JP2001209315A - Elliptic curve square computing device, generating polynomial generator and program recording medium therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To increase the speed of the computations by reducing the number of times of multiplications. SOLUTION: A squaring computation of GF(qn-1) on a quadratic extension field GF(qn)=GF(qn-12) is conducted on GF(qn-1). In a quadratic generating polynomial x2+v1x+v0 on the GF(qn-1) which has bases α and β as solutions to A=A0α+A1β and A2=C0α+C1β, A0-A1, is computed using relationships v0=u2 and u exists GF(qn-1), (u/v1) is multiplied to obtain L5, computes (L5-A0)(L5+A0)→T0, computes (L5-A1)(L5+A1)→T1, computes -v1T0→C0 and -v1T1→C1 and outputs the results.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an arithmetic device on an elliptic curve used for implementing, for example, information security technology (elliptic curve encryption / signature, prime factorization).

[0002]

2. Description of the Related Art When realizing public key cryptography and digital signatures on an elliptic curve, most of the processing time is spent for k-times operations on the elliptic curve. In general, an elliptic curve defined on a finite field GF (q) is used for encryption and signature. This is E
/ GF (q). q is a prime number or a power of a prime number. In the conventional implementation method, a prime number or 2 ^m is often used for q, but the present invention considers a general finite field.

[0003] Addition to a point P on an elliptic curve can be defined. This is called "elliptical addition" to distinguish it from normal addition.
This is referred to as “ellipse doubling operation”. Both are finite fields GF (q)
It can be performed by combining the above addition, subtraction, multiplication and division. Usually, "elliptic addition" is used to compose a k-fold operation.
A method of combining "ellipse doubling operation" is used. Therefore, the operation on the elliptic curve is a finite field GF
(Q) can be reduced to addition, subtraction, multiplication and division, and speeding up these leads to speeding up operations on elliptic curves.

An elliptic curve operation is represented by GF (q_nThe rational expression on
Column R (x₀, X₁, ...) and x₀, X ₁ , ... is the value of GF
(Q_n) Input to the arithmetic unit and GF (q_n-1) And the sequence of operations on
GF (q_n-1) Hand over to arithmetic unit, GF
(Q_n-1) Operator inputs GF (q _n-2) And the above sequence of operations
Reduced to the data, GF (q_n-2) Pass it to the computing unit and
By repeating the same, GF (q₀) Calculated by the calculator
By outputting the result, that is, by successively expanding
And reduce the number of multiplications compared to the conventional elliptic curve calculation.
Japanese Patent Application No. 11-230123, "Sequential Expansion"
Elliptic curve calculation device and program recording medium using
Proposed.

In this case, GF (q_n-1) Of the m-th extension field G
F (q_n) = GF (q_n-1 ^m) On GF (q_n-1) To the computing unit
Input A = (A₀, A₁), Output A^Two 
= (C₀ , C₁) With GF (q_n) = GF
(Q_n-1 ^m) On the original GF (q_{n- 1}) Expressed by the above element
And bases are α and β (where α + β = −v₁)
And A = A₀α + A₁β, A^Two= C₀α + C₁β means all
GF (q_{n -1}) Above m-order irreducible polynomial
f (x) = x^Two+ V₁x + v₀And A^Two= (-A₀ ^Twov₁+ (A₀-A₁)^Two(V₀/ V₁)) Α +
(-A₁ ^Twov₁+ (A₀-A₁)^Two(V₀/ V₁It has been proposed to perform the operation of β). That is, as shown in FIG.
GF (q_n-1) A in the squarer 27B₀ ^Two→ L₀Calculate
GF (q_n-1) A in the subtractor 27C₀-A₁→ L₁Calculate
GF (q_n-1) A in the squarer 27D₁ ^Two→ L_Two, And
GF (q_n-1) L on the squarer 27E₁ ^Two→ L_ThreeAnd GF
(Q_n-1) -V with constant multiplier 27F₁L₀→ L _Four, And G
F (q_n-1) In the constant multiplier 27G, (-v₁)^-1(-V₀) L_Three
→ L_FiveAnd GF (q_n-1) -V with constant multiplier 27H₁
L_Two → L₆ And GF (q_n-1) L at the adder 27I_Four
+ L_Five→ C₀And GF (q_n-1) L at adder 27J_Five
+ L₆→ C₁To calculate A^Two= (C₀, C₁Get)

In this way, only three square operations and three multiple operations are required. In the elliptic curve calculation using the sequential expansion, an m-order expansion of GF (q _n-1 ) GF (q _n ) = GF (q
_n-1 ^m ) is performed using a polynomial basis, and the generator polynomial used for the polynomial basis must be irreducible. In the case of normal bases, when successively expanding, a generator of normal bases suitable for high-speed operation is defined for each expansion, so that an irreducible polynomial having all bases as solutions is defined and an irreducible polynomial is defined. Make a row of Therefore, when creating an irreducible polynomial, this solution must be a normal basis.

