a precomputation value obtained by performing a precomputation using Equation 2 below. ) Are sequentially stored in the memory 280.

In Equation 2, to be.

Next, in decimal notation, the number combining each column from the first column to the last column of the constant table 2 arranged in the reference table 260 is displayed. (Step 140). This is expressed as in Equation 3 below.

Thereafter, the decoding apparatus 200 generates a multipoint operation result ( ) Is initialized as shown in Equation 4 below (step 150).

Next, the decoding apparatus 200 performs a double operation and a precalculated value (as shown in Equation 5 below). ), Then perform the mixed operation (step 160), and the resulting value ( ) ( (Step 170).

,

In order to help the understanding of the operation principle of the present invention described above, two points on the elliptic curve ( ) And multipoint computation with secret constants (127, 245) and the resulting value ( ), In other words An embodiment of calculating the following will be described.

(1) First, the secret constant and Is expressed as a quadratic number as follows, and precomputation is performed using Equation 1 described above. Precalculation result value ( Are sequentially stored in the memory 280.

,

(2) Secret Constant and Is constituted in the reference table 260 as an array of the following constant table 3.

One 3 3 3 3 3 One One

(3) In the constant table 3 arranged in the reference table 260 using the above equation (3), the value obtained by adding the entries of each column to the index value ( Is calculated as follows.

(4) Initialize with

(5) A multipoint operation is performed by using Equation 5 described above.

(6) generated as a result Will print

Therefore, according to the present invention, when the size of the defining field of the elliptic curve is assumed to be 160 bits, the number of operations can be reduced compared to the conventional Shamir-Elgarmal method. Table 1 and Table 2 show the maximum number of additions required for the calculation of the constant multiple of the double and triple points, respectively. Unlike the method of Shamir, in the present invention, Unfold in base. And in precomputation from Values and these values Precalculate the sum of the values. Since the constant is expressed in m-ary, the amount of computation in the constant multiplication of the actual points can be reduced. However, if you choose the base system that can be used to increase the amount of precomputation, you can benefit from the computational benefit over the method of Shamir.

Comparing with the conventional method for double point constant multiple operation Quaternary Octal Hexadecimal The present invention 251 271 449 Shamier-Elgarmal 320 320 320

Comparing with the conventional method for the triple point constant multiple operation Quaternary The present invention 299 Shamier-Elgarmal 324

Accordingly, it can be seen from the comparison tables 4 and 5 that there is a 22% computational gain in the quadratic method and 6% in the quadratic method even for the triple point operation.

Claims (4)

In a multipoint operation method on an elliptic curve in a public key cryptosystem, Want to keep secret Constants ( ) And each constant Points ( Selecting on the elliptic curve; Arranging each digit of the m-number constant, the constants of which are respectively expanded in m (= 2 ^k ) notation, in a reference table of m columns; ^Sequentially storing the 2 ^ml P _i values and the pre-calculated values (Q _i ) generated by pre-calculating the sum of these values for the i values in storage means; Generating _m indexes (I _m ) corresponding to the order of precomputed values (Q _i ) stored in the storage means; M comprises a mixing operation with the pre-calculated value (Q _i) corresponding to the reference table every m columns, each 2 ^m times calculated and indexes of each of 2 ^m times the calculation result (I _m) Multipoint Computation Method on Elliptic Curve Using the Decimal Method. The method of claim 1, wherein generating the index I _m is as follows. And generating entries by combining entries of m columns arranged in the m column reference table. The method of claim 2, wherein the mixed operation step, And multiplying the points having indices that match the order of the points stored in the pre-calculation step by 2 ^m . 2. The method of claim 1, wherein m is a positive integer greater than two.