JP2004177673A - Pairing ciphering device, pairing ciphering calculation program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To speedily perform pairing calculation of elliptic curve cryptography. <P>SOLUTION: In the program for pairing calculation shown in the figure, calculations are carried out to obtain the coefficients of the formulae of straight lines 11, 12 for the pairing calculation by defining a function TDBL and using values obtained in the process of calculating elliptic duplication. Or, calculations are carried out to obtain the coefficients of the formulae of the straight lines 11, 12 for the pairing calculation by using the values obtained in the process of calculating elliptic addition and by defining a function TADD. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a pairing encryption device on an elliptic curve, a pairing encryption calculation method, and a program therefor.
[0002]
[Prior art]
Encryption using pairing on an elliptic curve (hereinafter, pairing encryption) is one of public key encryption, and is composed of encryption primitives such as secret sharing, signature, and authentication. In these primitives, an operation called pairing on an elliptic curve is commonly used and is the center of cryptographic processing. For this reason, in implementing the pairing encryption, a technology for realizing a high-speed pairing operation is indispensable.
[0003]
As an example of the pairing encryption, a description will be given with reference to Document 1 regarding a secret sharing primitive by Ogishi / Sakai / Kasahara.
The center defines and publishes the elliptic curve E, and defines a scalar s (s is an integer) as the center's secret key. The user A registers personal information PA (PA is a point on the elliptic curve E) at the center, and secretly receives a secret key QA = s × PA (QA is a point on the elliptic curve E). Similarly, the user B registers personal information PB (PB is a point on the elliptic curve E) at the center, and secretly receives a secret key QB = s × PB (QB is a point on the elliptic curve E). Personal information will be made available to all users. When the user A and the user B share the secret, the user A transmits the shared information KAB with the user B,
KAB = (QA, PB) + (PB, QA)
= (S × PA, PB) + (PB, s × PA)
= (PA, PB) ＾ s + (PB, PA) ＾ s
Ask by. Here, (P, Q) represents pairing of the points P and Q. ＾ represents a power. User B provides shared information KBA with user A,
KBA = (QB, PA) + (PA, QB)
= (S × PB, PA) + (PA, s × PB)
= (PB, PA) ＾ s + (PA, PB) ＾ s
Ask by. At this time, since KAB = KBA, the secret information is shared between the user A and the user B. In this way, the Ogishi / Sakai / Kasahara pairing cipher performs secret sharing.
[0004]
The pairing encryption uses an operation called pairing on an elliptic curve. Hereinafter, the elliptic curve will be described.
Assuming that p is a prime number of 5 or more and m is an integer of 1 or more, an elliptic curve on a finite field GF (q) having q = p ＾ m is an equation
E: y ＾ 2 = x ＾ 3 + a × x + b
Is a set obtained by adding a point ∞ called an infinite point to a set of points (x, y) satisfying the following. The point at infinity ∞ may be represented as 0. Here, a, b, x, and y are elements of the finite field GF (q). A point on an elliptic curve can be represented in a coordinate format (affine coordinates) such as (x, y), but the point at infinity ∞ is the only point that cannot be represented in a coordinate format such as (x, y). is there. Thus, in the affine coordinates, points other than the point at infinity are represented as a pair of two elements of GF (q).
[0005]
An operation called addition of points can be defined between points on the elliptic curve E as follows.
Let P be a point on the elliptic curve E on GF (q). We define the inverse of P-P as follows.
[0006]
(1) If P = ∞, -P = ∞
(2) If P ≠ ∞, if P = (x, y), then −P = (x, −y)
Let P1 and P2 be two points on the elliptic curve E on GF (q). The sum P3 = P1 + P2 of P1 and P2 is defined as follows.
[0007]
(1) If P1 = ∞, P3 = P2
(2) If P2 = ∞, P3 = P1
(3) If P1 = -P2, P3 = ∞
(4) If P1 ≠ −P2, P1 = (x1, y1), P2 = (x2, y2),
When P3 = (x3, y3),
x3 = λ ＾ 2-x1-x2, y3 = −λ × x3-ν,
However
λ = (y2-y1) / (x2-x1), ν = (y1 × x2-y2 × x1) / (x2-x1)... when P1 ≠ P2
λ = (3 × x1 ＾ 2 + a) / (2 × y1), ν = (− x1 ＾ 3 + a × x1 + 2 × b) / (2 × y1): When P1 = P2
And Calculating P1 + P2 when P1 ≠ P2 is called elliptic addition, and calculating P1 + P2 = 2 × P1 when P1 = P2 is called elliptic doubling. Elliptic addition and elliptic doubling are calculated by a combination of addition, subtraction, multiplication, squaring, and inverse calculation in a finite field GF (q).
[0008]
9 and 10 are explanatory diagrams of the ellipse addition and the ellipse doubling. As shown in FIG. 9, the elliptic addition is a point obtained by turning the intersection of a straight line connecting points P1 = (x1, y1) and P2 = (x2, y2) on the elliptic curve with the elliptic curve on the x-axis. It is defined as P3 = P1 + P2 = (x3, y3). As shown in FIG. 10, the ellipse doubling is performed by turning the intersection of the tangent line of the point P1 = (x1, y1) on the elliptic curve and the elliptic curve along the x-axis, P4 = P1 + P1 = 2 × P1 = (X4, y4).
[0009]
For an elliptic curve E on a finite field GF (q), a point P on the curve, and an integer (also referred to as a scalar) d, calculate a point d × P = P + P +... + P (sum of d pieces). It is called scalar multiplication. Scalar multiplication is realized by a combination of elliptic addition and elliptic doubling. The scalar multiple d × P is calculated by binary expansion of d.
d = d [n−1] × 2 ＾ (n−1) + d [n−2] × 2 ＾ (n−2) +... + d [1] × 2 + d [0]
Often done using.
[0010]
FIG. 11 is a diagram showing a conventional scalar multiplication algorithm 1. In FIG. 11, the initial value of the variable Q [0] is set to P in step S1, the ellipse doubling of the point Q [0] is executed in step S3, and the operation result is stored in Q [0]. If d [i] == 1, ellipse addition of Q [0] and point P is executed in step S5, and the operation result is stored in Q [0].
[0011]
Since the scalar multiplication calculation on the elliptic curve is realized by a combination of operations called elliptic addition and elliptic doubling, the entire calculation time is evaluated as the number of calculations of these operations. Further, the calculation time of elliptic addition and elliptic doubling is evaluated by the sum of the calculation times of multiplication, squaring, and inverse element calculation in the finite field GF (q). This is because the actual calculation of elliptic addition, elliptical doubling, and scalar multiplication is calculated by a combination of addition, subtraction, multiplication, squaring, and inverse calculation in a finite field. This is because it is negligibly short compared to the time.