[0007]

One object of the present invention is to provide a G
F (q _n-1) of the m-th extension field _{GF (q n) = GF (} q n-1 m)
An object of the present invention is to provide an elliptic curve square arithmetic device capable of further reducing the number of multiplications of the GF (q _n-1 ) arithmetic unit of the above squarer and performing higher-speed arithmetic. It is another object of the present invention to provide a device for generating a generator polynomial for obtaining a basis suitable for successive expansion in an elliptic curve calculation device using successive expansion.

[0008]

According to the elliptic curve square operation device of the present invention, a GF having all bases as solutions is provided.
(Q _{n− 1} ) The upper m-order irreducible polynomial is expressed as f (x) = x ² + v ₁ x +
v ₀ , in particular v ₀ = u ² , u∈GF (q _i-1 ) is used, and A ² = C ₀ α + C ₁ β = v ₁ ((A ₀ −A ₁ ) (u / v ₁ ) −A ₀ ) ((A ₀ −A ₁ ) (u /
v ₁ ) + A ₀ ) α + v ₁ ((A ₀ −A ₁ ) (u / v ₁ ) −A ₁ ) ((A ₀ −
A ₁ ) (u / v ₁ ) + A ₁ ).

Further, the generator polynomial generator according to the present invention selects a generator polynomial candidate, checks whether the generator polynomial candidate is irreducible, and if not, selects the next generator polynomial candidate and performs the same operation. , If irreducible, use this,
A generator polynomial is generated in a similar manner for each expansion from GF (q _i ) to GF (q _{i + 1} ).

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Squarer (Normal Basis) This apparatus is an m-th order expansion of GF (q _{n -1} ) GF (q _n ) = GF
This is an example of a configuration of a squarer on (q _n-1 ^m ) by an arithmetic unit on GF (q _n-1 ). In this configuration example, m = 2, and an m- _th generation polynomial on GF (q _n-1 ) having all bases as solutions is represented by f
When (x) = x ² + v ₁ x + v ₀ , u such that v ₀ = u ²
This is an apparatus when -1GF (q _n-1 ) exists.

In this explanation and FIG.
(A ₀ , A ₁ ) and A ² = (C ₀ , C ₁ ) are the original GF (q _n-1 ) on GF (q _n ) = GF (q _n-1 ^m ) by the normal basis.
This is an expression based on the above element, and when the basis is α and β, it means A = A ₀ α + A ₁ β and A ² = C ₀ α + C ₁ β, respectively. The device 100 shown in the figure has GF (q _n ) = GF
GF for the input of the _element A = (A ₀ , A ₁ ) on (q _n-1 ^m )
(Q _n ) shows an example of the configuration of a device that outputs the element A ² on (q _n ).

When the operation of this apparatus is realized by a program, it is executed according to the flow shown in FIG. This GF
The (q _n ) self-multiplier 100 includes a GF (q _n-1 ) constant multiplier and G
F (q _n-1 ) adder, GF (q _n-1 ) subtractor, GF
(Q _n-1 ) multipliers and a controller 111 for controlling them,
And a memory 112. GF (q _n-1 ) subtractor 1
01 receives A ₀ and A ₁ as inputs and GF (q _n-1 ) constant multiplier 1
02 receives the output L ₁ of the subtractor 101, GF
The (q _n-1 ) adder 103 outputs A ₀ and the output L of the constant multiplier 102.
₅ , the GF (q _n-1 ) subtractor 104 receives A ₀ and L ₅ as inputs, the GF (q _n-1 ) adder 105 receives L ₅ and A ₁ as inputs, and GF (q _{n− 1)} the subtractor 106 inputs the L ₅ and _{a 1, GF (q n-} 1) multiplier 107 receives the output of the output subtracter 104 of the adder _{103, GF (q n-1} ) constant multiple The multiplier 108 receives the multiplier 107 as an input, and
The (q _n-1 ) multiplier 109 receives the output of the adder 105 and the output of the subtractor 106 as inputs, and outputs a GF (q _n-1 ) constant multiplier 1
10 receives the output of the multiplier 109 as an input.

