JP2002082609A - Arithmetic unit using requested calculation, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an arithmetic unit for which security is ensured when a fast arithmetic operation is performed by using a requested calculation. SOLUTION: When obtaining an inverse element of secret information, an element of a finite field, a personal box 102 multiplies the secret information by a random number and requests a personal computer 101 to calculate the inverse element of the multiplication result. The personal box receives the calculation result from the computer 101, and then it calculates the inverse element of the secret information by multiplying the calculation result by the random number.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to encryption and decryption,
Alternatively, the present invention relates to an arithmetic device for realizing a digital (electronic) signature or the like using a request calculation.

[0002]

2. Description of the Related Art In recent years, various services have been provided by digitization of information, and a comfortable living environment has been improved. For example, with the proliferation of the Internet, a global information infrastructure, we can benefit from the services provided by servers connected to it around the world. 2. Description of the Related Art The spread of mobile phones has made it possible to communicate with other parties when necessary, and to use additional services other than telephone calls and to access desired information at any time. Credit cards and prepaid cards eliminate the hassle of exchanging cash. The wide-area networking of digitized information provides us with the above-mentioned convenience, but also makes it more susceptible to unauthorized use.
In other words, privacy infringement due to eavesdropping and unauthorized use of the system due to leakage, copying, falsification, spoofing of personal information, and the like. Cryptographic technology has attracted attention as a solution to avoid such unauthorized use. Above all,
Research and development of cryptographic techniques using operations on finite fields and elliptic curves have been actively conducted. For example, electronic payment using an IC card in which personal information is stored has attracted attention, but techniques such as electronic authentication and electronic signature have become important for electronic payment. Generally, IC cards have high-security electronic authentication and electronic signature functions,
Due to the size and power supply limitations of the card, the computational power of the CPU that can be installed is weak, and the huge amount of computation related to encryption, decryption, or digital signature for high security takes a very long time. I was Therefore, conventionally, it has been attempted to reduce the time required for the calculation by performing the request calculation. In addition, the request calculation here is a request to another device with a high calculation capability for calculation,
It is intended to shorten the calculation time by obtaining the calculation result. Here, as an example of an electronic signature performed by an IC card,
Explaining the case where the elliptical DSA algorithm is used, the signatures “r” and “t” are expressed by the following equations (1), (2),
It is required as in (3). Here, “k” is a random number created by the signer, “G” is a base point, “(x, y)” is a coordinate, “n” is an order of the base point G, and “e” is a hash of data to be signed. The value "s" is assumed to be the signer's private key.

(X, y) = [k] G (1) r = x mod n (2) t = k ^-1 × (e + s × r) mod n (3) In other words, the above equation (1) calculates a point obtained by adding the base point G of a set of points on the elliptic curve by the number of random numbers k created by the signer at coordinates (x, y). ). Less than,
[K] A calculation like G is called integer multiplication. Equation (2) is
The value of x at the coordinates is divided by the order n of the base point G to obtain a remainder r. Then, equation (3) is obtained by calculating the remainder r
And to those obtained by multiplying the secret key s of the signer, by adding the hash value e of the data that you want to sign, to which the value obtained by multiplying the inverse element k ^-1 of the random number k the signer make, position of the base point G The remainder t is obtained by dividing by the number n. The digital signature values "r" and "t" are generated from "r" and "t" obtained in this manner. In this series of operations, a portion requiring a particularly long processing time is an inverse element calculation part on a finite field for ^obtaining [k ^-1 ] and an integer multiplication part for a point on an elliptic curve for obtaining “[k] G”. Is mentioned.