[0012]
The calculation time of the inverse element in the finite field GF (q) is much longer than the calculation time of multiplication and squaring. For this reason, Jacobian coordinates may be used to represent points of an elliptic curve. In Jacobian coordinates, a point is represented by a combination of three elements of a finite field GF (q) such as (X: Y: Z). However, (r ＾ 2 × X: r ＾ 3 × Y: r × Z) is considered to be the same for the element (X: Y: Z) and the element r of GF (q) where r ≠ 0. For the elliptic curve, in Jacobian coordinates, substituting x = X / Z ＾ 2, y = Y / Z ＾ 3,
E: Y ＾ 2 = X ＾ 3 + a × X × Z ＾ 4 + b × Z ＾ 6
It becomes. Using the Jacobian coordinates, points on the elliptic curve can be represented in a coordinate format such as (X: Y: Z). The point at infinity is ∞ = (0: 1: 0). Thus, in the Jacobian coordinates, all points on the elliptic curve are represented as a set of three elements of GF (q).
[0013]
In the Jacobian coordinates, the calculation time required for ellipse addition is 12M + 4S, and the calculation time required for ellipse doubling is 4M + 6S. In particular, when one Z coordinate of the input point is 1, the calculation time required for the ellipse addition is 8M + 3S.
[0014]
Since the Jacobian coordinates require the square or the third power of the Z coordinates, coordinates (Tudnovsky-Jacobi coordinates) holding these values as coordinate values may be used. In the Chudnovski-Jacobi coordinates, a point is represented by a combination of five elements of a finite field GF (q) such as (X: Y: Z: Z2: Z3), where Z2 = Z {2, Z3 = Z}. It is 3. However, X, Y, and Z are considered as Jacobian coordinates. The point at infinity is ∞ = (0: 1: 0: 0: 0). As described above, all points on the elliptic curve are represented as a set of five elements of GF (q) in the Chudnovsky-Jacobi coordinates.
[0015]
In the Chudnovsky-Jacobian coordinates, the calculation time required for ellipse addition is 11M + 3S, and the calculation time required for ellipse doubling is 5M + 6S. In particular, when one Z coordinate of the input point is 1, the calculation time required for the ellipse addition is 8M + 3S.
[0016]
Next, pairing on an elliptic curve will be described. Let E be an elliptic curve on a finite field GF (q). Let l be a divisor of the number of points on the elliptic curve E (the order of the curve, called #E), and choose the smallest natural number such that l is a divisor of q ＾ k-1 as k. At this time, the l-order pairing (P, Q) for the point P on the finite field GF (q) of the elliptic curve E and the point Q on the finite field GF (q ＾ k) is 1 for P and Q. This is an operation for associating elements of a set formed by the l-th root of and satisfies the following condition.
[0017]
(P1 + P2, Q) = (P1, Q) × (P2, Q)
(P, Q1 + Q2) = (P, Q1) × (P, Q2)
For all P, when Q = ∞, (P, Q) = 1
As specific examples of the pairing, Beil pairing and Tate pairing are known. In the following, Tate pairing will be used unless otherwise specified.
[0018]
Next, a method of calculating the pairing will be described.
Tate pairing for a point P on a finite field GF (q) of an elliptic curve E and a point Q on a finite field GF (q ＾ k) is
(P, Q) = (fp (Q + S) / fp (S)) ＾ ((q ＾ k−1) / l)
Can be expressed as Here, the function fp is a function that receives a point on the finite field GF (q ＾ k) and outputs an element of a set of l-th root, and can be expressed by the following equation.
[0019]
fp (Q + S) = Π [11 (Q + S) / 12 (Q + S)]
fp (S) = Π [11 (S) / 12 (S)]
The point S is a point on the finite field GF (q ＾ k), l1 is an equation of a straight line connecting the point T and the point P (in the case of T = P, a tangent to the point T), and l2 is T + P (T = P represents the equation of a straight line perpendicular to the x-axis through T + T). Further, Π indicates that a product of equations of a straight line satisfying a certain condition is calculated.
[0020]
[Non-patent document 1]
Seishi Ogishi, Ryuichi Sakai, Masao Kasahara, "A Study on Key Agreement Based on ID Information on Elliptic Curve", IEICE Technical Report, ISEC 99-57, November 1999
[0021]
[Problems to be solved by the invention]
In order for the pairing encryption to be widely used in the real world, it is required to reduce processing time and resources (memory, circuit amount, etc.) required for mounting. In the pairing encryption, an operation called pairing is commonly used, and the specific gravity of the entire processing is high. Therefore, the performance improvement of this part is directly linked to the overall performance improvement. Since the pairing calculation has a high specific gravity in the pairing encryption processing, further speeding up is desired.
[0022]
However, the coordinates used for the calculation of the elliptic curve cryptography are not always optimal for the calculation of the pairing since they are intended for the high-speed calculation of the scalar multiplication of the elliptic curve.
[0023]
An object of the present invention is to perform a pairing calculation in a pairing encryption at high speed.
[0024]
[Means for Solving the Problems]
The present invention provides a pairing cryptographic device that processes cryptography using pairing for a point on an elliptic curve, an elliptic curve on a finite field, storage means for storing a point on the elliptic curve, and elliptic doubling or A calculating means for storing a value obtained in the calculation process of the elliptic addition, and calculating a coefficient of a linear equation of the pairing calculation using the stored value.
[0025]
According to the present invention, it is possible to calculate the coefficient of the equation of the straight line of the pairing operation using the value obtained in the calculation process of the ellipse doubling or the ellipse addition, so that the calculation time of the pairing operation is reduced. be able to.
[0026]
Another invention provides a pairing encryption device that processes encryption using pairing for a point on an elliptic curve, wherein the storage unit stores an elliptic curve on a finite field, a point on the elliptic curve, and a pairing operation. A calculation unit is provided for storing a part of the calculation result of an equation obtained by expanding a straight line equation used for the intermediate calculation, and calculating the straight line equation using the stored calculation result.
[0027]
For example, when the equation of a straight line connecting the point T and the point P on the elliptic curve is 11, the equation of a straight line passing through the point T + P and perpendicular to the x-axis is 12, and the points Q + S and the point S on the finite field are: The straight line equations used for the intermediate calculation of the pairing operation are 11 (Q + S) × 12 (S) and 11 (S) × 12 (Q + S).
[0028]
According to the present invention, the calculation time can be shortened by performing the calculation of the equation by using a part of the calculation result of the equation developed from the straight line equation used for the intermediate calculation of the pairing calculation.
[0029]
In the above invention, the calculating means performs the calculation of the pairing calculation using reduced coordinates representing the coordinates of one point by a set of four elements (X: Y: Z: Z ＾ 2) on the finite field. Do. Thus, the calculation time can be reduced by performing the pairing calculation using the simplified coordinates.
[0030]
In the above invention, the calculating means calculates the coordinates of the point Q + S on the elliptic curve as (xQS, yQS), the coordinates of the point S as (xS, yS), and the equation of a straight line connecting the point T and the point P on the elliptic curve. When the equation of a straight line perpendicular to the x-axis passing through the point T + P is set to l2, the values of xQS × xS and yQS × xS are calculated and stored in advance, and the stored xQS × xS , YQS × xS, the calculation of l1 (Q + S) × 12 (S) and l1 (S) × 12 (Q + S) of the pairing operation may be performed.
