CN102479171A - Method for realizing Eta bilinear pairings on supersingular curve in binary field - Google Patents

Abstract

The invention provides a method for realizing Eta bilinear pairings on a supersingular curve in a binary field. According to the implementation method, a square root calculation is eliminated and only multiple square calculations and modular multiplication calculations with fast calculating speed are added; therefore the Eta bilinear pairings on the supersingular curve in the binary field can be substantially accelerated and the calculating efficiency can be substantially improved.

Description

A kind ofly realize the right method of Eta bilinearity on the ultra singular curve of binary field

Technical field

The present invention relates to a kind of public key cryptography technology, relate in particular to a kind of right method of Eta bilinearity on the ultra singular curve of binary field that realizes.

Background technology

Bilinearity obtains extensive studies and application to have bilinear characteristics and non degenerate characteristic owing to it in recent years.Bilinearity is to just being used for attacking elliptic curve cipher system at first in cryptography, but obtained research and utilization based on the right cipher system of bilinearity with its distinctive advantage, and also uses gradually in industry member and to be developed.Many in the world normal structures are also formulating the right standard of bilinearity, like ISO/IEC 14888-3, and IEEE P1363.3 etc.The researcher has proposed many based on the right cryptography scheme of bilinearity; For example based on the encipherment scheme (identity-based encryption schemes) of identity; Short signature scheme (short signature schemes) is based on key agreement scheme (identity-based authenticated key agreement schemes) of identity etc.

Bilinearity has distinct advantages to the cipher system of structure, and for example the short signature scheme can significantly reduce the length of signing.The signature scheme that generally uses at present has RSA signature scheme and ECDSA ellipse curve signature scheme, but the shortcoming of these two kinds of signature schemes is that its signature length is longer, and short signature more is applicable to resource-constrained applied environments such as smart card, mobile phone, PDA.

Bilinearity is to there being two kinds of algorithms in the polynomial time, and promptly the Weil on the algebraic curve is to right with Tate.Concerning the curve of same security level, high many of the counting yield that the counting yield that Tate is right is more right than Weil, based on the right mutation Ate of Tate to more significantly being optimized with the right counting yield of Eta.The right calculating of bilinearity is very complicated, can realize that bilinearity is right in bilinearity comparatively fast on to friendly curve.Mainly contain following three types of curves:

$E\left(F_{p^m}\right):y^2=x^3+\mathrm{Ax}+B;$

$E\left(F_{2^m}\right):y^2+y=x^3+x+b;$

$E\left(F_{3^m}\right):y^2=x^3-x+b$

The curve that the present invention relates to is that high-efficient algorithm is that the Eta bilinearity is right on this curve of ultra singular curve

of binary field.The computing formula that the Eta bilinearity of binary field is right is:

Wherein

Mapping

Function g _P(x, y)=(x _P ²+ 1) (x _P+ x)+y _P+ y, function ψ (Q)=(x _Q+ s ², y _Q+ sx _Q+ t), and function l (x, y)=y+ λ (x+x _P)+y _P+ δ.It is thus clear that calculating [2 ^-j] P ' time, need carry out a large amount of square root calculations.

To implementation method, wherein implementation method is slightly different simultaneously for binary field parameter m value to the promptly corresponding following traditional E ta bilinearity of formula for above-mentioned Eta bilinearity, and this implementation method is an example with m ≡ 3mod8, and same conclusions is also arranged under other situation:

Traditional E ta bilinearity is to implementation method: binary field

In curve y ²+ y=x ³+ x+b (b ∈ F ₂), m ≡ 3mod8 wherein;

Input: P (x _P, y _P), Q (x _Q, y _Q), output: η _T(P, Q), performing step is:

1.u＝x _p+1

2.f＝u(u+x _Q)+y _P+y _Q+b+1+(u+x _Q+1)t+(u+x _Q)t ²

$3.\mathrm{Fori}=0\mathrm{to}\frac{m-1}{2}\mathrm{do}$

3.1.u＝x _P，x _P＝x _P ^1/2，y _P＝y _P ^1/2

3.2.A＝u(x _P+x _Q)+y _P+y _Q+x _P+(u+x _Q+1)t+(u+x _Q)t ²

3.3.f＝fA

3.4.x _Q＝x _Q ²，y _Q＝y _Q ²

$4.\mathrm{Return}{f}^{(2^{2m}-1)(2^m-2^{(m+1)/2}+1)}$

Need to calculate two square root calculations in above-mentioned 3.1 steps, the square root calculation on the binary field is very complicated.Below be typical implementation method:

Square root calculation implementation method on the binary field:

Input: binary field

In irreducible function p and element a, output: s=a ^1/2Modp.