[0004] In the following, inverse element calculation and integer multiplication will be described. First, the inverse element calculation will be described using a Galois field GF (p), which is one of the finite fields, as an example. Since the Galois field is well known, a detailed description is omitted, but a Galois field GF (p) having p as a prime number is a set of p elements, and is usually an integer of 0 or more and less than p. Be the representative. On the Galois field GF (p), two types of operations are defined, namely, addition and multiplication. The multiplication of the two elements a and b on the Galois field GF (p) on the Galois field GF (p) is performed by multiplying the elements a and b on integers and then dividing by the prime number p to obtain the remainder. Is done. That is, if c is a multiplication result, it can be described as c = abmod p. The inverse element calculation is a calculation for obtaining an element b that satisfies 1 = abmod p in an element a on a Galois field GF (p). In general, an exponential calculation method is used. It is represented by b = a ^-1 mod p. Taking the Galois field GF (p) as an example, the inverse can be obtained by a ⁻¹ = ^ap −2 mod p. However, it is well known that the prime number p requires a very long processing time because it is a very large number for ensuring safety. Next, integer multiplication will be described using a rational point group on an elliptic curve which is one of the groups as an example. Note that the rational point group on the elliptic curve is well-known, and therefore detailed description is omitted, but addition is defined as an operation. Using this addition, subtraction and integer multiplication are realized. That is, if rational points on an elliptic curve are P, Q, and R, and k is an integer, addition, subtraction, and integer multiplication are expressed as follows. Q = P + P ········ Addition Q = P + (− R) ······ Subtraction Q = [k] P ······ Integer multiplication However, P + (− R) = 0, in this case 0 is an additive unit element. Thus, integer multiplication is represented as Q = [k] P, which means Q = P + P +... + P (k Ps are added). Here, Q and P are rational points on an elliptic curve defined on a finite field, and k is an integer less than the order of the base point G. When k number of bits of the n, k is expressed as _{k = k n-1 · 2} n-1 + ··· + k 1 · 2 + k 0. The binary representation is, for example, k = (10100101... 0101). From this, conventionally, Q was determined as follows using a binary method which is a general method of integer multiplication. This will be specifically described with reference to the flowchart shown in FIG.

First, in step 501, a unit element 0 is substituted for Q (variable). In the following step 502, the variable i
Is substituted by a value obtained by subtracting 1 from n (= n-1). After that, it moves to step 503. In step 503,
It is determined whether the value of the variable i is smaller than 0. Its value is 0
If it is smaller, the determination is YES, a series of processing is completed, and Q is returned (the value of Q is determined). Otherwise, the determination is no and the process moves to step 504. In step 504, the value of a bit specified by the value of the variable i k k _i determines whether 1. If the value of k _i is not 1, the determination is NO, and step 50
5, the value obtained by adding the value to the previous value to Q (= Q +
Q) is substituted, and the value of the variable i is decremented in step 506, and the process returns to step 503. Otherwise, the determination is yes and Q
Then, the value (= Q + P) obtained by adding the value of P to the previous value is substituted for the value, and the process proceeds to step 505. In this manner, sequentially the value of the variable i, while decrementing the value of the bit k _i specified by the value of the variable i is performed summation the value of P to a value of Q 1, then the Q The operation of adding the value to the value is repeated from the most significant bit (k _n-1 ) to the least significant bit (k ₀ ). Thereby, the final value of Q was obtained. However, integer multiplication as described above
It is well known that a large amount of calculation requires a large amount of processing time as in the case of obtaining the inverse. The above-described integer multiplication and inverse element calculation can be performed at high speed by performing the above-described request calculation.

[0006]

However, in the encryption technology, a and k are usually secret information to be prevented from leaking. Therefore, if the request calculation is simply performed, the confidential information may be leaked. This means that security is reduced and is very undesirable. SUMMARY OF THE INVENTION It is an object of the present invention to provide an arithmetic device that ensures safety when performing an operation at high speed using a request calculation.

[0007]