This squarer 100 operates as follows. An input value A = (A ₀ , A ₁ ) is input and temporarily stored in the memory 112. Data required for the operation is read out from the memory 112, although not described below, and the operation result is stored in the memory 112. Step 1: The GF (q _n-1 ) subtractor 101 receives the input A ₀
Calculate the L ₁ ← A ₀ -A ₁ outputs an L ₁ against and A _1.

Step 2: GF (q _n-1 ) constant multiplier 10
2 calculates the _{L 5 ← (u / v 1} ) L 1 with respect to L ₁ in the input to output an L _5. Step 3: GF (q _n-1 ) adder 103 receives input L ₅ ,
By calculating L ₅ + A ₀ output to the A _0. Step 4: The GF (q _n-1 ) subtractor 104 receives the input L ₅ ,
Calculate the L ₅ -A ₀ and outputs it to A _0.

Step 5: GF (q _n-1 ) adder 105
Calculates L ₅ + A ₁ with respect to the input L ₅ and A ₁ and outputs the result. Step 6: The GF (q _n-1 ) subtractor 106 receives the input L ₅ ,
Calculate the L ₅ -A ₁ outputs to A _1. Step 7: The GF (q _n-1 ) multiplier 107 receives the input (L ₅
+ A ₀ ), (L ₅ −A ₀ ), and calculates and outputs T ₀ ← (L ₅ + A ₀ ) (L ₅ −A ₀ ).

Step 8: GF (q _n-1 ) constant multiplier 10
8 calculates the input _{(L 5 + A 0) (} L 5 -A 0) -v 1 against _{(L 5 + A 0) (} L 5 -A 0) is output as C _0. Step 9: The GF (q _n-1 ) multiplier 109 receives the input (L ₅
+ A _1), and calculates and outputs (L ₅ -A ₁₎ with respect to _{T 1 ← (L 5 + A} 1) (L 5 -A 1).

Step 10: GF (q_n-1) Constant multiplier 1
10 is the input (L_Five+ A₁) (L_Five-A ₁) For -v₁(L_Five + A₁) (L_Five -A₁) To calculate C₁ age
Output. Step11: (C₀, C₁) To A^TwoOutput as Generator Polynomial Generator The generator polynomial generator shown in FIG._n-1M) order
Expanded GF (q_n) = GF (q_n-1 ^m) Using a polynomial basis
Configuration example of a device for obtaining a generator polynomial used for performing
It is. This device 200 has a memory 20
2 and the irreducibility determination device 203 are connected to each other.

When the operation of this apparatus is realized by a program, it is executed according to the flow shown in FIG. Step 0: The control device 201 receives the input finite field GF
(Q _n-1 ) and the extension degree m are input. Also, j generator polynomial candidates f _i (x), (i = 1,..., J) are generated.
Initialize i to 0. It is checked whether i = j, and if i is not j, Step1: i is incremented by 1 and the input finite field GF (q
_n-1 ) Select the generator polynomial candidate f _i (x) above.

Step 2: Using the irreducibility judging device 203, it is checked whether or not f _i (x) is irreducible. Step 3: If irreducible, output f _i (x) as a generator polynomial g (x). If not, return to Step 1 and start over. The configuration of the irreducibility determination device 203 will be described later. Further, the configuration of this device may be the following configuration or a combination thereof.

When f (x) is a quadratic polynomial x ² + v ₁ x + v ₀ , in order to perform multiplication using a polynomial basis at high speed, candidates f _i in which v ₁ = −1 in Step ₀
(X) is generated. f (x) is a quadratic polynomial x ² + v ₁ x +
v The inverse or squared with polynomial basis in the case of ₀ for the purpose of performing a high speed, to produce a candidate f _i (x) to be v ₁ = 0 in Step 0.