[0031]
With the above configuration, it is possible to reduce the calculation time of l1 (Q + S) × 12 (S) and 11 (S) × 12 (Q + S) in the pairing operation.
In the above invention, the calculation means calculates the coordinate T of the point T = (X1: Y1: Z1), the coordinate T + T of the point T + T = (X4: Y4: Z4), a straight line 11 connecting the point T + T, and an x-axis passing through the point T + T. Is calculated using the equation Z1 ＾ 2 and 3 × X1 ＾ 2 + a × Z1 ＾ 4, which are calculated in the calculation process of the ellipse doubling, when the straight line l2 is perpendicular to the straight line l2. You may do so.
[0032]
With this configuration, it is possible to reduce the calculation time for the coefficients of the straight line equations l1 and l2 of the elliptic doubling in the pairing calculation.
Further, in the above invention, the calculation means passes the coordinates T of the point T = (X1: Y1: Z1), the coordinates T + P of the point T + P = (X3: Y3: Z3), a straight line 11 connecting the point T + P, and the point T + P. Assuming that a straight line l2 perpendicular to the x-axis is used, the coefficients of the equations of the straight lines l1 and l2 are calculated using Z3 ＾ 2 and Y2 × Z1 ＾ 3-Y1 calculated in the elliptic addition calculation process. You may do it.
[0033]
With this configuration, it is possible to reduce the calculation time of the coefficients of the equations of the straight lines l1 and l2 of the elliptic addition in the pairing calculation.
The storage means corresponds to, for example, the storage unit 15 of FIG. 1, or the storage unit 15 and the register 14, and the calculation means corresponds to the calculation unit 12 or the calculation unit 13 of FIG.
[0034]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. The pairing encryption device according to the embodiment includes a personal computer, an IC chip built in an IC card (smart card), a mobile phone, a portable information terminal device, a DVD player, and the like, and has a processor for performing calculations. .
[0035]
FIG. 1 is a diagram showing a configuration of a main part of a pairing encryption device 11 according to the present invention. The operation unit 12 of the pairing encryption device 11 according to the embodiment includes an operation unit (CPU) 13 and a register 14 including a plurality of registers. The operation result is input to the register 14 again. The storage unit 15 includes a hard disk, a memory, and the like, and stores a calculation program of scalar multiplication of elliptic curve cryptography described later. The calculation unit 12 executes a program stored in the storage unit 15 and performs a calculation of the pairing encryption and the like.
[0036]
In the following description, the operation method of the pairing encryption according to the present invention is applied to an elliptic curve on a prime field GF (q) (q = p ＾ m, p is a prime number of 5 or more, m is a natural number of 1 or more). A description will be given of the case in which this is done.
[0037]
A circular curve E on GF (q) can be expressed by the following equation.
E: y ＾ 2 = x ＾ 3 + a × x + b
Here, a, b, x, and y are elements of GF (q) and satisfy 4 × a ＾ 3 + 27 × b ＾ 2 ≠ 0.
[0038]
FIG. 2 is a diagram showing a program of a mirror algorithm (hereinafter referred to as algorithm 2) which is a general Tate pairing algorithm, and FIG. 3 is a first embodiment of the present invention in which the algorithm 2 is improved. FIG. 6 is a diagram showing a program of an algorithm (improved mirror algorithm) (hereinafter referred to as algorithm 3) of the form (1).
[0039]
First, algorithm 2 shown in FIG. 2 will be described. The program shown in FIG. 2 inputs an n-bit integer 1 and coordinates of points P, Q, and S on an elliptic curve, and outputs a result of a pairing operation (P, Q) of the points P and Q. is there.
[0040]
The coordinates of the point P are stored in a register storing the variable T (hereinafter referred to as register T), and "1" is stored as an initial value in a register storing the function f (hereinafter referred to as register f) (FIG. 2, S11). ).
[0041]
Next, the variable i is sequentially changed from n-1 to 0, and the following processing is executed (FIG. 2, S12).
The ellipse doubling T = T + T is calculated, and the coefficients of the equations of the straight lines l1 and l2 of the ellipse doubling are calculated (FIG. 2, S13).
[0042]
Here, l1 is an equation of a straight line connecting the point T and the point P, and l2 is an equation of a straight line perpendicular to the x-axis passing through the point of T + T.
Next, in step S14, f = f ＾ 2 × 11 (Q + S) × 12 (S) / 11 (S) / 12 (Q + S) is calculated.
[0043]
It is determined whether the value l [i] of the i-th bit of the integer l is "1" (FIG. 2, S15). If l [i] = 1, the process proceeds to the next step S16, where elliptic addition T + P is calculated, and coefficients of equations of straight lines l1 and l2 of elliptic addition T + P are calculated.
[0044]
Next, in step S17, f = f × 11 (Q + S) × 12 (S) / 11 (S) / 12 (Q + S) is calculated. Thereafter, the process returns to step S12, and the process is repeated until i = 0.
[0045]
When the processing of steps S12 to S17 is completed, the process proceeds to step S18, and f = f {(q {k-1) / l} is calculated from the value of f obtained in the above processing.
An improvement of the above-mentioned mirror algorithm is algorithm 3 of the first embodiment of the present invention shown in FIG. In the following description, portions different from the program of FIG. 2 will be described.
[0046]
The algorithm 3 of the first embodiment is based on the calculation of the elliptic doubling, the calculation of the coefficients of the equations of the straight lines l1 and l2 of the elliptic doubling, In the calculation of the addition and the calculation of the coefficients of the equations of the straight lines l1 and l2 of the elliptic addition, the calculation of the common intermediate variable is performed only once. Therefore, in the program of the algorithm 3, the function TDBL that performs the elliptic doubling and the calculation of the equations of the straight lines l1 and l2 using the common intermediate variable, and the intermediate function that performs the elliptic addition and the calculation of the equations of the straight lines l1 and l2 are common. A function TADD performed using variables is defined.
[0047]
The processing in steps S21 and S22 in FIG. 3 is the same as the processing in steps S11 and S12 in FIG.
In the next step S23, the function TDBL is called, the ellipse doubling of the point specified by the variable T and the calculation of the coefficients of the equations of the straight lines l1 and l2 are performed, and the calculation results correspond to the variables T, l1 and l2. Stored in the register.
[0048]
In the next step S24, f = f ＾ 2 × 11 (Q + S) × 12 (S) / 11 (S) / 12 (Q + S) is calculated.
When it is determined in step S25 that l [i] = 1, the process proceeds to the next step S26, where the function TADD is called, and the coefficients of the equations of the elliptic addition T + P and the straight lines l1 and l2 are calculated.
[0049]
In the next step S27, f = f × 11 (Q + S) × 12 (S) / 11 (S) / 12 (Q + S) is calculated.
Steps S28 and S29 are the same as steps S18 and S19 in FIG.
[0050]
Next, FIG. 4 is a diagram showing a program of a function TDBL for calculating elliptic doubling and coefficients of equations of straight lines l1 and l2 in the program of FIG.
