JP2005316038A - Scalar multiple computing method, device, and program in elliptic curve cryptosystem - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an elliptic curve scalar multiple computing method which can make quick calculation using a small amount of memory in elliptic curve scalar scale computing which requires the resources most in an elliptic curve cryptosystem. <P>SOLUTION: The transform processing of the scalar value is made by calculating on the continuous 2 bits of the scalar value in a scalar multiple computing method which calculates the scalar multiple point from the points on a scalar value and elliptic curve. Then this processing is made left-to-right by calculating for the continuous 2 bits of the scalar value. Thus, it becomes possible to calculate at high speed with a small memory. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to security technology, and more particularly to a message processing method using elliptic curve calculation.

  Elliptic curve cryptography is a kind of public key cryptography proposed by N.Koblitz, V.S. Miller. Public key cryptography includes information that can be disclosed to the public called a public key, and secret information that must be kept secret, called a private key. A public key is used for encryption of a given message and signature verification, and a secret key is used for decryption of a given message and creation of a signature.

  The secret key in elliptic curve cryptography is a scalar value. The security of elliptic curve cryptography comes from the difficulty of solving discrete logarithm problems on elliptic curves. The discrete logarithm problem on an elliptic curve is a problem of obtaining a scalar value d when a certain point P on the elliptic curve and a point dP that is a scalar multiple thereof are given.

  The point on the elliptic curve is a set of numbers that satisfy the definition equation of the elliptic curve. The entire point on the elliptic curve is calculated based on a virtual point called an infinite point, that is, on the elliptic curve. Addition (also called addition) is defined. The addition on the elliptic curve by the same points is particularly called doubling on the elliptic curve.

The addition of two points on the elliptic curve is calculated as follows. When a straight line passing through two points is drawn, the straight line intersects the elliptic curve at another point. The intersecting point and a point that is symmetric with respect to the x-axis are taken as points resulting from the addition. For example, in the case of a Weierstrass-type elliptic curve, the addition of the point (x ₁ , y ₁ ) and the point (x ₂ , y ₂ ) (x ₃ , y ₃ ) = (x ₁ , y ₁ ) + ( x ₂ , y ₂ ) is
x ₃ = ((y ₂ -y ₁ ) / (x ₂ -x ₁ )) ² -x ₁ -x ₂ (Equation 1)
y ₃ = ((y ₂ -y ₁ ) / (x ₂ -x ₁ )) (x ₁ -x ₃ ) -y ₁ (Equation 2)
Is obtained by calculating. Here, the defining formula of the Weierstrass-form elliptic curve is
y ² = x ³ + ax + b (Formula 3)
Given in. That is, when x _i and y _i (i = 1, 2, 3) are substituted for x and y in Equation 3, the equation in Equation 3 holds.

The doubling of the points on the elliptic curve is calculated as follows. If you draw a tangent at a point on the elliptic curve, the tangent will intersect at another point on the elliptic curve. The intersecting point and a point that is symmetric with respect to the x-coordinate are taken as the result of doubling. For example, in the case of a Weierstrass-type elliptic curve, the doubling of the point (x ₁ , y ₁ ) (x ₃ , y ₃ ) = 2 (x ₁ , y ₁ ) = (x ₁ , y ₁ ) + (x ₁ , y ₁ ) is
x ₃ = ((3x ₁ ² + a) / (2y ₁ )) ² -2x ₁ (Formula 4)
y ₃ = ((3x ₁ ² + a) / (2y ₁ )) (x ₁ -x ₃ ) -y ₁ (Formula 5)
Is obtained by calculating.

  Adding a certain number of times to a certain point is called scalar multiplication, the resulting point is called a scalar multiple, and the number of times is called a scalar value.

  In elliptic curve cryptography, encryption, decryption, signature generation or verification of a given message must be performed using elliptic curve computation. In particular, the calculation of the scalar multiplication on the elliptic curve is the calculation that requires the most calculation resources in each processing such as encryption and decryption. Therefore, in order to efficiently execute the elliptic curve cryptography, it is necessary to efficiently calculate the elliptic curve scalar multiplication.

  Non-Patent Document 1 and Non-Patent Document 6 describe the elliptic curve scalar multiplication method.

J.A. Solinas, “Efficient Arithmetic on Koblitz Curves,” Designs, Codes and Cryptography, 19, Kluwer Academic Publishers, pp.195-249, (2000). H. Cohen, A. Miyaji, and T. Ono, “Efficient Elliptic Curve Exponentiation Using Mixed Coordinates,” Advances in Cryptology-ASIACRYPT 1998, LNCS 1514, Springer-Verlag, pp.51-65, (1998). D.V. Bailey, C. Paar, “Optimal Extension Fields for Fast Arithmetic in Public-Key Algorithms,” Advances in Cryptology Crypto '98, LNCS 1462, Springer-Verlag, pp.472-485, (1998). ANSI X9.62 Public Key Cryptography for the Financial Services Industry, The Elliptic Curve Digital Signature Algorithm (ECDSA), (1998) H. Cohen, “A course in computational algebraic number theory,” GTM138, Springer-Verlag, (1993). M. Joye, and S.-M. Yen, “Optimal Left-to-Right Binary Signed-digit Exponent Recoding,” IEEE Transactions on Computers 49 (7), pp.740-748, (2000).