In the case where f (x) is a quadratic polynomial x ² + v ₁ x + v ₀ , v ₁ = 0 and v ₀ = u ² are expressed in Step 0 for the purpose of quickly squaring using the polynomial basis. generating a candidate f _i (x) which can. Normal Polynomial Generating Apparatus The normal polynomial generating apparatus shown in FIG. 3 is a normal polynomial used for performing an m-order expansion of GF (q _n-1 ) GF (q _n ) = GF (q _n-1 ^m ) using a normal basis. 1 is a configuration example of an apparatus for obtaining the following. This device 300 includes a memory 30 in the control device 301.
2. The irreducibility determination device 303 and the regularity determination device 304 are connected and configured.

When the operation of this apparatus is realized by a program, it is executed according to the flow shown in FIG. Step 0: Input a finite field GF (q _n-1 ) and an expansion degree m. Generator polynomial candidate f _i (x), (i = 1,..., J)
Is generated, i is initialized to 0, and it is determined whether i = j.
If i is not j, Step1: a finite field GF (q
_n-1 ) Select the generator polynomial candidate f _i (x) above.

Step 2: Using the irreducibility judging device 303, it is checked whether f _i (x) is irreducible. Step 3: If the contract has not been made, return to Step 1 and start over. Step 4: If irreducible, the regularity determination device 304 is used to check whether f _i (x) is regular. (This checking method is described in, for example, "Cryptography / Zero Knowledge Proof / Number Theory", written by Tatsuaki Okamoto and Kazuo Ota, Kyoritsu Shuppan, pp. 167) Step 5: If not regular, return to Step 1 and start over. If it is regular, f _i as a generator polynomial f (x)
Output (x).

The configuration of this device may be as follows. f (x) is a quadratic polynomial x
^{In the case of 2} + v ₁ x + v ₀ , in order to quickly perform the square using the polynomial basis, v ₀ =
Generate f (x), which can be represented as u ² . Irreducibility determining device The irreducibility determining device shown in FIG. 4 is a configuration example of the irreducibility determining devices 203 and 303 in the devices shown in FIGS. The device 400 comprises a control device 401 and a polynomial Euclid reciprocal device 402.

When the operation of this apparatus is realized by a program, it is executed according to the flow shown in FIG. Definition field GF
(Q _n−1 ), the candidate f (x), and the expansion order m are input. g
(X) = (x ＾ q _n-1 ^m-1 ) -x Here A ^ B represents the A ^B. Next, the input polynomials f (x) and g (x) = (x ＾ q
The greatest common divisor polynomial with ( _n-1 ^m-1 ) -x is obtained, and if the greatest common polynomial is a zero-order expression, "irreducible" is output.

In the above, each device can be made to function by causing a computer to decode and execute a program.

[0027]

As described above, according to the square operation device of the present invention, only two multiplication operations and three constant multiplication operations are required.
The number of times of multiplication is one less than that shown in FIG. 9, and the calculation can be performed at a higher speed. In addition, it is possible to generate a generator polynomial of a polynomial basis used for the expansion in the successive expansion elliptic curve calculation.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of a GF (q _n ) squarer of the present invention.

FIG. 2 is a block diagram showing a polynomial basis generator polynomial generator according to the present invention.

FIG. 3 is a block diagram showing a normal polynomial generating apparatus according to the present invention.

FIG. 4 is a block diagram showing a configuration of an irreducibility determination device used in FIGS. 2 and 3;

FIG. 5 is a flowchart showing a GF (q _n ) square processing procedure in the embodiment shown in FIG. 1;

FIG. 6 is a flowchart showing a generating polynomial generating procedure of a polynomial basis in the embodiment shown in FIG. 2;

FIG. 7 is a flowchart showing a normal polynomial generation processing procedure in the embodiment shown in FIG. 3;

FIG. 8 is a flowchart showing an irreducibility determination processing procedure of the apparatus shown in FIG. 4;

FIG. 9 is a diagram showing a functional configuration of a previously proposed GF (q _n ) squarer.