$1,c=a^{2^{m-1}}\mathrm{mod}p;$

2、s＝c ²mod?p；

If 3 s equal a, the square root calculation result is c so; If s is not equal to a, " there is not square root in output information " so.

The step 1 of the square root calculation implementation method on the binary field is a Montgomery Algorithm, and this step operation is quite consuming time, approximately needs to calculate (m-1)/2 modular multiplication and (m-1) individual square operation.And traditional E ta bilinearity is to the 3.1st of implementation method gone on foot loop computation (m+1)/2 time, and therefore whole implementation method needs could accomplish for a long time.

Summary of the invention

The object of the invention provides a kind of right method of Eta bilinearity on the ultra singular curve of binary field that realizes; Adopt the square root calculation of removing in the implementation method; Only increase very fast square operation of a plurality of arithmetic speeds and modular multiplication, thereby it is right significantly to quicken on the ultra singular curve of binary field the Eta bilinearity.

A kind of right method of Eta bilinearity that realizes on the ultra singular curve of binary field comprises following content:

(1) makes variable i=(m-1)/2-j, computing function

(2) computing function $g_{\left[2^{-j}\right]P^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right);$

(3) make variable

calculate

$\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{\left(g_{\left[2^{-j}\right]p^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right)\right)}^{2^j}=\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{A_j}^{2^j}={\left(\mathrm{\Λ}{\left({\left(A_{(m-1)/2}\right)}^2{A}_{(m-3)/2}\right)}^2\mathrm{\Λ}\right)}^2{A}_0;$

(4) the Eta pairing result in the calculating binary field

$f_{T,P}\left(\mathrm{\ψ}\left(Q\right)\right)=l\left(\mathrm{\ψ}\left(Q\right)\right)\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{\left(g_{{[2}^{-j}]p^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right)\right)}^{2^j}.$

Binary field

In the ultra singular curve y of (m is the binary field parameter) ²+ y=x ³+ x+b (b ∈ F ₂) last 2 P (x _P, y _P) (x _pBe the x axial coordinate of a P, y _pY axial coordinate for a P) and Q (x _Q, y _Q) (x _QBe the x axial coordinate of a Q, y _QY axial coordinate for a Q), the Eta bilinearity to implementation method based on formula do

Function wherein

Mapping

Function g _P(x, y)=(x _P ²+ 1) (x _P+ x)+y _P+ y; Function ψ (Q)=(x _Q+ s ², y _Q+ sx _Q+ t), s is that scale-of-two expands the territory

In element, t is that scale-of-two expands the territory

In element, satisfy s ²+ s+1=0 and t ²+ t+s=0; Function l (x, y)=y+ λ (x+x _P)+y _P+ δ, as m ≡ 1, during 5mod8, variable λ=x _P, as m ≡ 3, during 7mod8, variable λ=x _P+ 1, as m ≡ 1, during 7mod8, variable δ=b, as m ≡ 3, during 5mod8, variable δ=b+1.

The utilization Galois field

In element x satisfy

Character, remove traditional E ta bilinearity to calculation step in the implementation method [2 ^-j] square root calculation of P ', it is right to obtain based on the quick Eta bilinearity of removing the square root calculation formula.

The parameter m of binary field comprises all positive odd numbers.Binary field

In ultra singular curve, comprise y ²+ y=x ³+ x+1 and y ²+ y=x ³+ x.

The formula that the Eta bilinearity is right does

The complex calculations step is the most

Wherein need a large amount of square root calculations to calculate

With

Make j=(m-1)/2-i, can original formula be optimized for

Only need square operation to calculate after then optimizing

With The time of square operation is to be far smaller than square root calculation in the binary field, and this computing carries out again repeatedly, and then this optimization can significantly reduce whole Eta bilinearity right computing time, only need make variable $A_j=g_{\left[2^{-j}\right]P^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right)$ Get final product.

Embodiment

Below in conjunction with embodiment quick Eta bilinearity on the ultra singular curve of binary field provided by the invention is carried out detailed description to implementation method.Wherein its implementation is slightly different simultaneously for binary field parameter m value, realizes in the instance with m ≡ 3mod8 being example, under other numerical value situation the generation same conclusions is arranged also.