  Cryptographic techniques have become an indispensable element for the secrecy and authentication of electronic information with the development of information and communication networks. Requirements imposed on cryptographic technology include high-speed processing and low memory usage. On the other hand, since the discrete logarithm problem on an elliptic curve is very difficult, the elliptic curve cryptosystem can shorten the key length as compared with a cipher whose safety is based on the difficulty of prime factorization. For this reason, it is possible to perform cryptographic processing even if there are relatively few sources such as computing capacity and memory capacity. However, in a smart card (also referred to as an IC card) or the like, there are few resources that can be used, and cryptographic processing that is excellent in processing speed and memory usage is required so as to perform optimal cryptographic processing within the limited resources.

  Since the technique of Non-Patent Document 1 converts a scalar value expression once, and then executes cryptographic processing using the converted expression, a memory for storing the converted expression is required. Further, if conversion and encryption processing are performed simultaneously, a high-speed method cannot be used as a method for calculating ellipse addition. This is because scalar value conversion is performed from the least significant bit to the most significant bit (right-to-left), while the high-speed calculation method of elliptic addition is directed from the most significant bit to the least significant bit. This is because it is applicable only when left-to-right processing is performed. Therefore, the above technique does not fully consider the reduction of the memory usage and the improvement of the processing speed.

  The technique of Non-Patent Document 6 can perform left-to-right scalar value conversion for a special case, but no consideration is given to a general case.

  The present invention provides an elliptic curve calculation method capable of high-speed calculation and calculation with a small memory by providing a process for converting a scalar value in a left-to-right manner.

  The present invention further provides an encryption processing method, a decryption processing method, a signature creation method, a signature verification method, and a data sharing method using the above elliptic curve calculation method.

  The present invention is an elliptic curve calculation method in elliptic curve cryptography for calculating a scalar multiplication from a scalar value and a point on the elliptic curve in an elliptic curve calculation, the step of performing an operation on two consecutive bits in the scalar value, Have

  In the present invention, the calculation for the two bits may be performed by calculating a 2-bit difference, comparing a 2-bit value, or calculating a 2-bit exclusive OR.

  The present invention also includes a step of encoding the scalar value into a numerical sequence, and a step of calculating a scalar multiple from the encoded numerical sequence and a point on the elliptic curve. You may comprise so that the calculation with respect to 2 bits may be included.

  The present invention also encodes the scalar value into a numerical sequence, creates a precalculation table from the points on the elliptic curve, and calculates a scalar multiplication from the encoded numerical sequence and the precalculation table. And the encoding step may include an operation on the two bits.

  The present invention also includes a step of creating a pre-calculation table from the points on the elliptic curve, and a step of calculating a scalar multiplication from the scalar value and the pre-calculation table, and calculating the scalar multiplication May be configured to include operations on the two bits.

  As described above, according to the scalar multiplication method of the present invention, it is possible to use an elliptic curve calculation method capable of performing scalar value conversion processing left-to-right and performing high-speed calculation and calculation with a small memory. Become.

  According to the present invention, scalar value conversion processing can be executed left-to-right, and message processing using elliptic curve calculation that can be performed at high speed and with small memory becomes possible.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 shows a system configuration in which a computer A101 and a computer B121 to which an elliptic curve calculation method according to the present invention connected by a network 142 is applied are connected by a network.

In order to encrypt the message by the computer A101 in the cryptographic communication system of FIG. 1, P _m + k (aQ) and kQ are calculated and output, and the decryption of the ciphertext is performed by the computer B121. Calculate -a (kQ) from a and kQ,
(P _m + k (aQ))-a (kQ) (Formula 6)
Can be calculated and output. Here, P _m is a message, k is a random number, a is a constant indicating a secret key, Q is a fixed point, and aQ is a point indicating a public key.

Only P _m + k (aQ), kQ is transmitted to the network 142. In order to restore the message P _m , it is necessary to calculate kaQ, that is, a times kQ. However, since the private key a to the network 142 is not sent, only those holding the private key a is becomes possible to restore the P _m.

  In FIG. 1, a computer A101 is equipped with a calculation device such as a CPU 113 and a coprocessor 114, a storage device such as a RAM 103, a ROM 106 and an external storage device 107, and an input / output interface 110 for performing data input / output with the outside of the computer. A display 108, a keyboard 109, and a removable portable storage medium read / write device for operating the computer A101 by the user are connected to the outside.

  Further, the computer A101 realizes the storage unit 102 by a storage device such as the RAM 103, the ROM 106, and the external storage device 107, and an arithmetic device such as the CPU 113 or the coprocessor 114 executes the program stored in the storage unit 102. The data processing unit 112, the scalar multiplication calculation unit 115, and the processing units included therein are realized.

  In this embodiment, the data processing unit 112 functions as an encryption processing unit, and encrypts an input message.

  The scalar multiplication calculation unit 115 calculates parameters necessary for the encryption processing unit 112 to perform encryption. The storage unit 102 stores a constant 104 (for example, an elliptic curve definition formula or a fixed point on the elliptic curve), secret information 105 (for example, a secret key), and the like.

  The computer B121 has the same hardware configuration as the computer A.

  Further, the computer B121 realizes the storage unit 122 by a storage device such as the RAM 123, the ROM 126, and the external storage device 127, and the arithmetic device such as the CPU 133 and the coprocessor 134 executes the program stored in the storage unit 122. The data processing unit 132, the scalar multiplication calculation unit 135, and the processing units included therein are realized.

  In the present embodiment, the data processing unit 132 functions as the decryption processing unit 132 and decrypts the ciphertext 141 that is an encrypted message.