 ────────────────────────────────────────────────── ─── Continuation of the front page (72) Hoshino Literature 2-3-1 Otemachi, Chiyoda-ku, Tokyo Nippon Telegraph and Telephone Corporation F-term (reference) 5B056 FF01 FF02 HH00 5J104 AA25 JA25 NA16 NA27

Claims (14)

[Claims] 1. A second-order extension GF (q _n ) = GF of a finite field GF (q _n-1 ) (q _n-1 is a prime number or a power of a prime number)
An elliptic curve square arithmetic device on (q _n-1 ² ), wherein an input A = (A ₀ , A ₁ ) and an output A ² = (C ₀ , C ₁ ) are GF (q _n ) = an element on GF (q _n-1 ² ) is represented by two elements on GF (q _n-1 ), A = A ₀ α + A ₁ β, A ² = C ₀ α + C ₁ β, α, β
Is a quadratic generator polynomial on GF (q _n-1 )
(X) = x ² + v ₁ x + v ₀ , v ₀ = u ² , u∈GF
A (q _n-1), by entering the A ₀ and A ₁ calculates the _{A 0 -A 1 → L 1 GF} (q
_n-1) for computing a subtraction unit, type L ₁ a _{(u / v 1) L 1} → L 2 GF (q
_n-1 ) A constant multiplying means, and GF (q which calculates A ₀ + L ₂ → L ₃ by inputting A ₀ and L _2
n-1 ) Addition means, GF (q which inputs A ₀ and L ₂ and calculates L ₂ −A ₀ → L _4
n-1 ) subtraction means, GF (q which calculates A ₁ + L ₂ → L ₅ by inputting A ₁ and L _2
n-1 ) Addition means, GF (q which inputs A ₁ and L ₂ and calculates L ₂ −A ₁ → L _6
n-1 ) subtraction means, and GF (q which calculates L ₃ × L ₄ → L ₇ by inputting L ₃ and L _4
n-1 ) Multiplying means, GF (q which calculates L ₅ × L ₆ → L ₈ by inputting L ₅ and L _6
n-1) multiplication means and, GF which enter the L ₇ calculates and outputs the -v ₁ L ₇ → C ₀
(Q _n-1) constant factor means and inputs the L ₈ calculates and outputs the -v ₁ L ₈ → C ₁ GF
(Q _n-1 ) constant multiplying means; 2. An apparatus for generating a generator polynomial used for performing an m-order expansion from a finite field GF (q _i ) (q _i is a prime number or a power of a prime number) to GF (q _{i + 1} ). Means for generating a generator polynomial candidate; selecting means for selecting one of the generator polynomial candidates f (x); checking means for checking whether the selected candidate f (x) is irreducible; If the checking means determines that it is irreducible, means for outputting the selected candidate f (x) as a generator polynomial, and if the checking means determines that it is not irreducible, the selecting means and the checking means are repeated. Means for generating a polynomial basis generating polynomial. 3. A generator polynomial generation apparatus according to claim 2 wherein is used from GF (q _i) on the secondary expansion of the GF (q i + _1), the means for generating the generator polynomial candidate v ₁ is X ² + v ₁ x + which is −1 (where v ₀ and v ₁ are elements of GF (q _i ))
An apparatus for generating a polynomial basis generating polynomial, which is means for generating a generating polynomial candidate of v ₀ . 4. A generator polynomial generation apparatus according to claim 2 wherein is used from GF (q _i) on the secondary expansion of the GF (q i + _1), the means for generating the generator polynomial candidate v ₁ is 0 (where v ₀ and v ₁ are elements of GF (q _i )) x ² + v ₁ x +
An apparatus for generating a polynomial basis generating polynomial, which is means for generating a generating polynomial candidate of v ₀ . 5. The generator polynomial generator according to claim 4, wherein the means for generating the generator polynomial candidate is such that v ₀ can be expressed as u ² (where u is an element of GF (q _i )). An apparatus for generating a polynomial basis generating polynomial, which is means for generating a candidate. 6. An apparatus for generating a generator polynomial used for performing an m-order expansion from a finite field GF (q _i ) (q _i is a prime number or a power of a prime number) to GF (q _{i + 1} ). Means for generating a generator polynomial candidate; selecting means for selecting one of the generator polynomial candidates f (x); first checking means for checking whether the selected candidate f (x) is irreducible When the first checking means determines that it is not irreducible, means for causing the selecting means to make a selection again, and when the first checking means determines that it is irreducible, the selected candidate f (x) is formed in a regular manner. A second inspection means for inspecting whether there is, a means for causing the selection means to make a selection again when the second inspection means determines that it is not regular, and a candidate f for which the second inspection means determines that it is irregular.