The arithmetic devices using the request calculation according to the first to third aspects of the present invention are both mounted on a data processing device capable of communicating with an external device, and the calculation is performed by the external device. It is assumed that a request is made and an operation is performed using the requested calculation result, and the following means are provided. When calculating the inverse of secret information that is an element on a finite field, the arithmetic device of the first aspect performs an operation on the secret information, and calculates the inverse of a calculated value obtained by performing the operation. A calculation request unit for requesting the external device; and a calculation result transmitted from the external device as requested by the calculation request unit, performing an operation according to an operation performed on the secret information, thereby obtaining the secret information. Inverse element calculating means for calculating an inverse element. In the above configuration, the calculation request unit performs an operation of generating a random number on a finite field and multiplying the secret information, and the inverse calculation unit performs an operation of multiplying the calculation result from the external device by the random number. It is desirable to calculate the reciprocal of the secret information. Further, it is desirable to perform the verification by confirming whether or not a value obtained by multiplying the secret information by the inverse element calculated by the inverse element calculation means becomes 1. The arithmetic device according to the second aspect, when performing integer multiplication of the secret information and the predetermined value, divides the number of bits of a numerical value equal to or larger than the maximum value that can be taken as the value of the secret information into an external device into a plurality of pieces. A calculation request unit for requesting an integer multiplication with the value for each numerical value that can be represented by the divided bit number for each of the divided bit numbers, and a bit number divided from an external device by requesting the calculation request unit. The required integer multiplication result is selected from the separately transmitted integer multiplication results based on the value of the secret information, and the selected integer multiplication result is added. And an integer multiplication result calculating means for calculating an integer multiplication result of the above. The arithmetic device according to the third aspect, when performing integer multiplication of the secret information and the predetermined value, provides a numerical value that can be represented by an external device with the number of bits of a numerical value equal to or larger than the maximum value that can be taken as the value of the secret information. Calculation request means for requesting an integer multiplication with the value for each time, and an integer required based on the value of the secret information from among the integer multiplication results transmitted from the external device when requested by the calculation request means. An integer multiplication result calculating means for selecting the multiplication result to obtain an integer multiplication result between the secret information and the predetermined value. In the configuration of the second or third aspect, a request for calculation is made to an external device, and a value obtained by multiplying a value obtained by reversing the sign of the secret information and a predetermined value by an integer is obtained. It is preferable to perform verification by confirming whether a value obtained by adding the integer multiplication result calculated by the integer multiplication result calculation means and the integer multiplication result becomes 0 which is an additive unit element.

In the first to third aspects, it is desirable that the secret information is data used for encryption, decryption of the encrypted information, or digital signature. Each of the recording media according to the first to third aspects of the present invention is readable by a data processing device capable of communicating with an external device, and stores the following programs. When calculating the inverse of secret information that is an element on a finite field, the recording medium of the first aspect performs an operation on the secret information and calculates the inverse of a calculated value obtained by performing the operation. A function for requesting an external device and an operation corresponding to the operation performed on the secret information are performed on the calculation result transmitted from the external device by requesting the function using the requesting function, so that the inverse of the secret information is obtained. And a program for realizing the function. The recording medium according to the second aspect divides the number of bits of a numerical value equal to or larger than the maximum value that can be taken as a value of the secret information into an external device when performing an integral multiplication of the secret information and a predetermined value. Then, for each of the divided bits, a function for requesting an integer multiplication with the value for each numerical value that can be represented by the divided bit number, and for each of the divided bits transmitted from an external device by requesting by the request function From the obtained integer multiplication results, the necessary integer multiplication results are selected based on the value of the secret information, and the selected integer multiplication results are added, so that the secret information and the predetermined value are compared. A function for calculating an integer multiplication result and a program for realizing the function are recorded. Third
The recording medium according to the aspect, when performing an integral multiplication of a predetermined value on the secret information, provides the external device with each of the numerical values that can be expressed by the number of bits of a numerical value equal to or larger than the maximum value that can be taken as the value of the secret information. Select the required calculation result based on the value of the secret information from the function of requesting the integer multiplication with the value and the result of the integer multiplication transmitted from the external device by requesting by the requesting function. Thus, a program for realizing a function of obtaining an integer multiplication result of secret information and a predetermined value is recorded. In the present invention, when calculating the inverse of secret information that is an element on a finite field, an operation is performed on the secret information, and the calculation of the inverse of the calculated value obtained by performing the operation is performed on an external device. A request is made and an operation corresponding to the operation performed on the secret information is performed on the calculation result transmitted from the external device, thereby calculating the inverse of the secret information. By performing an operation on the secret information and requesting the calculation of the inverse of the calculated value obtained by performing the operation, the external device or a device capable of accessing the external device cannot identify the secret information from the calculated value. As a result, safety can be ensured when performing calculations at high speed using request calculations.