In the first embodiment, a simplified Chudnov is obtained by simplifying the Tudnovski-Jacobi coordinates representing the coordinates of a point with five elements (X: Y1: Z: Z2: Z3) of a finite field GF (q). Uses Ski-Jacobi coordinates. The reduced Chudnovsky-Jacobi coordinates (hereinafter referred to as reduced coordinates) are the coordinates of a point represented by four elements (X: Y: Z: Z2) of a finite field GF (q). Note that Z2 = Z ＾ 2.
[0051]
In the calculation of the function TDBL, the equations of the straight lines l1 and l2 represent the coordinates of the point T and the point T + T obtained by the ellipse doubling as T = (X1: Y1: Z1) and T + T = (X4: Y4: Z4, respectively). ) Can be expressed as follows.
[0052]
11: (Z4 × Z1 ＾ 2 × y-2 × Y1 ＾ 2)-(3 × X1 ＾ 2 + a × Z1 ＾ 4) × (Z1 ＾ 2 × x-X1) = 0 (1)
l2: Z4 ＾ 2 × x−X4 = 0 (2)
The program of the function TDBL shown in FIG. 4 is obtained by inputting the coordinates (X1: Y1: Z1: Z12) of the point T expressed by the simplified coordinates and a constant a, and obtaining a point 2 × T (= T + T) obtained by elliptic doubling. (X4: Y4: Z4: Z42) and the coefficients A, B, C, D, and E of the equations of the straight lines 11 and 12 of the ellipse doubling.
[0053]
The calculation of the ellipse doubling is performed in the processing after step S31 in FIG. First, the squaring of the X coordinate X1 of the point T is calculated, and the calculation result is stored in a register (hereinafter, referred to as a register X12) as a variable X12 (FIG. 4, S32). Next, the square calculation of the Y coordinate Y1 of the point T is calculated, and the calculation result is stored in a register (hereinafter, referred to as a register Y12) as a variable Y12 (FIG. 4, S33).
[0054]
Next, the square calculation of the register Y12 calculated in step S33 is calculated, and the calculation result is stored in the register Y14 as a variable Y14 (FIG. 4, S34). Next, the square calculation of the square Z12 of the Z coordinate of the point T is calculated, and the calculation result is stored in the register Z14 (FIG. 4, S35). Hereinafter, it is assumed that the calculation results are stored in registers corresponding to the respective variables.
[0055]
Next, 3 × X12 + a × Z14 is calculated, that is, 3 × X1 ＾ 2 + a × Z1 ＾ 4, and the calculation result is stored in the register M (FIG. 4, S36).
Next, the calculation of 4 × X1 × Y12, that is, 4 × X1 × Y1 ＾ 2 is calculated, and the calculation result is stored in the register S (FIG. 4, S37).
[0056]
Next, the calculation of M ＾ 2-2 × S, that is, the value obtained by doubling the register S from the square of the register M is subtracted, and the result is stored in the register X4 (FIG. 4, S38).
Next, the calculation of M × (S−X4) −8 × Y14, that is, the value obtained by subtracting the register X4 from the register S is multiplied by the register M, and 8 × Y1 ＾ 4 is subtracted from the calculation result. The result is stored in the register Y4 (FIG. 4, S39).
[0057]
Next, the calculation result of 2 × Y1 × Z1 is stored in the register Z4 (FIG. 4, S40).
Next, the square calculation of the register Z4 obtained in step S40 is calculated, and the calculation result is stored in the register Z42 (FIG. 4, S41).
[0058]
By the above processing, the X coordinate X4, the Y coordinate Y4, the Z coordinate Z4, and the square Z42 of the Z coordinate of the point obtained by the ellipse doubling 2 × T can be calculated.
Next, the coefficients of the equations of the straight lines l1 and l2 are calculated in the processing after step S42.
[0059]
First, calculation of −M × Z12, that is, − (3 × X1 ＾ 2 + a × Z1 ＾ 2) × Z1 ＾ 2 is calculated, and the calculation result is stored in the register A (FIG. 4, S43). By the processing in step S43,-(3 × X1 ＾ 2 × Z1 ＾ 2 + a × Z1 ＾ 6) is stored in the register A.
[0060]
Next, Z4 × Z12 is calculated, that is, the register Z4 is multiplied by the register Z12, and the multiplication result is stored in the register B (FIG. 4, S44). By the processing in step S44, Z4 × Z1 ＾ 2 is stored in the register B.
[0061]
Next, the calculation of −2 × Y12 + M × X1, that is, the result obtained by multiplying the register Y12 by −2 and the result obtained by multiplying the register M and the X coordinate X1 of the point T are added, and the calculation result is stored in the register C. (S45 in FIG. 4). By the processing in step S45, the register C stores −2 × Y1 ＾ 2 + (3 × X1 ＾ 2 + a × Z1 ＾ 4) × X1.
[0062]
Next, the value of the register Z42 is stored in the register D (FIG. 4, S46). By the processing in step S46, Z4 ＾ 2 is stored in the register D.
Finally, the negative value of the register X4 is stored in the register E (FIG. 4, S47).
[0063]
The above program of the function TDBL stores Z1 ＾ 2, Y1 ＾ 2, and M = 3 × X1 ＾ 2 + a × Z1 ＾ 4 obtained in the calculation process of the ellipse doubling in registers, and stores the values of these registers. Are used to calculate the coefficients A, B, C, D, and E of the equations of the straight lines l1 and l2, so that the calculation time for calculating the coefficients A to E can be greatly reduced.
[0064]
When the above function TDBL is calculated using the Jacobian coordinates, the calculation of elliptic doubling requires 4M + 6S calculation time for 4 multiplications and 6 squaring operations. In the calculation of the coefficients of the equations of the straight lines l1 and l2, since Z1 ＾ 2, Y1 ＾ 2, and (3 × X1 ＾ 2 + a × Z1 ＾ 4) are calculated in the calculation process of the ellipse doubling, Z4 × Z1 ＾ It is sufficient to calculate 2, (3 × X1 ＾ 2 + a × Z1 ＾ 4) × Z1 ＾ 2, (3 × X1 ＾ 2 + a × Z1 ＾ 4) × X1, Z4 ＾ 2, so that a calculation time of 3M + 1S is required. . Therefore, a total of 4M + 6S + 3M + 1S = 7M + 7S calculation time is required.
[0065]
Further, when the calculation is performed using the Chudnovsky-Jacobi coordinates, the calculation of the elliptic doubling requires a calculation time of 5M + 6S by five multiplications and six squares. Straight line l1. In the calculation of the coefficient of the equation of l2, since Z1 ＾ 2, Y1 ＾ 2, (3 × X1 ＾ 2 + a × Z1 ＾ 4), Z4 ＾ 2 are calculated, Z4 × Z1 ＾ 2, (3 × X1 (2 + a × Z1 ＾ 4) × Z1 ＾ 2, (3 × X1 ＾ 2 + a × Z1 ＾ 4) × X1, which requires 3M calculation time. Therefore, a total calculation time of 5M + 6S + 3M = 8M + 6S is required.