  The scalar multiplication calculator 135 calculates parameters necessary for the decoding processor 132 to perform decoding. The storage unit 122 stores a constant 124 (for example, an elliptic curve definition formula or a fixed point on the elliptic curve), secret information 125 (for example, a secret key), and the like.

  The program may be stored in advance in a storage unit in the computer, or when necessary, the program may be stored from another device via an input / output interface 110 and a medium usable by the computer. The medium that may be introduced into the medium unit refers to, for example, a storage medium that is detachable from the input / output interface, or a communication medium (that is, a network or a carrier wave or a digital signal that propagates through the network).

  FIG. 2 shows how information is transferred by the processing units of the computer A101 and the computer B121.

  Next, an operation when the computer A101 in FIG. 1 encrypts an input message will be described. The message may be any digitized data, and may be any type of text, image, video, sound, etc.

  When receiving the plaintext message (input message 204 in FIG. 2) via the input / output interface 110, the encryption processing unit 112 determines whether or not the bit length of the input plaintext message is a predetermined bit length. When the bit length is longer than a predetermined bit length, the plaintext message is divided so as to have a predetermined bit length. Hereinafter, a partial message (also simply referred to as a message) divided into a predetermined bit length will be described.

Next, the encryption processing unit 112 calculates the value of the y coordinate (y ₁ ) of the point P _m on the elliptic curve having the numerical value represented by the bit string of the message at the x coordinate (x ₁ ).

For example, the Weierstrass-type elliptic curve, when A and B are constants,
y ₁ ² = x ₁ ³ + Ax1 + B (Formula 7)
Therefore, the y-coordinate value can be obtained from this.

  Next, the encryption processing unit 112 generates a random number k. Then, the public key aQ and the x coordinate of Q read from the constant 104 stored in the storage unit 102 (205 in FIG. 2), the obtained y coordinate value, and the random number k are sent to the scalar multiplication unit 115 (FIG. 2 of 206).

The scalar multiplication calculation unit 115 calculates the x-coordinate and y-coordinate values of Q, and the scalar multiplication point (x _d1 , y _d1 ) = kQ based on the random number k, the x-coordinate of the public key aQ, the y-coordinate value, and the scalar multiplication based on the random number. The point (x _d2 , y _d2 ) = k (aQ) is calculated, and the calculated scalar multiple is sent to the encryption processing unit 112 (207 in FIG. 2).

The encryption processing unit 112 performs encryption processing using the sent scalar multiple. For example, for a Weierstrass-type elliptic curve, P _m + k (aQ) and kQ are calculated. That is,
x _e1 = ((y _d1 -y ₁ ) / (x _d1 -x ₁ )) ² -x ₁ -x _d1 (Equation 8)
x _e2 = x _d2 (Formula 9)
To obtain encrypted messages x _e1 and x _e2 .

  The computer A101 assembles an encrypted output message from the one or more partial messages encrypted by the encryption processing unit 112 (208 in FIG. 2).

  The computer A101 outputs the encrypted message as data 141 from the input / output interface 110, and transfers it to the computer B121 via the network 142.

  Note that the information read from the storage unit 102 in FIG. 2 may be performed before the input message is received as long as the information is not sent to the scalar multiplication unit 115.

  Next, the operation when the computer B 121 decrypts the encrypted message 141 will be described with reference to FIG.

  When the encrypted data 141 (input message 204 in FIG. 2) is input via the input / output interface 110, the decryption processing unit 132 (data processing unit 112 in FIG. 2) receives the input encrypted data. It is determined whether the bit length of the data 141 is a predetermined bit length. If the bit length is longer than the predetermined bit length, the encrypted data is divided so as to have the predetermined bit length. Hereinafter, partial data (also simply referred to as data) divided into a predetermined bit length will be described.

  The value of the y coordinate on the elliptic curve having the numerical value represented by the bit string of the data 141 at the x coordinate is calculated.

If the encrypted message is a bit string of x _e1 and x _e2 and is a Weierstrass-type elliptic curve, the y coordinate value (y _e1 ) is
y _e1 ² = x _e1 ³ + Ax _e1 + B (Formula 10)
(However, A and B are constants)
Can be obtained from

The decryption processing unit 132 reads the secret key a (205 in FIG. 2) stored in the storage unit 122 (102 in FIG. 2) (205 in FIG. 2) and the values of the x and y coordinates (x _e2 , y _e2 ) is sent to the scalar multiplication unit 135 (115 in FIG. 2) (206 in FIG. 2).

The scalar multiplication calculator 135 calculates a scalar multiple (x _d3 , y _d3 ) = a (x _e2 , y _e2 ) from the x-coordinate and y-coordinate values and the secret information a125. The scalar multiplication calculator 135 sends the calculated scalar multiple to the decoding processor 132 (207 in FIG. 2). The decoding processing unit 132 performs a decoding process using the sent scalar multiple.

For example, if the encrypted message is a bit string of x _e1 and x _e2 and a Weierstrass-type elliptic curve,
(P _m + k (aQ))-a (kQ) = (x _e1 , y _e1 )-(x _d3 , y _d3 ) (Formula 11)
This is achieved by calculating That is,
x _f1 = ((y _e1 + y _d3 ) / (x _e1 -x _d3 )) ² -x _e1 -x _d3 (Equation 12)
And x _f1 corresponding to the partial message x ₁ before being encrypted is obtained.

  The computer B 121 assembles a plain text message from the partial message decrypted by the decryption processing unit 132 (208 in FIG. 2), and outputs it from the display 108 or the like via the input / output interface 110.