According to the present invention, when performing integer multiplication of secret information and a predetermined value, the number of bits of a numerical value equal to or larger than the maximum value that can be taken as the value of the secret information is divided into a plurality of values for an external device. For each of the divided bits, request integer multiplication with the value for each numerical value that can be represented by the divided bits, and from the integer multiplication results transmitted by the divided bits from the external device, A required integer multiplication result is selected based on the value of the secret information, and the selected integer multiplication result is added to calculate an integer multiplication result between the secret information and a predetermined value. According to the present invention, when performing an operation of multiplying the secret information by a predetermined value by an integer, an external device is provided with the value for each numerical value that can be expressed by the number of bits of a numerical value equal to or greater than the maximum value that can be taken as the value of the secret information. The secret information is multiplied by a predetermined value by selecting the necessary calculation result based on the value of the secret information from the calculation results transmitted from the external device. Find the result. As mentioned above,
By requesting an external device to calculate a plurality of calculation results, including a calculation to obtain a desired integer multiplication result, in the external device or a device that can access it, the calculation requester needs any calculation result. Cannot be identified. As a result, security can be ensured even when performing calculations at high speed using the request calculation.

[0010]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a diagram illustrating a configuration of a system in which a request calculation according to the present embodiment is performed. As shown in FIG. 1, the system 101 includes a personal computer (hereinafter abbreviated as a PC) 101 serving as a server, a personal box 102 connected to the PC 101 by a cable 103,
It is composed of The personal box 102
An arithmetic device using the request calculation according to the present embodiment (hereinafter, abbreviated as an arithmetic device) is mounted in the personal box 102. The arithmetic device is realized by a CPU mounted on the personal box 102 executing a program stored in, for example, a ROM. The object on which the arithmetic device according to the present embodiment is mounted is not limited to the personal box 102, but may be mounted on a data processing device such as an IC card having a CPU. The personal box 102 is a PC1
01 and an interface for communicating with the
U communicates with the PC 101 via the interface. The other PC 101 also has an interface for communicating with the personal box 102, and a CPU (not shown) mounted thereon communicates with the personal box 102 via the interface. In addition,
The interface mounted on each of the personal box 102 and the PC 101 does not need to be special, and may be a known interface.

The operation of the above configuration will be described. First, the addition of points on an elliptic curve used in an elliptic curve cryptosystem will be described as an example. The principle of addition of points on a normal elliptic curve is described in IEEE P1363,
ANSI Working Draft X9.62-
Since it is described in detail in 199X or the like, details are omitted. Inverse calculation on a finite field requires an extremely large amount of calculation and takes a long time to process. Therefore, calculation of a point on an elliptic curve is usually performed using projective coordinates without using the inverse calculation. Since the coordinate point representation is complicated (has a large amount of data), a large memory capacity is required. However, when performing the inverse calculation using the request calculation,
The processing time can be sufficiently shortened, and in particular I
The C card is particularly suitable because the memory capacity is small. Galois body GF (2
^m ) The elliptic curve defined above (y ² + x · y = x ³ + a ·
An arbitrary point on x ² + b) is defined as P ₀ = (x ₀ , y ₀ ) and P ₁ =
(X ₁ , y ₁ ). Addition of points in Affine coordinates,
That is, P ₂ = P ₀ + P ₁ is calculated by the following algorithm in the present embodiment. step 1 If P ₀ = (0,0) then P ₂ = P ₁ and stop step ₂ If P ₁ = (0,0) then P ₂ = P ₀ and stop step 3 If x ₀ ≠ x ₁ then step 3.1 v = y ₀ + y ₁ step 3.2 w = x ₀ + x ₁ step 3.3 r∈GF (2 ^m ) where r is a random number step 3.4 t = w · r step 3.5 t is passed to the PC 101 and its inverse element t ⁻¹ Step 3.6 w ⁻¹ = t ⁻¹ · r step 3.7 l = v · w ⁻¹ step 3.8 goto step 7 Step 4 If y ₀ ≠ y ₁ then output P ₂ = (0,0) and _{stop step5 If x 1 = 0 then} output P 2 = (0,0) and stop step6 set step6.1 r∈GF (2 m) However, r is Number _{step6.2 t = r · x 1 step6.3} t me PC 101, the inverse element t ^-1 may by calculated _{^{step6.4 x 1 -1 = t -1 ·}} r step6.5 l = y 1 X ^-1 + x ₁ step 6.6 x ₂ = a + l ² + l step 7 y ₂ = (x ₁ + x ₂ ) l + x ₂ + y _{1 step 8} P ₂ = (x ₂ , y ₂ ) In the above algorithm, step 3.5 or 6.3
Performs a request calculation for the inverse calculation of t. That t
Is obtained by multiplying w, which is secret information, by a random number r. As a result, even if t obtained by performing an operation of multiplying the random number r by the secret information w is passed to the PC 101 (an external device that has high computational power but is unreliable when viewed from the personal box 102), On the side, the secret information w cannot be specified from the t. The random number r is generated each time the request calculation is performed. For this reason,
Even if the request calculation is repeated, the PC 101 cannot specify the secret information w from t sent each time the calculation is requested. In this way, leakage of secret information, that is, reduction in security is avoided. The operation on the secret information w may be performed by other than multiplying the random number r. The check of t ^-1 transmitted from the PC 101 is multiplied by a random number r, and the inverse of the secret information w ⁻¹ (= t ⁻¹ · r =
(W ^-1 · r ^-1 ) · r), and it can be determined by checking whether the value obtained by multiplying it by the secret information w is 1 or not.