A generator for generating a normal basis. 7. The generator polynomial generating apparatus according to claim 6, GF (q _i) used in second expansion to GF (q i + ₁₎ from the means for generating the generator polynomial candidate v ₀ = u ² (where u is an element of GF (q _i )), which is a means for generating a generator polynomial candidate that can be expressed as x ² + v ₁ x + v ₀ , wherein a generator polynomial generator for a polynomial base is provided. . 8. An input A = (A ₀ , A ₁ ) and an output A ² =
(C ₀ , C ₁ ) is GF (q _n ) = G by the normal basis α, β
An element on F (q _n-1 ² ) is represented by two elements on GF (q _n-1 ) (q _n is a prime number or a power of a prime number), and A
= A ₀ α + A ₁ β, A ² = C ₀ α + C ₁ β, and a second-order generator polynomial on GF (q _n−1 ) having α and β as solutions is f (x)
= X ² + v ₁ x + v ₀ , v ₀ = u ² , u∈GF (q _n-1 )
And input A and output A ² finite field GF (q
to _n-1) of the quadratic extension _{GF (q n) = GF (} q n- 1) of the elliptic curve squaring device on a computer, a process of inputting A ₀ and A _1, from the A ₀ and A ₁ A ₀₋ A ₁ → L ₁ , v ₀ , v _1, and L ₁ (u / v ₁ ) L ₁ → L ₂ , L ₂ , A and L ₂ + A ₀ → a process of calculating L ₃ , a process of calculating L ₂ −A ₀ → L ₄ from L ₂ and A, a process of calculating L ₂ + A ₁ → L ₅ from A ₁ and L ₂ , A ₁ a process of calculating the L ₂ -A ₁ → L ₆ from L ₂ Prefecture and, L ₃ and from L ₄ and the process of calculating the _{L 3 L 4 → L 7,} L 5 and from L ₆ L ₅ L ₆ → L ₈ and the process of calculating the a process of outputting the L ₇ and -v ₁ calculates the -v ₁ L ₇ → C _0, to compute the -v ₁ L ₈ → C ₁ from L ₈ and -v ₁ A recording medium on which a process for outputting and a program for executing are executed. 9. A polynomial basis for generating a generator polynomial used to perform m-order expansion from a finite field GF (q _i ) (q _i is a prime number or a power of a prime number) to GF (q _{i + 1} ^m ) Generating polynomial candidate generating processing for generating a generating polynomial candidate, selecting input processing for selecting and inputting a generating polynomial candidate f (x), and selecting and inputting the candidate f (x) Inspection processing for inspecting whether or not the above is satisfied. If the result of the inspection processing is irreducible, the candidate f (x) is output as a generator polynomial. A recording medium on which is recorded a program for executing a process of returning to and executing. 10. A recording medium according to claim 9, used from GF (q _i) on the secondary expansion of the GF (q _{i + 1),} the generator polynomial candidate generation processing is v ₁ = 1 x ² + v ₁
x + v ₀ (where v ₀ and v ₁ are elements of GF (q _i )), which is a process for generating a generator polynomial candidate. 11. The recording medium according to claim 9, which is used for quadratic expansion from GF (q _i ) to GF (q _{i + 1} ), and wherein the generator polynomial candidate generation processing is performed by x where v ₁ = 0. ² + v ₁
x + v ₀ (where v ₀ and v ₁ are elements of GF (q _i )), which is a process for generating a generator polynomial candidate. 12. The recording medium according to claim 11, wherein the generating polynomial candidate generating process includes v ₀ = u ² (where,
v _1, v _0, u is a recording medium which is a process of generating a _{^{x 2 + v 1 x + v}} 0 becomes generator polynomial candidates that can be expressed as the original) of GF (q _i). 13. Generation of a normal basis for generating a generator polynomial used for performing m-order expansion from a finite field GF (q _i ) (q _i is a prime number or a power of a prime number) to GF (q _{i + 1} ). The computer of the polynomial generation apparatus generates a generator polynomial candidate, generates a generator polynomial candidate, selects and inputs a generator polynomial candidate f (x), and selects and inputs the selected candidate f (x). A first check process for checking whether or not the candidate f (x) is regular if the result of the first check process is not irreducible; A second inspection process to be inspected, a candidate f (x) is output if the result of the second inspection process is irregular, and if not, the process returns to the selection input process. . 14. The recording medium according to claim 13, which is used for quadratic expansion from GF (q _i ) to GF (q _{i + 1} ), and wherein the generator polynomial candidate generation processing is expressed as v ₀ = u ^2. Generator polynomial candidate x ² + v ₁ x + v ₀ (where u is GF (q _i )
A recording medium characterized by processing for generating