  Next, the processing of the scalar multiplication calculation unit 115 when the computer A101 performs encryption processing will be described in detail.

  In the first embodiment, the functional block of the scalar multiplication calculator shown in FIG. 3 is used. The scalar multiplication calculation unit 115 (115 in FIG. 1) includes an encoding unit 302 and an actual calculation unit 304. The encoding unit 302 includes a BinaryToMOF encoding unit 305 and a MOFTo2cMOF encoding unit 306. The BinaryToMOF encoding unit 305 includes a repetition determination unit 351 and a conversion unit 352. The MOFTo2cMOF encoding unit 306 includes a repetition determination unit 361 and a conversion unit 362. The actual calculation unit 304 includes a bit value determination unit 341, an addition unit 342, a doubling unit 343, and a repetition determination unit 344.

  A first calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 302 encodes the input scalar value d into a numeric string d _w [j]. That is,
d = d _w [n] 2 ⁿ + d _w [n-1] 2 ^n-1 +… + d _w [j] 2 ^j +… + d _w [0] (Equation 13)
-2 ^w-1 ≤d _w [j] ≤2 ^w-1 , d _w [j] = 0 or odd (equation 14)
Convert scalar value d to d _w [j] that satisfies Here, w is a predetermined small positive integer and is called a window width. If priority is given to calculation time, set w to a large value. Set w to a small value to reduce memory usage. The actual calculation unit 304 calculates a scalar multiple dP using the encoded scalar value and the input point P. In the first embodiment, a case where w = 2 is described.

  Next, each process performed by the encoding unit 302 and the actual calculation unit 304 will be described in detail.

First, processing performed by the encoding unit 302 will be described.
The encoding unit 302 converts the binary string d into a signed binary string cmd.

  When the binary string d is input to the encoding unit 302, the BinaryToMOF encoding unit 305 converts the binary string d into a signed binary string md.

  The MOFTo2cMOF encoding unit 306 converts the signed binary string md converted by the BinaryToMOF encoding unit 305 into another signed binary string cmd.

The encoding unit 302 outputs the signed binary sequence cmd converted by the MOFTO2cMOF encoding unit 306 as an encoded numeric sequence d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

Next, processing performed by the BinaryToMOF encoding unit 305 will be described in detail with reference to FIG. This process is configured with 2d-d conversion in mind. However, this subtraction is a bit-by-bit subtraction and can take a negative value (−1). In the signed binary string md, the value of the j-th bit is expressed as md _j .

The conversion unit 352 substitutes d _n−1 for md _n (401).

  An initial value n-1 is assigned to variable i (402).

Conversion unit 352 calculates the d _i-1 d _i, and substitutes the md _i (403).

  The repetition determination unit 351 determines whether i> 1. If i> 1, go to step 411. If i <= 1, go to step 421 (404).

If i> 1 in step 404,
The variable i is decreased by 1, and the process returns to step 403 (411).

If i <= 1 in step 404,
The conversion unit 352 substitutes d ₀ for md ₀ (421).

Output md _n , ..., md ₀ as a converted signed binary string md (422).

Incidentally, md _i output by the BinaryToMOF encoding unit 305 0,1, can take only one of the values of -1. This is because md _i is assigned only d _i or d _i-1 -d _i , and d _i is available and only 0 and 1 can be taken.

  In this specification, this signed binary representation md is referred to as MOF representation. In MOF representation, non-zero bits always have a different sign from the adjacent non-zero bits, ignoring zero-value bits. For example, the MOF representation of the bit string 1010011 is 1, -1,1, -1,0,1,0, -1. If the zero value bit is ignored, it can be seen that the sign of the adjacent non-zero bit is inverted.

Next, processing performed by the MOFTo2cMOF encoding unit 306 will be described in detail with reference to FIG. This process converts the most significant bit into the process of converting to (0,1) and (0, -1), respectively, when the value of two adjacent bits is (1, -1) or (-1,1). From the side. In the signed binary string cmd, the value of the j-th bit is expressed as cmd _j .

  The variable i is initialized with n (501).

The conversion unit 362 distributes the process according to the value of (md _i , md _i-1 ). If (md _i , md _i-1 ) = (1, -1), go to step 511. If (md _i , md _i−1 ) = (− 1, 1), go to step 512. If (md _i , md _i-1 ) is any other value, the process goes to step 503 (502).

If (md _i , md _i-1 ) = (1, -1) in step 502,
Conversion unit 362 substitutes 1 to the _{0, cmd i-1 cmd i} , go to step 513 (511).

If (md _i , md _i-1 ) = (-1,1) in step 502,
Conversion unit 362 substitutes -1 0, cmd _i-1 in cmd _i, go to step 513 (512).

  Decrease variable i by 2 and go to step 505 (513).

If (md _i , md _i-1 ) is a value other than (1, -1), (-1,1) in step 502,
The conversion unit 362 substitutes md _i for cmd _i and goes to step 504 (503).

  Decrease the variable i by 1 and go to step 505 (504).

  The repetition determination unit 361 determines whether i> = 1. If i> = 1, the process returns to step 502. If i <1, go to step 506 (505).

If i <1 in step 505,
Determine if i = 0. If i = 0, go to step 507. If i! = 0, go to step 508 (506).

If i = 0 in step 506,
The conversion unit 362 substitutes md ₀ for cmd ₀ and goes to step 508 (507).

cmd _n , ..., cmd ₀ are output as a converted signed binary string cmd (508).