Next, an example will be described in which a request calculation for integer multiplication on an elliptic curve is performed. Elliptic curve cryptography and ellipse D
It has been found that, among the operations performed by SA (Digital Signature Algorithm), the ratio of the operation amount related to integer multiplication is very large. Therefore, applying the request calculation to the integer multiplication is very effective from the viewpoint of reducing the amount of calculation in the personal box 102. The integer multiplication of a point on an elliptic curve is: Q = [r] P where Q and P are points on the elliptic curve, and r is an integer less than the order of the base point of the subgroup of points on the elliptic curve (secret Information). In the present embodiment, the integral multiplication (operation for obtaining Q = [r] P) on the elliptic curve is performed as follows. This will be described in detail with reference to the flowchart shown in FIG. In the figure 2, the number of bits of r is n, the r is _{r = r n-1 · 2} n-1 + ··· + r 1 · 2 + r 0
Is treated as. i (variable) is prepared to divide the request calculation of the integral multiple by dividing it, and its value is 2
^u . u is an integer satisfying the relationship u · N ≧ n (N is an integer of 2 or more). First, in step 201, Q
The unit element 0 = (0,0) is substituted for (variable). In the following step 202, 0 is substituted for a variable j. Thereafter, in step 203, P and the variable j are set to the PC (server) 10
Then, the process proceeds to step 205 after requesting the calculation by sending the request to S.1.

On the other hand, the PC 101 receives the P and the variable j transmitted from the personal box 102 in step 221 and multiplies by 2 ^ju for each value from 1 to a value obtained by subtracting 1 from the value of the variable i. Then, a value obtained by multiplying the calculated value and P by an integer is calculated, and each calculated (multiplied) value is transmitted to the personal box 102 as a calculation result t _j of the request calculation. As a result, t _j = ([1.2 ^ju ] P, [2 ·
2 ^ju ] P, [ ^{3.2 ju} ] P, ..., [(i-1) · 2
^ju ] P) is sent from the PC 101. In addition,
The value of u used in performing the calculation may be specified by the personal box 102 transmitting the value to the PC 101, or may be determined in advance as information to be shared. If the value of u is 5, and the value of variable j is 0, an integer multiple of each value represented by the lower 5 bits and P is transmitted to the personal box 102 as the calculation result t _j . When the value of the variable j is 1, each value represented by the lower 6 to 10 bits (0000100000000010)
00000,00011000000, ..., 111
1100000) and an integer multiple of P are transmitted to the personal box 102 as the calculation result t _j . As described above, in the present embodiment, the PC 101 is divided into 5 bits from the lower order, and requests the PC 101 to perform integral multiplication of each value represented by the 5 bits and P. As such, secret information r
When the request calculation is performed by dividing the number of bits into smaller bits, the number of bits of the value to be multiplied by an integer with P can be minimized. Therefore, a value that can be represented by 5 bits is represented by 160 bits. Can be avoided. As a result, P
C101 calculation result t _j bits integer multiplication value to be transmitted can be suppressed as from the communication between the PC101 and personal box 102 more rapidly performed, to store personal box 102, the calculation result t _j There is also an advantage that the required memory amount can be small.