[0066]
On the other hand, when the function TDBL is calculated using the reduced coordinates, the calculation time of the ellipse doubling calculation 4M + 6S is required, and the calculation of the coefficient of the equation of the straight line is Z1 ＾ 2, Y1 ＾ 2, Since (3 × X1 ＾ 2 + a × Z1 ＾ 4) and Z4 ＾ 2 are calculated in the calculation process of the elliptic doubling, Z4 × Z1 ＾ 2, (3 × X1 ＾ 2 + a × Z1 ＾ 4) × Z1 Since it is sufficient to calculate ＾ 2, (3 × X1 ＾ 2 + a × Z1 よ い 4) × X1, the calculation time is 3M. Therefore, the total calculation time is 4M + 6S + 3M = 7M + 6S.
[0067]
From the above, by using the reduced coordinates, the calculation time of the function TDBL is approximately 6.3% faster than the calculation time in the Jacobian coordinates, and approximately 7.8% faster than the calculation time in the Chudnovsky-Jacobi coordinates. Can be. Therefore, by using the reduced coordinates expressed by a set of four elements of GF (q) (X: Y: Z: Z ＾ 2) in the calculation of the function TDBL, the elliptic doubling and the coefficients of the equations of the straight lines l1 and l2 are performed. Calculation time can be reduced.
[0068]
Next, FIG. 5 is a diagram showing a program of the function TADD in step S26 of the program of FIG.
In the calculation of the function TADD, the coordinates of the point T in the Jacobian coordinates are T = (X1: Y1: Z1), the coordinates of the point P are P = (X2: Y2: 1), and the coordinates T + P of the point obtained by the elliptic addition T + P = When (X3: Y3: Z3), the equations of the straight lines l1 and l2 of the ellipse addition can be expressed as follows.
11: Z3 × (y−Y2) − (Y2 × Z1 ＾ 3-Y1) × (x−X2) = 0 (3)
l2: Z3 ＾ 2 × x−X3 = 0 (4)
The coefficients of the equations of the straight lines l1 and l2 are as follows.
[0069]
11: Axx + Bxy + C
l2: Dxx + E
The program shown in FIG. 5 is obtained by inputting coordinates T = (X1: Y1: Z1: Z12) and P = (X2: Y2: 1: 1) of the point T and the point P in the simplified coordinates, and obtaining the points obtained by the ellipse addition T + P. And outputs the coefficients A, B, C, D, and E of the equations of l1 and l2 as T + P = (X3: Y3: Z3: Z32).
[0070]
The calculation of the ellipse addition is performed in the processing after step S51 in FIG.
First, the X coordinate X1 of the point T is stored in the register U1 (FIG. 5, S52). Next, the X coordinate X2 of the point P is multiplied by the square Z12 of the Z coordinate of the point T, and the multiplication result is stored in the register U2 (FIG. 5, S53).
[0071]
Next, the Y coordinate Y1 of the point T is stored in the register S1 (FIG. 5, S54). Next, the calculation of Y2 × Z1 × Z12, that is, the Y coordinate Y2 of the point P is multiplied by the Z coordinate Z1 of the point T and the square Z12 of the Z coordinate, and the calculation result is stored in the register S2 (FIG. 5). S55).
[0072]
Next, the value of the register U1 is subtracted from the register U2, and the subtraction result is stored in the register H (FIG. 5, S56).
Next, the calculation of S2-S1, that is, Y1 of the register S1 is subtracted from Y2 × Z1 ＾ 3 of the register S2, and the subtraction result is stored in the register R (FIG. 5, S57).
[0073]
Next, the square calculation of the register H is calculated, and the calculation result is stored in the register H2 (FIG. 5, S58).
Next, the register H2 is multiplied by the register H, and the multiplication result is stored in the register H3 (FIG. 5, S59).
[0074]
Next, the register U1 is multiplied by the register H2, and the multiplication result is stored in the register U1H2 (FIG. 5, S60).
Next, a calculation of −H3−2 × U1H1 + R ＾ 2 is performed, and the calculation result is stored in the register X3 (S61 in FIG. 5).
[0075]
Next, calculation of -S1 * H3 + R * (U1H2-X3) is performed, and the calculation result is stored in the register Y3 (FIG. 5, S62).
Next, the Z coordinate Z1 of the point T is multiplied by the register H, and the multiplication result is stored in the register Z3 (FIG. 5, S63).
[0076]
Next, the square calculation of the register Z3 is calculated, and the calculation result is stored in the register Z32 (FIG. 5, S64).
By the above-described processing, the coordinates T + P of the point obtained by the ellipse addition T + P in the simplified coordinates can be calculated (X3: Y3: Z3: Z32 = Z3 ＾ 2).
[0077]
In the processing after step S65, the coefficients of the equations of the straight lines l1 and l2 are calculated.
First, the negative value of the register R is stored in the register A (S66 in FIG. 5). By the process of step S66,-(Y2 × Z1 ＾ 3-Y1) is stored in the register A.
[0078]
Next, the value of the register Z3 is stored in the register B (FIG. 5, S67). Next, the calculation of −Z3 × Y2 + R × X2, that is, the result of multiplying the negative value of the register Z3 by the register Y2 and the result of the multiplication of the register R and the register X2 are stored in the register C (FIG. 5, S68). By the processing in step S68, “−Z3 × Y2 + (Y2 × Z1 ＾ 3-Y1) × X2” is stored in the register C.
[0079]
Next, the value of the register Z32 is stored in the register D (FIG. 5, S69). By the processing in step S69, Z3 ＾ 2 is stored in the register D.
Finally, the negative value of the register X3 is stored in the register E (FIG. 5, S70).
[0080]
In the calculation of the ellipse addition, since “Y2 × Z1 ＾ 3-Y1 (register R)” and Z3 ＾ 2 (register Z32) are calculated, the coefficient A of the equation of the straight line l1 is a negative value of the register R. Can be calculated by finding The coefficient B can be obtained from the value of the register Z3. The coefficient C can be calculated by adding the multiplication result of the register Z3 and the register Y2 and the multiplication result of the register R and the register X2. Further, the coefficient D of the straight line l2 can be obtained from the value of the register Z32, and the coefficient E can be obtained from the negative value of the register X3.
[0081]
Therefore, “Y2 × Z1 ＾ 3-Y1” and Z3 ＾ 2 obtained in the calculation process of the ellipse addition are held in the register, and the values are used for calculating the coefficients of the equations of the straight lines l1 and l2. The coefficient can be calculated in two multiplications, that is, in a calculation time of 2M. In addition, since the calculation of the ellipse addition can be performed in the calculation time of 8M + 3S, when the function TADD is calculated using the simplified coordinates, the calculation time of 8M + 3S + 2M = 10M + 3S in total is sufficient.
[0082]
On the other hand, when the function TADD is calculated using the Jacobian coordinates or the Chudnovsky-Jacobi coordinates, the calculation time of 8M + 3S is required for the calculation of the ellipse addition, and the calculation of the coefficients of the equations of the straight lines l1 and l2 is as follows. Since Y2 × Z1 ＾ 3-Y1 is calculated in the calculation process of the ellipse addition, it is sufficient to calculate Z3 × Y2, (Y2 × Z1 ＾ 3-Y1) × X2, and Z3 ＾ 3. Requires 2M + 1S calculation time. Accordingly, calculation of the function TADD requires a total of 8M + 3S + 2M + 1S = 10M + 4S calculation time.