Note that cmd _i output from the MOFTo2cMOF encoding unit 306 can take only one of 0, 1, and -1. This is because only 0, 1, -1 or md _i is assigned to cmd _i , and md _i is the output of the BinaryToMOF encoding unit 305 and can take only 0, 1, -1.

As a result, d _w [j] output from the encoding unit 302 can take only one of 0, 1, and -1.

  In this specification, this signed binary representation cmd is referred to as a 2cMOF representation.

  Finally, a method for calculating a scalar multiple point in an elliptic curve from the encoded scalar value and a point on the elliptic curve will be described with reference to FIG.

   The initial value n is assigned to the variable c (601).

d _w Determine whether [c] is 0 or 0.

If d _w [c] is 0, go to Step 603. If not 0, go to step 611 (602).

   The variable c is decreased by 1, and the process returns to step 602 (603).

If d _w [c] is not 0 in step 602, assigns the d _w [c] P to the point Q (611).

   The initial value c-1 is assigned to the variable j (612).

   The repetition determination unit 344 determines whether j is smaller than 0. If j is smaller than 0, go to Step 621. If it is greater than 0, go to step 614 (613).

If j is greater than or equal to 0 in step 613,
The doubling unit 343 doubles the point Q by ECDBL and stores it again at the point Q (614).

The bit value determination unit 341 determines whether d _w [j] is 0 or not 0. If d _w [j] is 0, go to Step 617. If not 0, go to step 616 (615).

If d _w [j] is not 0 in step 615,
The adding unit 342 adds the point Q and d _w [j] P by ECADD. However, when d _w [j] is negative, addition is performed using the inverted y coordinate of (−d _w [j]) P. The result is stored at point Q and the process goes to step 617 (616).
When d _w [j] is not 0, d _w [j] is 1 or −1, and d _w [j] P represents either P or −P.

   The variable j is decreased by 1, and the process returns to step 613 (617).

If j is less than 0 in step 613,
The point Q is output (621).

  Note that for the point Q = (x, y) on the elliptic curve, the inverse element point -Q relating to the addition of the elliptic curve is expressed as -Q = (x, -y). It can be easily calculated if given. Therefore, if only the point P is held, the point -P necessary for the calculation performed by the actual calculation unit 304 can be derived from them.

  ECADD and ECDBL represent addition and doubling on an elliptic curve, respectively. Addition is calculated using equations 1 and 2, and doubling is calculated using equations 4 and 5, respectively. Note that, in addition to using Equations 1, 2 and Equations 4 and 5 for addition and doubling calculations, there are calculation formulas in projective coordinates and Jacobian coordinates, which are described in Non-Patent Document 2. In particular, by expressing the point P as affine coordinates, it is possible to calculate at high speed.

  The point Q output from the actual calculation unit 304 is equal to the scalar multiple dP. The reason is as follows.

In step 613, point Q is
(d _w [c] 2 ^{c- (j + 1)} + d _w [c-1] 2 ^{(c-1)-(j + 1)} +… + d _w [j + 1] 2 ^{(j + 1) -(j + 1)} ) P (Formula 15)
It is assumed that At this time, the point Q indicates that the equation 15 is satisfied even when the next step 613 is reached.

Point Q is doubled at step 614 and d _w [j] P is added at step 616 if d _w [j] is not zero. So immediately after step 616, the value of point Q is
(d _w [c] 2 ^cj + d _w [c-1] 2 ^{(c-1) -j} +… + d _w [j + 1] 2 ^{(j + 1) -j} + d _w [j] 2 ^jj ) P (Formula 16)
It becomes. Therefore, the point Q satisfies Equation 16 immediately before step 617, including when d _w [j] = 0. Since j is decreased by 1 in step 617, substituting j + 1 for j in equation 16 yields equation 15. That is, the next time when coming to step 613, the point Q satisfies the equation 15.

Since the value of d _w [j] for j> c is 0, the value of the point Q output in step 621 is
(d _w [n] 2 ⁿ + d _w [n-1] 2 ^n-1 +… + d _w [0]) P (Equation 17)
be equivalent to. Since the scalar value input to the actual calculation unit 304 is d _w [j] encoded by the encoding unit 302, the d _w [j] satisfies Equation 13. Therefore, Q = dP.

The signed binary string md output by the BinaryToMOF encoding unit 305 is
d = md _n 2 ⁿ + md _n-1 2 ^n-1 +… + md ₀ (Equation 18)
Meet. The reason is as follows.
In step 401, d _n-1 is stored in md _n , d _i-1 -d _i is stored in md _i in step 403, and d ₀ is stored in md ₀ in step 421. Therefore,
md _n 2 ⁿ + md _n-1 2 ^n-1 +… + md ₀
= d _n-1 2 ⁿ + (d _n-2 d _n-1 ) 2 ^n-1 + (d _n-3 d _n-2 ) 2 ^n-2 + ... + (d ₀ -d ₁ ) 2 + d ₀
= d _n-1 2 ^n-1 + d _n-2 2 ^n-2 + ... + d ₁ 2 + d ₀
= d (Equation 19)
Holds.