The personal box 102 receives the calculation result t _j transmitted from the PC 101 in step 204.
Thereafter, the process proceeds to step 205, in which the value represented by the number of bits (the number of bits equal to the value of u) of the portion designated by the value of the variable j in the secret information r is calculated and substituted for the variable d. To calculate the value, each bit expressing the secret information r in binary is represented by r _L (L is an integer indicating the bit position (the initial value is set to 0, and the number of the bit counted from the least significant bit is indicated. Integer). The least significant bit is 0), and d = _ruj ^u2uj + _{ruj + 1}・^{2uj + 1} + _{ruj + 2}・^{2uj + 2}
+... + R _{uj + u−1} · 2 ^{uj + u−1} After calculating the value and assigning it to the variable d, the process proceeds to step 206. In step 206, it is determined whether the value of the variable d is larger than 0. If all the bits of the portion designated by the value of the variable j in the secret information r are 0, the determination is NO, and the process proceeds to step 209 after incrementing the value of the variable j in step 207. Otherwise, the determination is YES, and in step 208, a value indicating [d] P is extracted from the calculation result t _j , and the extracted value is added to Q, that is, After substituting the value obtained by adding the extracted value into Q, the step 2
In step 07, the value of the variable j is incremented. In step 209, it is determined whether or not the value of the variable j is equal to or smaller than a value obtained by dividing n by u. If the value of the variable j is larger than the value obtained by dividing n by u, the determination is NO, and the series of processing ends.
Otherwise, the determination is YES and the process returns to step 203 to execute the subsequent processing in the same manner.

The flowchart shown in FIG. 2 is executed, for example, as a subroutine process or a function. Therefore, when the series of processes is completed, the value of Q is passed to the program that instructed (called) the execution. Steps 203 to 209 form a processing loop, and are repeatedly executed until the determination in step 209 becomes NO. For example, if u is 5 and n is between 156 and 160, the value of n / u is at most 32 (= 160/5)
Is repeated until the value of the variable j becomes 33. This means that the PC 101 performs integer multiplication of each numerical value that can be expressed by the number of bits equal to or greater than the maximum value of the possible values of the secret information r and P. This allows the personal box 102 to obtain Q using the calculation result t _j of the request calculation sent from the PC 101. As described above, a request is made to the PC 101 for calculation, and a necessary value is extracted from the calculation result t _j to obtain a desired value, so that the PC 101 is provided with secret information (here, secret information r). Nothing is gone. Also, no information that can be used to specify the secret information is provided. For this reason, even if the request calculation is performed for the PC 101 which has an excellent calculation capability but cannot be trusted,
Leakage of secret information can be avoided, and security can be maintained. Calculation result t transmitted from PC 101
The check of Q obtained by _{j is performed} by reversing the sign of the secret information r and performing the same processing as above to obtain -Q = [-r] P, and the value obtained by adding the value to Q is a unit element. 0 = (0,0)
It can be done by checking whether or not. In the present embodiment, the request calculation is performed separately for each of a plurality of consecutive bits. However, the request calculation is performed for each of a plurality of bits including distant bits using a comb table. Is also good. In such a case, since the doubling can be performed with a lighter load than the addition, the load due to the request calculation of the server (here, the PC 101) can be suppressed. The inverse element calculation using the above-described request calculation or the integer multiplication operation can be widely applied to encryption, decryption, digital signature, and the like. Hereinafter, the decryption of the encrypted information and the digital signature performed by applying it will be described in detail with reference to the flowcharts shown in FIGS.

FIG. 3 is a flowchart showing a process for implementing an elliptical ElGamal decoding algorithm using request calculation. First, the processing will be described in detail with reference to FIG. As we all know,
In the elliptic elgamal, the plaintext M is encrypted by using the base point G, the random number k, and the public key V of the decryptor to generate the ciphertexts C ₁ and C ₂ . Decryption is based on the ciphertexts C ₁ , C ₂ ,
The decryption is performed using the secret key s of the decryptor. The personal box 102 transmits the ciphertexts C ₁ and C ₂ to the PC 101.
And decrypts it. First, step 301
Then, [s] C ₁ is obtained by using a request calculation so that the value of the secret key s cannot be specified, and the obtained result is substituted (stored) in a variable T. This is a process performed in the same manner as the process shown in FIG. In the subsequent step 301 step 302, it subtracts the value of variable T from the ciphertext C _2, decodes the result of the subtraction as the plaintext M. Thereafter, a series of processing is completed, and the result (plaintext M) is returned to the calling program. FIG. 4 is a flowchart of a process for realizing the signature generation algorithm of the elliptical DSA using the request calculation. Next, the processing will be described in detail with reference to FIG. As described above, in the elliptical DSA, signatures r and t for the message e are generated using the base point G, the random number k, the message e, and the signer's private key s. The order of the base point G is n. The secret information here is
A secret key s and a random number k. First, in step 401, [k] G is obtained using request calculation in the same manner as in FIG. 2 so that the value of the random number k cannot be specified, and the obtained result is expressed as (x, y) (x, y Variable). In the subsequent step 402, the remainder obtained by dividing x by n (= x mo
dn) is assigned to a variable r. After that, step 403
Move to In step 403, similarly to the above-described inverse element calculation, the inverse element of the random number k is obtained by using the request calculation, and the obtained result is stored (substituted) in the variable tmp. Thereafter, in step 404, the value of the secret key s is multiplied by the value of the variable r, the value obtained by adding the value of the message e to the multiplication result is multiplied by the value of the variable tmp, and the multiplication result is divided by n. The remainder is substituted for a variable t. Thereafter, a series of processing is completed, and the result (variable r, t) is returned to the calling program.