[0083]
Comparing the calculation time when the function TADD is calculated using the simplified coordinates and the calculation time when using the Jacobian and Chudnovsky-Jacobi coordinates, the former calculation time is smaller than the latter calculation time. Approximately 6.1% faster. Therefore, it is preferable to use simplified coordinates in order to speed up the calculation of the function TADD for obtaining the coefficients of the equations of the ellipse addition and the straight lines l1 and l2.
[0084]
Next, a description will be given of a second embodiment of the present invention in which the calculation time is reduced by using an expression obtained by expanding a straight line equation used for the intermediate calculation of the pairing calculation.
The equation of the straight lines l1 and l2 corresponding to the ellipse doubling T + T can be expressed as follows in Jacobian coordinates (or simplified coordinates) as described above.
[0085]
11: (Z4 × Z1 ＾ 2 × y−2 × Y1 ＾ 2) − (3 × X1 ＾ 2 + a × Z1 ＾ 4) × (Z1 ＾ 2 × x−X1) = 0 (1)
l2: Z4 ＾ 2 × x−X4 = 0 (2)
In the calculation of the function f corresponding to the ellipse doubling T + T, as shown in the calculation formula of the function f in step S24 in FIG. 3, 11 (Q + S) × 12 (S) and 11 (S) × 12 (Q + S) Needs to be calculated. When the coefficients of the equations of the straight lines l1 and l2 are given, when the function f is directly calculated based on the above equation, the calculation time of 2 × 3 × k × M for substituting the value and 4Mk + 2Sk for updating the function f Required. Here, Mk and Sk represent calculation times for multiplication and squaring in a finite field GF (q ＾ k), and are usually 1Mk = k ＾ 2 × M and 1Sk = k ＾ 2 × S. Therefore, the total required calculation time is 2 × 3 × k × M + 4Mk + 2Sk = (4 × k ＾ 2 + 6 × k) × M + 2 × k ＾ 2 × S.
[0086]
If the right side of l1 is Ax + By + C and the right side of l2 is Dx + E,
11 (Q + S) × 12 (S) = A × D × (xQS × xS) + B × D × (yQS × xS) + A × E × xQS + B × E × yQS + C × D × xS + C × E (5)
11 (S) × 12 (Q + S) = A × D × (xQS × xS) + B × D × (yQS × xS) + A × E × xS + B × E × ys + C × D × xQS + C × E (6)
It becomes. Here, xQ, yQ, xQS, yQS, xS, and yS are coordinates Q of point Q in affine coordinates = (xQ, yQ), coordinates Q + S of point Q + S = (xQS, yQS), and coordinates S of point S, respectively. = (XS, yS) as an input value for the pairing calculation.
[0087]
Therefore, l1 (Q + S) × 12 (S) and l1 (S) × 12 (Q + S) are expanded as in the above equations (5) and (6), and the values of xQS × xS and yQS × xS are determined in advance. If the calculation is performed, the calculation time of the function f in steps S24 and S27 of the program of the algorithm 3 in FIG. 3 can be reduced.
[0088]
6 and 7 are programs created based on the above-described concept. The program in FIG. 6 is a detailed flowchart of the process for calculating the function f in step S24 in FIG.
[0089]
The program in FIG. 6 obtains the values stored in the registers f1, f2, A, B, C, D, E, xQS, yQS, xS, yS, xQSxS, xSyQS, xQSyS, and calculates the calculation results as f1, f2 Is output as
[0090]
The coefficients A and D of the equations of the straight lines l1 and l2 stored in the registers A and D are multiplied, and the multiplication result is stored in the register AD (S81 in FIG. 6).
Next, the coefficients B and D of the equations of the straight lines 11 and 12 stored in the register B and the register D are multiplied, and the multiplication result is stored in the register BD (S82 in FIG. 6).
[0091]
Next, the coefficients A and E of the equations stored in the registers A and E are multiplied, and the multiplication result is stored in the register AE (S83 in FIG. 6).
Next, the coefficients B and E of the equations stored in the register B and the register E are multiplied, and the multiplication result is stored in the register BE (S84 in FIG. 6).
[0092]
Next, the coefficients C and D of the equations stored in the registers C and D are multiplied, and the multiplication result is stored in the register CD (S85 in FIG. 6).
Next, the coefficients C and E of the equations stored in the registers C and E are multiplied, and the multiplication result is stored in the register CE (FIG. 6, S86).
[0093]
Next, the register AD is multiplied by the register xQSxS, and the multiplication result is stored in the register T (S87 in FIG. 6). By the process of step S87, A × D × xQS × xS is stored in the register T.
[0094]
Next, the multiplication of the register BD and the register xSyQS, the multiplication of the register AE and the register xQS, the multiplication of the register BE and the register yQS, and the multiplication of the register CD and the register xS are performed. And the result of the calculation is stored in the register T1 (FIG. 6, S88).
[0095]
Next, a multiplication of the register BD and the register xQSyS, a multiplication of the register AE and the register xS, a multiplication of the register BE and the register yS, and a multiplication of the register CD and the register xQS are performed. And the result of the calculation is stored in the register T2 (FIG. 6, S89).
[0096]
Next, the square calculation of the register f1 is calculated, the calculation result is multiplied by the register T1, and the multiplication result is stored in the register f1 (FIG. 6, S90).
Next, the square calculation of the register f2 is calculated, the calculation result is multiplied by the register T2, and the multiplication result is stored in the register f2 (S91 in FIG. 6).
[0097]
After executing the processing of the program in FIG. 6 until the variable i = 0, the function f is obtained by calculating f = f1 / f2.
According to the program of FIG. 6, the values of xQS × xS and yQS × xS are calculated in advance, and the calculation formulas for calculating 11 (Q + S) × 12 (S) and 11 (S) × 12 (Q + S) are as follows. By using the equations developed based on the above xQS × xS and yQS × xS, the calculation time of 11 (Q + S) × 12 (S) is 6M for substituting the coefficients A to E and 5 kM for substituting the coordinate values. Become. Further, the calculation time of l1 (S) × 12 (Q + S) is 4 kM for substituting coordinate values and 2Mk + 2Sk for updating f1 and f2. Further, 2Mk + 2Sk of f is required.
[0098]
Accordingly, while the calculation time when directly calculating by the conventional calculation method is (4 × k ＾ 2 + 6 × k) × M + 2 × k ＾ 2 × S, the ellipse is doubled in the second embodiment. The calculation time in the case of using an expression obtained by expanding the equation used in the intermediate calculation of the calculation may be (2 × k ＾ 2 + 9 × k + 6) × M + 2 × k ＾ 2 × S. Therefore, it is possible to reduce the calculation time of the function f of the elliptic doubling in the pairing operation.
[0099]
Next, FIG. 7 is a diagram showing a program for calculating the function f in step S27 of the algorithm 3 in FIG.