The signed binary string cmd output by the MOFTo2cMOF encoding unit 306 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Formula 20)
Meet. The reason is as follows.
If (md _i , md _i-1 ) = (1, -1), (-1,1) in step 502, cmd _i , cmd _i-1 and md _i , md determined by the conversion in step 511 and step 512 _{Between i-1}
cmd _i 2 ⁱ + cmd _i-1 2 ^i-1 = md _i 2 ⁱ + md _i-1 2 ^i-1 (Formula 21)
The relationship holds. Also, if (md _i , md _i-1 ) = (1, -1), (-1,1) other than (md _i ) in step 502, there is a gap between cmd _i , and md _i , determined by the conversion in step 503.
cmd _i 2 ⁱ = md _i 2 ⁱ (Formula 22)
The relationship holds. In step 507, md ₀ is assigned to cmd ₀ . Therefore,
cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ = md _n 2 ⁿ + md _n-1 2 ^n-1 +… + md ₀ (Equation 23)
Holds. Since md is the output of 305 of the BinaryToMOF encoding unit, Equation 13 is satisfied. Therefore, Equation 18 holds.

As a result, the numerical sequence d _w [j] output from the encoding unit 302 satisfies Expression 13.

The processing performed by the BinaryToMOF encoding unit 305 is left-to-right. This is because, in step 401, the value of md _n is assigned using the value of d _n-1 , and then in step 403, the value of md _i is determined using d _i and d _i-1 in descending order of _i. Finally, in step 421, the value of md ₀ is assigned using d ₀ .

In the first embodiment, the case where the processing of the BinaryToMOF encoding unit 305 is performed left-to-right has been described, but right-to-left processing and parallel processing are also possible. This is because each md _i is determined from d _i and d _i−1, and the result of other md _j is not used. Therefore, when processing with right-to-left by sequentially determined from i is smaller, also by performing the calculation of md _i of interest simultaneously when performing in parallel, it is possible to calculate.

The processing performed by the MOFTo2cMOF encoding unit 306 is left-to-right. This is because in Step 511, Step 512, and Step 503, the values of cmd _i and cmd _i-1 are determined using md _i and md _i-1 from the largest i in order, and finally md ₀ is set in Step 507. This is because the value of cmd ₀ is assigned.

  As a result, the processing performed by the encoding unit 302 is left-to-right.

The md output from the BinaryToMOF encoding unit 305 represents the transition probability of the value of the appearance bit and has the following transition probability.
0 → 0: 1/2, 0 → non-zero: 1/2, non-zero → 0: 1/2, non-zero → non-zero: 1/2 (Formula 24)
That is, 0 and non-zero are independent. The reason is as follows. Each md _i is determined by d _i-1 d _i and does not depend on other md _j . By considering two cases of 0 and 1 as the values of d _i-1 and d _i , it can be seen that 0 and non-zero values each have a probability of 1/2. Therefore, it can be seen that the above transition probability is taken.

Next, cmd output from the MOFTo2cMOF encoding unit 306 has a non-zero density of 1/3. Here, the non-zero density indicates an asymptotic value of (number of non-zero bits) / (bit length). The reason is as follows.
The conversion from step 502 to step 505 has four possible states depending on the values of md _i and md _i−1 . That is, (a) 00, (b) 01, (c) 10, (d) 11. However, 1 here represents non-zero. In step 513, i is decreased by 2, so that another state (e) is compensated. Since the transition probability of MOF expression is given by Equation 24, the transition probability between these is
(a) → (a): 1/2, (a) → (b): 1/2,
(b) → (c): 1/2, (b) → (d): 1/2,
(c) → (a): 1/2, (c) → (b): 1/2,
(d) → (e): 1,
(e) → (a): 1/4, (e) → (b): 1/4, (e) → (c): 1/4, (e) → (d): 1/4 (Formula 25 )
It becomes. When calculating the steady state determined from this transition probability,
(a): 1/4, (b): 1/4, (c): 1/6, (d): 1/6, (e): 1/6 (Formula 26)
It becomes. Since the non-zero bit is output corresponding to the states (c) and (d), the non-zero density is 1/3. Non-Patent Document 1 shows that when the window width w is 2, the non-zero density 1/3 is the smallest.

  Therefore, the output of the encoding unit 302 is also 1/3 of the non-zero density, which is the minimum non-zero density.

The number of elliptical additions performed by the adding unit 342 of the actual calculation unit 304 is the number of non-zero bits of the encoded signed binary string. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.
As described above, the above calculation method can perform the encoding process left-to-right. In addition, since the encoded numerical sequence has the minimum non-zero density, the number of times of ellipse addition can be reduced, so that it can be calculated at high speed.

  In the first calculation method, the Weierstrass-type elliptic curve is used as the elliptic curve, but the elliptic curve defined on the finite field of characteristic 2 or the OEF (Optimal An elliptic curve defined on Extension Field) or a Montgomery-type elliptic curve may be used.

  In the second embodiment, a method for simultaneously executing the two encoding processes of the first embodiment will be described. In the second embodiment, the functional block of the scalar multiplication calculator shown in FIG. 7 is used. The scalar multiplication calculation unit 115 (115 in FIG. 1) includes an encoding unit 702 and an actual calculation unit 704. The encoding unit 702 includes a repetition determination unit 721 and a conversion unit 722. The actual calculation unit 704 has the same configuration as the actual calculation unit 304 of the first embodiment.

  A second calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 702 converts the input scalar value d into a numerical sequence d _w [ j]. The actual calculation unit 704 calculates a scalar multiple dP using the encoded scalar value and the input point P. In the second embodiment, a case where w = 2 is described.

  Next, each process performed by the encoding unit 702 and the actual calculation unit 704 will be described in detail.

  First, processing performed by the encoding unit 702 will be described.