In the present embodiment, the request calculation is performed for the PC 101 having a remarkably high calculation ability as compared with the personal box 102. However, the PC 101 does not perform the processing itself but connects to the PC 101. The request calculation may be performed on another PC or server that has been performed. As is clear from this, the target of the request calculation need not be one external device. Personal box 10 as described above
A program that realizes the operation of the second or modified example may be recorded on a recording medium such as a CD-ROM, a floppy (registered trademark) disk, or a magneto-optical disk and distributed. Alternatively, using a transmission medium such as a public network,
A part or all of the program may be distributed. In such a case, the user can apply the present invention to the data processing device by acquiring and loading (installing) the program into the data processing device. For this reason, the recording medium may be one that can be accessed by an apparatus that distributes the program.

[0018]

As described above, according to the present invention, when calculating the inverse of secret information which is an element on a finite field, the secret information is operated, and the calculated value obtained by performing the operation is calculated. Requesting the external device to calculate the inverse of the secret information, and performing an operation according to the operation performed on the secret information on the calculation result transmitted from the external device to calculate the inverse of the secret information . By operating on confidential information and requesting the inverse calculation of the calculated value obtained by performing the operation, external devices,
Alternatively, in a device that can access the secret information, the secret information cannot be specified from the calculated value. Therefore, safety can be ensured when performing calculations at high speed using the request calculation. The present invention divides the number of bits of a numerical value equal to or larger than the maximum value that can be taken as a value of the secret information into an external device when performing integral multiplication of the secret information and a predetermined value, and performs the division. For each number of bits, a request is made for integer multiplication with the value for each numerical value that can be represented by the divided number of bits, and from the results of the integer multiplication transmitted for each divided number of bits from the external device, A required integer multiplication result is selected based on the value, and the selected integer multiplication result is added to calculate an integer multiplication result between the secret information and a predetermined value. In the present invention, when performing an operation of multiplying secret information and a predetermined value by an integer, an external device is provided with a value for each numerical value that can be represented by the number of bits of a numerical value greater than or equal to a maximum value that can be taken as a value of the secret information. The secret information is multiplied by a predetermined value by selecting the necessary calculation result based on the value of the secret information from the calculation results transmitted from the external device. Find the result. As described above, by requesting a calculation to obtain a plurality of calculation results to an external device, including a calculation to obtain a desired integer multiple, an external device,
Or, in a device that can access it, it becomes impossible for the side requesting the calculation to specify which calculation result is needed. Therefore, safety can be ensured even when the calculation is performed at high speed using the request calculation.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a system in which a request calculation according to an embodiment is performed.

FIG. 2 is a flowchart showing a process for obtaining Q = [r] P using request calculation.

FIG. 3 is a flowchart illustrating a process for implementing an elliptic ElGamal decoding algorithm using request calculation.

FIG. 4 is a flowchart illustrating a process for realizing a signature generation algorithm for an elliptical DSA using request calculation.

FIG. 5 is a flowchart showing a conventional process for obtaining Q = [k] P.