The Eta bilinearity is described the implementation method flow process as follows on the ultra singular curve of detailed binary field:

Input: ultra singular curve y ²+ y=x ³+ x+b (b ∈ F ₂) last 2 P (x _P, y _P), Q (x _Q, y _Q)

Output: the Eta pairing is η as a result _T(P, Q)

1.u＝x _p+1

2.f＝u(u+x _Q)+y _P+y _Q+b+1+(u+x _Q+1)t+(u+x _Q)t ²

3.C＝1

$4.\mathrm{Fori}=0\mathrm{to}\frac{m-1}{2}\mathrm{do}$

4.1if(i＝0)v＝x _p，w＝y _p，else?v＝v ⁴，w＝w ⁴

4.2u＝v ²

$4.3\mathrm{if}((\frac{7m+1}{2}+i)\%4=1)$

A＝u(v+x _Q)+w+v+y _Q+u+x _Q+(u+x _Q)t+(u+x _Q+1)t ²

$\mathrm{elseif}((\frac{7m+1}{2}+i)\%4=2)$

A＝u(v+x _Q)+w+v+y _Q+1+(u+x _Q+1)t+(u+x _Q)t ²

$\mathrm{elseif}((\frac{7m+1}{2}+i)\%4=3)$

A＝u(v+x _Q)+w+v+y _Q+u+x _Q+1+(u+x _Q)t+(u+x _Q+1)t ²

else

A＝u(v+x _Q)+w+v+y _Q+(u+x _Q+1)t+(u+x _Q)t ²

4.4C＝C ²A

5.f＝Cf

$6.\mathrm{Return}{f}^{(2^{2m}-1)(2^m-2^{(m+1)/2}+1)}$

U wherein; V; W is the variable in the binary field

; F; A, C are that scale-of-two expands the variable in the territory

Following table compares for the operand of the quick Eta two-wire on the ultra singular curve of binary field of the present invention's proposition to implementation method and classic method.(since binary field in mould multiply by and square operation time be ten times even tens of times that mould adds computing; Therefore only consider mould take advantage of with square operation time; Ignore the operation time that mould adds temporarily; Wherein M representes that the mould in the binary field

takes advantage of, S represent in the binary field

square)

Table 1 classic method and fast method operand are relatively

Comparison from last table can draw; Be all a lot of greatly than the fast method that the present invention proposes at the operand of binary field and classic method; And when the binary field parameter m is big more (when safe class is high more), the odds for effectiveness of fast method is obvious more.

Generally speaking, in the binary field operation time of modular multiplication and square operation similar, therefore can obtain the efficient that the relative classic method of fast method in the following table 2 is promoted.

Table 2 fast method is raised the efficiency than classic method

Claims (4)

1. realize the right method of Eta bilinearity on the ultra singular curve of binary field for one kind, it is characterized in that comprising following content:

(1) makes variable i=(m-1)/2-j, calculate

(2) calculate

(3) order $A_j=g_{\left[2^{-j}\right]P^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right),$ Calculate

$\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{\left(g_{\left[2^{-j}\right]p^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right)\right)}^{2^j}=\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{A_j}^{2^j}={\left(\mathrm{\Λ}{\left({\left(A_{(m-1)/2}\right)}^2{A}_{(m-3)/2}\right)}^2\mathrm{\Λ}\right)}^2{A}_0;$

(4) calculate $f_{T,P}\left(\mathrm{\ψ}\left(Q\right)\right)=l\left(\mathrm{\ψ}\left(Q\right)\right)\underset{j=0}{\overset{(m-1)/2}{\mathrm{\Π}}}{\left(g_{{[2}^{-j}]p^{\′}}\left(\mathrm{\ψ}\left(Q\right)\right)\right)}^{2^j}.$

2. a kind of right method of Eta bilinearity on the ultra singular curve of binary field that realizes as claimed in claim 1 is characterized in that said binary field

In ultra singular curve y ²+ y=x ³+ x+b (b ∈ F ₂) last 2 P (x _P, y _P) (x _p, y _pY axial coordinate for a P) and Q (x _Q, y _Q) (x _Q, y _QY axial coordinate for a Q), the Eta bilinearity to implementation method based on formula do

Wherein

Mapping Function g _P(x, y)=(x _P ²+ 1) (x _P+ x)+y _P+ y, function ψ (Q)=(x _Q+ s ², y _Q+ sx _Q+ t), s is that scale-of-two expands the territory

In element, t is that scale-of-two expands the territory In element, satisfy s ²+ s+1=0 and t ²+ t+s=0, and function l (x, y)=y+ λ (x+x _P)+y _P+ δ, as m ≡ 1, during 5mod8, variable λ=x _P, as m ≡ 3, during 7mod8, variable λ=x _P+ 1, as m ≡ 1, during 7mod8, variable δ=b, as m ≡ 3, during 5mod8, variable δ=b+1.

3. a kind of right method of Eta bilinearity on the ultra singular curve of binary field that realizes as claimed in claim 1 is characterized in that the parameter m of said binary field

comprises all positive odd numbers.

4. a kind of right method of Eta bilinearity on the ultra singular curve of binary field that realizes as claimed in claim 1 is characterized in that said binary field

In ultra singular curve, comprise y ²+ y=x ³+ x+1 and y ²+ y=x ³+ x.