When the binary string d is input to the encoding unit 702, it is converted into a signed binary string cmd. The encoding unit 702 outputs the signed binary string cmd as an encoded numeric string d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

  Next, processing performed by the actual calculation unit 704 will be described. The process performed by the actual calculation unit 704 is the same as the process performed by the actual calculation unit 304 of the first embodiment.

  Next, processing performed by the encoding unit 702 will be described in detail with reference to FIG.

Substitute initial value c + 1 for variable i. Here, c is the largest index of non-zero bits of d. That is, d _i = 0 (801) for d _c ! = 0 and i> c.

The conversion unit 722 substitutes 0 for d−1 and substitutes 0 for cmd _n ,..., Cmd _{c + 1} (802).

  The repetition determination unit 721 determines whether i> = 1. If i> = 1, go to Step 811. If i <1, go to Step 821 (803).

If i> = 1 in step 803,
Determine whether d _i-1 = d _i . If d _i−1 = d _i , go to step 812. If d _i-1 ! = d _i , go to Step 813 (811).

If d _i-1 = d _i in step 811,
The conversion unit 722 assigns 0 to cmd _i , decreases the variable i by 1, and returns to step 803 (812).

If d _i-1 ! = D _{i in} step 811,
The conversion unit 722 -d _i + d _i-2 in cmd _i, by substituting the _{d i-2 + d i-} 1 to cmd _i-1, the variable i 2 is reduced, the flow returns to step 803 (813).

If i <1 in step 803,
Determine if i = 0. If i = 0, go to step 822. If i! = 0, go to Step 823 (821).

If i = 0 in step 821,
The conversion unit 722 substitutes d ₀ for cmd ₀ and goes to Step 823 (822).

cmd _n , ..., cmd ₀ are output as the converted signed binary string cmd (823).

Note that d _w [j] output from the encoding unit 702 can take only one of 0, 1, and -1. This is because each bit d _i of the scalar value d takes only 0 or 1 and cmd _j is substituted with 0, −d _i or one of the differences between the two d _i .

The signed binary string cmd output from the encoding unit 702 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Equation 27)
Meet. The reason is as follows.
In the loop in Step 803 to Step 813, d _i 2 ^{i + 1} is a carry and becomes an invariant in the loop. First, consider the case where the process proceeds to step 812 by the branch process of step 811. In step 812, 0 is assigned to cmd _i .
cmd _i 2 ⁱ + d _i 2 ^{i + 1} = d _i 2 ⁱ + d _i 2 ⁱ
= d _i 2 ⁱ + d _i-1 2 ⁱ (Equation 28)
Thus, term for d _i is d _i 2 ^i, and becomes a carry d _i-1 2 ^i. Next, consider a case where the process goes to step 813 by the branch process of step 811.
cmd _i 2 ⁱ + cmd _i 2 ^i-1 + d _i 2 ^{i + 1} = (-d _i + d _i-2 ) 2 ⁱ + (d _i-2 + d _i-1 ) 2 ^i-1 + d _i 2 ^{i + 1}
= d _i 2 ⁱ + d _i-1 2 ^i-1 + d _i-2 2 ^i-1 (Equation 29)
Therefore, the terms for d _i and d _i−1 are d _i 2 ⁱ and d _i−1 2 ⁱ⁻¹ , respectively, and carry d _i−2 2 ⁱ⁻¹ . Therefore, it was found that d _i 2 ^{i + 1} is an invariant in the loop as a carry. The value of i when first coming to step 803 is i = c + 1,
d _{c + 1} 2 ^{c + 2} = 0 (Equation 30)
Therefore, the carry becomes 0. On the other hand, in the processing after exiting the loop, the carry value is d ₀ 2 or d ₋₁ 1. If i = 0, the process of step 822 is performed, and in either case, the carry is canceled. In summary,
cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ = d _n 2 ⁿ + d _n-1 2 ^n-1 +… + d ₀ = d (Equation 31)
It becomes.

Processing performed by the encoding unit 702 is left-to-right. This is because the values of cmd _n ,..., Cmd _{c + 2} are cleared in step 802, and then in steps 812 and 813, d _i , d _i-1 and d _i-2 are set in descending order of _i. This is because the values of cmd _i and cmd _i−1 are determined by using and finally the value of cmd ₀ is assigned using d ₀ in step 821.

  In the signed binary string cmd output from the encoding unit 702, the non-zero density is 1/3, which is the minimum non-zero density. This is because the output of the encoding unit 702 matches the output of the encoding unit 302 of the first embodiment.

  The number of elliptical additions performed by the adding unit 742 of the actual calculation unit 704 is the number of non-zero bits of the encoded signed binary string. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.

  As described above, the above calculation method can perform the encoding process left-to-right. In addition, since the encoded numerical sequence has a minimum non-zero density, the number of times of ellipse addition can be reduced, so that it can be calculated at high speed. Further, in the second embodiment, the encoding process is performed once, so that there are merits such as speeding up of the encoding process, simplification of the program and downsizing of the hardware logic circuit.

  In the second calculation method, the Weierstrass-type elliptic curve was used as an elliptic curve, but an elliptic curve defined on a characteristic 2 finite field or an ellipse defined on OEF (Optimal Extension Field) Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the third embodiment, the encoding process in the first embodiment and the second embodiment will be incorporated into the process performed by the real calculation unit, and a method of sequential conversion and use when performing an elliptic operation will be described. In the third embodiment, the functional block of the scalar multiplication calculator shown in FIG. 9 is used. The scalar multiplication calculation unit 115 (115 in FIG. 1) includes an actual calculation unit 904. The actual calculation unit 904 includes a conversion determination unit 941, an addition unit 942, a doubling unit 943, and a repetition determination unit 944.