[Explanation of symbols]

 101 Personal computer 102 Personal box

Claims (10)

[Claims] 1. A device mounted on a data processing device capable of communicating with an external device, requesting the external device to perform a calculation, and performing an operation using the requested calculation result, which is an element on a finite field. When calculating the inverse of confidential information,
A calculation requesting means for performing an operation on the secret information and requesting the external device to calculate the inverse of a calculated value obtained by performing the operation; and transmitting the request from the external device by requesting the calculation requesting means An inverse calculation means for calculating an inverse of the secret information by performing an operation in accordance with the operation performed on the secret information on the calculation result obtained, and a request calculation characterized by comprising: Computing device. 2. The calculation requesting means performs an operation of generating a random number on the finite field and multiplying the secret information, and the inverse calculating means multiplies a calculation result from the external device by the random number. The operation device according to claim 1, wherein the reciprocal of the secret information is calculated by performing an operation. 3. The verification is performed by confirming whether or not a value obtained by multiplying the secret information by the inverse calculated by the inverse calculating means becomes 1 or not. Computing device using the calculation of the request. 4. A device mounted on a data processing device capable of communicating with an external device, requesting the external device to perform a calculation, and performing an operation using the requested calculation result. When performing integer multiplication, for the external device, the number of bits of a numerical value equal to or greater than the maximum value that can be taken as the value of the secret information is divided into a plurality of bits, and for each of the divided bits, the number of divided bits is used. A calculation requesting unit for requesting an integer multiplication with the value for each representable numerical value; and from an integer multiplication result transmitted from the external device for each of the divided bits by requesting the calculation requesting unit. Selecting the required integer multiplication result based on the value of the secret information, and adding the selected integer multiplication result to calculate an integer multiplication result of the secret information and the predetermined value. And an integer multiplication result calculation means. An arithmetic unit using request calculation, characterized in that: 5. A device mounted on a data processing device capable of communicating with an external device, requesting the external device to perform a calculation, and performing an operation using the requested calculation result. A calculation requesting unit that requests the external device to perform an integer multiplication with the value for each numerical value that can be represented by the number of bits of a numerical value greater than or equal to a maximum value that can be taken as the value of the secret information when performing the integer multiplication By selecting a required integer multiplication result based on the value of the secret information from the integer multiplication results transmitted from the external device at the request of the calculation request unit, the secret information is obtained. And an integer multiplication result calculation means for obtaining an integer multiplication result of the predetermined value and the predetermined value. 6. Requesting a calculation to the external device to obtain a value obtained by multiplying a value obtained by inverting the sign of the secret information and the predetermined value by an integer, and calculating the obtained value and the integer multiplication result The request calculation according to claim 4 or 5, wherein the verification is performed by confirming whether or not the value obtained by adding the integer multiplication result calculated by the means becomes 0 which is an additive unit element. Arithmetic unit. 7. The apparatus according to claim 1, wherein the secret information is data used for encryption, decryption of the encrypted information, or digital signature. Computing device using the calculation of the request. 8. A storage medium that can be read by a data processing device capable of communicating with an external device, wherein the inverse of secret information that is an element on a finite field is calculated.
An operation is performed on the secret information, and a function of requesting the external device to calculate the inverse of a calculated value obtained by performing the operation is transmitted from the external device by requesting the request by the requesting function. And a function of calculating the inverse of the secret information based on an operation performed on the secret information with respect to a calculation result that comes from the storage medium, and a program for realizing: 9. A recording medium readable by a data processing device capable of communicating with an external device, wherein when performing an integral multiplication of secret information and a predetermined value, the external device sends the secret information to the external device. A function of dividing the number of bits of a numerical value equal to or larger than the maximum value that can be taken as a value into a plurality of values, and requesting an integer multiplication with the value for each numerical value that can be represented by the divided bit number for each of the divided bits; From the integer multiplication results transmitted by the number of divided bits from the external device by requesting by the request function, a necessary integer multiplication result is selected based on the value of the secret information, and the selection is performed. A function of calculating an integer multiplication result of the secret information and the predetermined value by adding the obtained integer multiplication result, and a program for realizing the following. 10. A storage medium readable by a data processing device capable of communicating with an external device, wherein when performing an integral multiple of a predetermined value on the secret information, the secret information value is transmitted to the external device. A function for requesting an integer multiplication with a numerical value that can be represented by the number of bits of a numerical value greater than or equal to the maximum value that can be taken, and an integer multiplication transmitted from the external device by requesting by the requesting function A function of selecting a necessary calculation result based on the value of the secret information from among the results to obtain an integer multiplication result of the secret information and the predetermined value; and a recording medium recording a program for realizing .