CN108650078A - A kind of accelerated method of SM9 id passwords algorithm - Google Patents

Abstract

The present invention designs a kind of accelerated method for the close SM9 id passwords algorithm of state, expand domain structure and specific mathematical property based on 12 times in algorithm, it increases substantially 12 times and expands element-specific square multiplication efficiency in domain, it is mainly used in the close SM9 id passwords algorithm software and hardware of state and realizes field, be to improve the method that password realizes efficiency using mathematical property.SM9 is a kind of id password algorithm based on elliptic curve to design of the close publication of state, its safety-critical is the bilinearity feature of elliptic curve pair, and Bilinear map operation mathematically needs base field and expands the algorithm on domain, the expansion domain used in SM9 designs is obtained by tower expansion, any primary operation expanded on domain is required for based on a large amount of base field operation, the specific structure that the present invention passes through Miller algorithm characteristics and tower expansion in research Bilinear map calculating process, increase substantially 12 realization efficiency for expanding element-specific square multiplication in domain, compared to the expansion domain square multiplication of basis 12 times, operation efficiency can be improved nearly 50%.

Description

acceleration method of SM9 identification cryptographic algorithm

The technical field is as follows:

the method is mainly applied to the field of realization of software and hardware of the SM9 cryptographic identification algorithm.

Background art:

the SM9 cipher identification cryptographic algorithm 12-time domain expansion square multiplication acceleration method is mainly based on two aspects:

the 1.12-time domain expansion adopts a tower type expansion structure:

based on finite field F_p1-2-4-12 tower type expansion structure:

(1)

(2)

(3)

wherein,

finite field F_pIs a finite field of modulo large prime number p, having a property p²≡1(mod 6)；

The reduction polynomial for the second expansion in the (1) th time is: x is the number of²-α，α＝-2；

The reduced polynomial for the second expansion at time (2) is: x is the number of²-u，u²＝α，

The reduced polynomial for the cubic expansion performed in (3) th time is: x is the number of³-v，v²＝u，

At the same time have omega³＝v。

2. Specific order of elements after Miller's algorithm in bilinear pairings:

the SM9 identification algorithm makes the element (p) at the end of Miller algorithm in the calculation process of elliptic curve pair²+1)(p⁶Power of-1), and expansion 12 times, as known from the tower-like expansion structureOf order p for any non-zero element in the domain¹²-1，

Due to the fact that

p¹²-1＝(p²+1)(p⁶-1)(p⁴-p²+1)

Then is done (p)²+1)(p⁶-1) the order of the elements raised to the power is (p)⁴-p²+1)。

The invention content is as follows:

based on the two backgrounds, the method for accelerating square multiplication operation of elements after Miller algorithm comprises the following steps:

note that the element α in the 12-degree extension field is a + b ω + c ω²Wherein a, b and c are elements in 4-time extension domain, and the notation of a is a₀+a₁v，Wherein a is₀，a₁Is an element in a 2-time expansion field, and the same applies to b and c

(1) Calculating a in 4-degree extension²AndcomputingMarking as A;

(2) calculating c in 4-degree extension²AndcomputingMarking as B;

(3) calculating b in 4-degree extension²AndcomputingMarking as C;

(4) finally α²＝A+Bω+Cω²。

Wherein,

and in the operation converted into the base domain, the ordinary square multiplication of 12 times needs 36 times of multiplication and 174 times of addition, and the improved square multiplication only needs 18 times of multiplication and 130 times of addition, so that the efficiency is improved by nearly 50%.

The analysis table of the operation efficiency of the square multiplication on the 12-time extension is as follows:

note that the 12-time spread element α ═ a + b ω + c ω²Wherein a, b and c are elements in 4-degree extension, if a ═ a₀+a₁v, then rememberWherein a is₀，a₁Is an element in 2-degree extension field, note α²＝A+Bw+Cw²。

Description of the drawings:

a flow chart of a 12-time domain expansion square multiplication operation.

The specific implementation mode is as follows:

as illustrated in fig. 1, let α be a + b ω + c ω²Wherein a, b and c are elements in 4-degree extension, if a ═ a₀+a₁v, then rememberWherein a is₀，a₁Is an element in a 2-time expansion domain

Calculation α²＝A+Bω+Cω²

Wherein,

specific analysis:

the 6 th order expansion group was constructed as follows:

where q is a positive integer and q ≡ 1(mod 6).

Order to

α＝(a₀+a₁v)+(b₀+b₁v)ω+(c₀+c₁v)ω²＝a+bω+cω²

Wherein

a＝a₀+a₁v

b＝b₀+b₁v

c＝c₀+c₁v

Then there is

α²＝a²+2abω+(2ac+b²)ω²+2bcω³+c²ω⁴

＝(a²+2bcv)+(2ab+c²v)ω+(2ac+b²)ω²

＝A+Bω+Cω²

Wherein

A＝a²+2bcv

B＝2ab+c²v

C＝2ac+b²

The observation and discovery

v^q＝v^2(q-1)/2·v＝ξ^(q-1)/2·v

Since (ξ)^(q-1)/2)²＝ξ^(q-1)1, and v²- ξ is a primitive polynomial, ζ^(q-1)/2＝-1

Then

v^q＝-v

ω^q＝ω^3(q-1)/3·ω＝v^(q-1)/3·ω＝v^2(q-1)/6·ω＝ξ^(q-1)/6·ω

Introducing 6-order unit root deltaI.e. delta⁶-1＝0，δ²-1≠0，δ³-1 ≠ 0, then

ω^q＝δ·ω

And is composed of

δ⁶-1＝(δ²-1)(δ⁴+δ²+1)＝0

δ⁶-1＝(δ³-1)(δ³+1)＝0

Is provided with

(δ⁴+δ²+1)＝0

(δ³+1)＝0

Due to the fact that

(a+bv)^q＝a+bv^q＝a-bv

If A is a + bv, it will be noted

If q is equal to p²When the expansion domain of degree 12 is regarded as polynomial expansion of degree 6, the element order after the outer power of miller cycle is (q)²Q +1), this element being denoted α, having

Namely, it is

Bringing the expression of upper α into

After expansion and combination, the right side of the equation is 0, and the left side polynomial ω polynomial constant term is:

the first item is as follows:

the second order term is:

the polynomial is 0, i.e. the coefficients of the terms are 0, which results in:

substituting the expression A, B and C into the expression:

。

Claims (1)

1. An acceleration method of SM9 identification cryptographic algorithm is characterized in that for any one time of power operation of elements on 12 expansion fields required after Miller algorithm in bilinear pairing operation process, the acceleration power algorithm comprises the following steps:

note that the element α in the 12-degree extension field is a + b ω + c ω²Wherein a, b and c are elements in 4-time extension domain, and the notation of a is a₀+a₁v，Wherein a is₀，a₁Is an element in a 2-time expansion field, and the same applies to b and c

(1) Calculating a in 4-degree extension²AndcomputingMarking as A;

(2) calculating c in 4-degree extension²AndcomputingMarking as B;

(3) calculating b in 4-degree extension²AndcomputingMarking as C;

(4) finally α²＝A+Bω+Cω²。