The program in FIG. 7 obtains the values stored in the registers f1, f2, A, B, C, D, E, xQS, yQS, xS, yS, xQSxS, xSyQS, xQSyS, and calculates f1 and f2. Outputs the result.
[0100]
In FIG. 7, the processing of steps S101 to S107 is the same as the processing of steps S81 to S87 of FIG. 6 described above.
Further, the processing in steps S108 and S109 in FIG. 7 is the same as the processing in steps S88 and S89 in FIG.
[0101]
By the processing in step S108, a value corresponding to l1 (Q + S) × 12 (S) is stored in the register T1. Further, by the processing in step S109, a value corresponding to l1 (S) × 12 (Q + S) is stored in the register T2.
[0102]
Next, the register f1 is multiplied by the register T1, and the multiplication result is stored in the register f1 (S110 in FIG. 7).
Next, the register f2 is multiplied by the register T2, and the multiplication result is stored in the register f2 (FIG. 7, S111).
[0103]
After executing the program of FIG. 7 until the variable i = 0, the function f is obtained by calculating f = f1 / f2.
According to the program of FIG. 7, the values of xQS × xS and yQS × xS are calculated in advance, and the expression for calculating the function f is developed by using the expression developed based on xQS × xS and yQS × xS. , The calculation time can be reduced to 2 × Mk + 9 × k × M + 6 × M = (2 × k ＾ 2 + 9 × k + 6) × M.
[0104]
Therefore, when the conventional calculation method of directly calculating the equation is used, the calculation time of 4Mk + 6 × k × M = (4 × k ＾ 2 + 6 × k) is required, whereas the elliptic addition of the second embodiment is required. If an equation obtained by expanding an equation used in the intermediate calculation of the function f is used, the calculation time may be (2 × k ＾ 2 + 9 × k + 6) × M. Therefore, in the pairing calculation, the calculation time of the elliptic addition function f can be reduced.
[0105]
In the example described above, a case has been described in which both the calculation method of the first embodiment and the calculation method of the second embodiment are applied to the algorithm 3 of FIG. 3, but only one of them is applied. Alternatively, the program may be created. In this case, the calculation time of the pairing calculation can obtain one of the effect of reducing the calculation time according to the first embodiment and the effect of reducing the calculation time according to the second embodiment.
[0106]
Here, an example of a hardware configuration of a pairing encryption device that executes a pairing encryption operation program according to the above-described embodiment will be described with reference to FIG. This pairing encryption device can be realized by, for example, an information processing device such as a personal computer.
[0107]
The CPU 23 executes the above-described calculation program and the like. The ROM 24 stores a control program such as a BIOS. The RAM (memory) 26 is used as various registers used for calculation. The storage device 25 stores an arithmetic program for elliptic curve cryptography and the like.
[0108]
The recording medium reading device 27 is a device that reads or writes on a portable recording medium 28 such as a CDROM, a DVD, a flexible disk, and an IC card.
[0109]
The input device 29 is a device for inputting data such as a keyboard. The communication interface 30 is a device for connecting to a network 31 such as the Internet, and can download a program from a server of an information provider 32 on the network via this device. Note that the CPU 22, the RAM 24, the external storage device 25, and the like are connected by the bus 22.
[0110]
INDUSTRIAL APPLICABILITY The present invention is not limited to a dedicated device for performing encryption and decryption of elliptic curve cryptography, but can be applied to various products such as an IC card, a DVD device, a mobile phone, and a personal computer.
[0111]
(Supplementary Note 1) In a pairing encryption device that processes encryption using pairing for a point on an elliptic curve,
An elliptic curve on a finite field, and storage means for storing points on the elliptic curve;
A pairing encryption device, comprising: a calculation unit that stores a value obtained in a calculation process of elliptic doubling or elliptic addition, and calculates a coefficient of a linear equation of a pairing calculation using the stored value.
[0112]
(Supplementary Note 2) In a pairing encryption device that processes encryption using pairing for a point on an elliptic curve,
An elliptic curve on a finite field, and storage means for storing points on the elliptic curve;
A pairing encryption device comprising: a calculation unit that stores a part of the calculation result of an equation obtained by expanding a straight line equation used in the intermediate calculation of the pairing calculation, and calculates the straight line equation using the stored calculation result. .
[0113]
(Supplementary Note 3) The calculating means uses simplified coordinates representing the coordinates of one point in a set of four elements (X: Y: Z: Z ＾ 2) (＾: power) on the finite field. 3. The pairing encryption device according to claim 1 or 2, wherein the pairing encryption device calculates a pairing operation.
[0114]
(Supplementary Note 4) The calculating means calculates the coordinates of the point Q + S on the elliptic curve as (xQS, yQS), the coordinates of the point S as (xS, yS), and the equation of a straight line connecting the points T and P on the elliptic curve. When the equation of a straight line perpendicular to the x-axis passing through the point T + P is set to l2, the values of xQS × xS and yQS × xS are calculated and stored in advance, and the stored xQS × xS 3. The pairing encryption device according to appendix 1 or 2, wherein the value of (11 (Q + S) × 12 (S) / (11 (S) × 12 (Q + S)) of the pairing operation is calculated using the value of yQS × xS.
[0115]
(Supplementary Note 5) A cryptographic operation program using pairing for a point on an elliptic curve,
An elliptic curve on a finite field and a point on the elliptic curve are stored in storage means,
A pairing cryptographic operation program that holds a part of the calculation result of an expression obtained by expanding a straight line equation used for the intermediate calculation of the pairing operation, and causes the calculation means to execute the calculation of the pairing operation using the held calculation result .
[0116]
(Supplementary Note 6) The calculating means calculates the coordinates T of the point T = (X1: Y1: Z1), the coordinates T + T of the point T + T = (X4: Y4: Z4), a straight line 11 connecting the points T + T, and an x-axis passing through the points T + T. Is calculated using the equation Z1 ＾ 2 and 3 × X1 ＾ 2 + a × Z1 ＾ 4, which are calculated in the calculation process of the ellipse doubling, when the straight line l2 is perpendicular to the straight line l2. The pairing encryption device according to any one of supplementary notes 1 to 5.
[0117]
(Supplementary Note 7) The calculating means calculates the coordinates T of the point T = (X1: Y1: Z1), the coordinates T + P of the point T + P = (X3: Y3: Z3), a straight line 11 connecting the points T + P, and an x-axis passing through the points T + P. When the straight line l2 is perpendicular to, the coefficients of the equations of the straight lines l1 and l2 are calculated using Z3 ＾ 2 and Y2 × Z1 ＾ 3−Y1 calculated in the calculation process of the ellipse addition. 5. The pairing encryption device according to any one of 5.
[0118]
(Supplementary Note 8) The arithmetic means calculates the coordinates T of the point T = (X1: Y1: Z1), the coordinates P + T of the point T + P = (X3: Y3: Z3), and the coordinates T + T = (X4: Y4: Z4) of the point T + T. When a straight line 11 connecting the points T + P (tangent to the point T when P = T) and a straight line 12 perpendicular to the x-axis passing through the points T + P (or the points T + T) are calculated in the calculation process of the ellipse doubling. Using the obtained Z1 に お け る 2 and 3 × X1 ＾ 2 + a × Z1 ＾ 4, a straight line 11. The coefficients of the equation of l2 are calculated, and the coefficients of the equations of the straight lines l1 and l2 in the ellipse addition are calculated using Z3 ＾ 2 and Y2 × Z1 ＾ 3-Y1 calculated in the calculation process of the ellipse addition. The pairing encryption device according to any one of supplementary notes 1 to 5.
[0119]
(Supplementary Note 9) A pairing encryption program for encryption using pairing for a point on an elliptic curve,
An elliptic curve on a finite field and a point on the elliptic curve are stored in storage means,
A pairing cryptographic operation program that stores a value obtained in a calculation process of elliptic doubling or elliptic addition, and causes a calculating unit to calculate a coefficient of a linear equation of a pairing operation using the stored value.
[0120]
(Supplementary Note 10) Calculation of pairing operation using reduced coordinates representing coordinates of one point by a set of four elements (X: Y: Z: Z ＾ 2) (＾: representing power) on a finite field 5. The pairing cryptographic operation program according to Supplementary Note 5 or 9, which performs the following.
[0121]
(Supplementary Note 11) The coordinates of the point Q + S on the elliptic curve are (xQS, yQS), the coordinates of the point S are (xS, yS), the equation of a straight line connecting the point T and the point P on the elliptic curve is 11, and the point T + P is When the equation of a straight line perpendicular to the x-axis passing through is 12, the values of xQS × xS and yQS × xS are calculated and stored in advance, and the stored values of xQS × xS and yQS × xS are calculated as The pairing cryptographic operation program according to Supplementary Note 5, 9 or 10, wherein the program is used to perform a calculation of l1 (Q + S) × 12 (S) / (11 (S) × 12 (Q + S)) of the pairing operation.
[0122]
(Supplementary Note 12) Coordinates T of the point T = (X1: Y1: Z1), coordinates T + T of the point T + T = (X4: Y4: Z4), a straight line 11 connecting the point T + T, and a straight line 12 perpendicular to the x-axis passing through the point T + T And Z1Ｚ2 and 3 × X1 ＾ 2 + a × Z1 ＾ 4 calculated in the calculation process of the ellipse doubling, the straight line l1. The pairing cryptographic operation program according to any one of Supplementary Notes 5, 9 to 11, which causes the equation of l2 to be calculated.
[0123]
(Supplementary Note 13) The coordinates T of the point T = (X1: Y1: Z1), the coordinates T + P of the point T + P = (X3: Y3: Z3), a straight line 11 connecting the points T + P, and a straight line 12 perpendicular to the x-axis passing through the points T + P. Where Z3 ＾ 2 and Y2 × Z1 ＾ 3-Y1 calculated in the elliptic addition calculation process are used to calculate the equations of the straight lines l1 and l2. A pairing cryptographic operation program according to 1.
[0124]
(Supplementary Note 14) The coordinates T of the point T = (X1: Y1: Z1), the coordinates P + T of the point T + P = (X3: Y3: Z3), the coordinates T + T of the point T + T = (X4: Y4: Z4), and the point T + P is When a straight line l1 (tangent to the point T when P = T) and a straight line l2 passing through the point T + P (or the point T + T) and perpendicular to the x-axis, Z1Ｚ2 calculated in the calculation process of the ellipse doubling And 3 × X1 ＾ 2 + a × Z1 ＾ 4, a straight line 11. The coefficients of the equation of l2 are calculated, and the coefficients of the equations of the straight lines l1 and l2 in the ellipse addition are calculated using Z3 ＾ 2 and Y2 × Z1 ＾ 3-Y1 calculated in the elliptic addition calculation process. The pairing encryption operation program according to any one of Supplementary Notes 5 and 9 to 11.
[0125]
【The invention's effect】
According to the present invention, the pairing calculation in the pairing encryption can be speeded up. Further, the calculation time can be reduced by calculating the coefficients of the equation of the straight line used for the pairing operation using the values obtained in the calculation process of the ellipse doubling or the ellipse addition. In addition, the calculation time can be reduced by calculating in advance some values of an equation obtained by expanding a straight line equation used for the intermediate calculation of the pairing calculation.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration of a main part of a pairing encryption device according to an embodiment.
FIG. 2 is a diagram showing a program of an algorithm 2;
FIG. 3 is a diagram showing a program of an algorithm 3;
FIG. 4 is a diagram illustrating a program of a function TDBL according to the first embodiment.
FIG. 5 is a diagram illustrating a program of a function TADD according to the first embodiment.
FIG. 6 is a diagram illustrating a program of a function f according to the second embodiment.
FIG. 7 is a diagram illustrating a program of a function f according to the second embodiment.
FIG. 8 is a diagram illustrating a hardware environment.
FIG. 9 is an explanatory diagram of elliptic addition.
FIG. 10 is an explanatory diagram of elliptic doubling.
FIG. 11 is a diagram showing a program of an algorithm 1;
[Explanation of symbols]
11 Pairing encryption device
12 Operation part
13 arithmetic unit
14 registers
15 Memory
23 CPU
24 ROM
25 Storage device
26 RAM
27 Recording medium reader
29 I / O devices

Claims (5)

In a pairing encryption device that processes encryption using pairing for a point on an elliptic curve,
An elliptic curve on a finite field, and storage means for storing points on the elliptic curve;
A pairing encryption device comprising: a calculation unit that stores a value obtained in a calculation process of ellipse doubling or ellipse addition, and calculates a coefficient of a linear equation of a pairing calculation using the stored value. In a pairing encryption device that processes encryption using pairing for a point on an elliptic curve,
An elliptic curve on a finite field, and storage means for storing points on the elliptic curve;
A pair of storage means for storing a part of the calculation result of an equation obtained by expanding a straight line equation used for the intermediate calculation of the pairing calculation, and calculating the straight line equation using the stored calculation result Ring encryption device. The calculating means performs a pairing calculation using reduced coordinates representing the coordinates of one point with a set of four elements (X: Y: Z: Z ＾ 2) (＾: representing a power) on a finite field. 3. The pairing encryption device according to claim 1, which performs a calculation. The calculating means calculates the coordinates of the point Q + S on the elliptic curve as (xQS, yQS), the coordinates of the point S as (xS, yS), the equation of a straight line connecting the point T and the point P on the elliptic curve, and the point T + P When the equation of a straight line perpendicular to the x-axis passing through is set to 12, the values of xQS × xS and yQS × xS are calculated and stored in advance, and the stored xQS × xS and yQS × xS 4. The pairing encryption device according to claim 1, wherein the value of (1) is used to calculate l1 (Q + S) × 12 (S) / (11 (S) × 12 (Q + S)). A cryptographic operation program using pairing for a point on an elliptic curve,
An elliptic curve on a finite field and a point on the elliptic curve are stored in storage means,
A pairing cryptographic operation in which a calculation result of a part of an expression obtained by expanding a linear equation used for an intermediate calculation of a pairing operation is held, and the calculation means performs a pairing operation using the held calculation result. program.

Images