  A third calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

  When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the actual calculation unit 904 uses the input scalar value and the input point P to determine the scalar multiple dP. Calculate In the third embodiment, a case where w = 2 is described.

  Next, processing performed by the actual calculation unit 904 will be described in detail with reference to FIGS.

Substitute 0 for d- ₁ and c + 1 for variable i. Here, c is the largest index of non-zero bits of d. That is, d _c ! = 0 and d _i = 0 (1001) for i> c.

The conversion determination unit 941 determines whether d _i−2 = 1. If d _i−2 = 1, go to step 1003. If d _i-2 ! = 1, go to step 1004 (1002).

If d _i-2 = 1 in step 1002,
The doubling unit 943 doubles the point P by ECDBL, stores it at the point Q, and goes to Step 1005 (1003).

If d _i-2 ! = 1 in step 1002,
Point P is stored in point Q, and the process goes to step 1005 (1004).

  Decrease variable i by 2 (1005).

  The repetition determination unit 944 determines whether i> 0. If i> 0, go to step 1111. If i <= 0, go to step 1007 (1006).

If i> 0 in step 1006,
The conversion determination unit 941 determines whether di-1 = d. If d _i−1 = d _i , go to step 1121. If d _i-1 ! = d _i , go to step 1112 (1111).

If d _i-1 = d _i in step 1111,
The doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q (1121).

  The variable i is decreased by 1, and the process returns to step 1006 (1122).

If d _i-1 ! = D _{i in} step 1111,
The doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q (1112).

The conversion determination unit 941 distributes processing according to the value of (d _i , d _i−2 ). If (d _i , d _i−2 ) = (1,1), go to step 1114. If (d _i , d _i−2 ) = (1,0), go to step 1115. If (d _i , d _i−2 ) = (0,1), go to step 1116. If (d _i , d _i−2 ) = (0,0), go to step 1117 (1113).

If (d _i , d _i-2 ) = (1,1) in step 1113,
The doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q. Thereafter, the adding unit 942 adds the point Q and the point −P by ECADD, and stores the result in the point Q. Thereafter, the process goes to Step 1118 (1114).

If (d _i , d _i-2 ) = (1,0) in step 1113,
The adding unit 942 adds the point Q and the point −P by ECADD, and stores the result in the point Q. Thereafter, the doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q. Thereafter, the process goes to Step 1118 (1115).

If (d _i , d _i-2 ) = (0,1) in step 1113,
Adder 942 adds point Q and point P by ECADD, and stores the result at point Q. Thereafter, the doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q. Thereafter, the process goes to step 1118 (1116).

If (d _i , d _i-2 ) = (0,0) in step 1113,
The doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q. Thereafter, the adding unit 942 adds the point Q and the point P by ECADD, and stores the result at the point Q. Thereafter, the process goes to Step 1118 (1117).

  Decrease the variable i by 2 and return to Step 1006 (1118).

If i <= 0 in step 1006,
Determine if i = 0. If i = 0, go to step 1008. If i! = 0, go to step 1009 (1007).

If i = 0 in step 1007,
The doubling unit 943 doubles the point Q by ECDBL and stores it again at the point Q. Thereafter, the adding unit 942 adds the point Q and the point −d0P by ECADD, and stores the result at the point Q. Thereafter, the process goes to Step 1009 (1008).

  The point Q is output as a scalar multiple dP (1009).

The point Q output from the actual calculation unit 904 is equal to the scalar multiple dP. The reason is as follows.
First, consider the processing of step 1112-step 1118. In this case, d _i = d _i−1 holds. When (d _i , d _i−2 ) = (1, 1), the operations executed in steps 1112 and 1114 are cmd _i = 0 and cmd _i−1 = −1. This is the same as when input to the actual calculation unit 704. Also, the encoding unit 702 of the second embodiment performs (cmd _i , cmd _i ) by the process of step 813 when the input is (d _i , d _i-1 , d _i-2 ) = (1, 1, 1). _-1 ) = (0, -1) is output. Therefore, the processing in this case is the same between the third embodiment and the second embodiment. Similarly, the processing of step 1112 and step 1115 is (cmd _i , cmd _i-1 ) = (-1,0), and the processing of step 1112 and step 1116 is (cmd _i , cmd _i-1 ) = (1 , 0), step 1112, and step 1117 correspond to (cmd _i , cmd _i-1 ) = (0, 1), respectively, and correspond to the processing of step 813. Similarly, when d _i ,! = D _i−1 , the process at step 1121 corresponds to the process at step 812. Other portions can be handled in the same manner as the processing of the encoding unit 702 of the second embodiment. Therefore, the point Q output from the actual calculation unit 904 is equal to the scalar multiple dP.

  Further, due to the correspondence with the second embodiment, the processing performed by the actual calculation unit 904 is left-to-right.

  The number of ellipse additions performed by the actual calculation unit 904 is minimum. This is because the processing performed by the conversion determination unit 941 of the actual calculation unit 904 can correspond to the processing of the encoding unit 702 of the second embodiment.

  As described above, the above calculation method can perform left-to-right scalar multiplication. In addition, since the number of times of ellipse addition is minimized, the calculation can be performed at high speed. In the third embodiment, since the encoding process and the ellipse calculation are performed once, it is not necessary to store the encoding result in the memory once, and the memory usage can be reduced.

  In the third calculation method, the Weierstrass-type elliptic curve was used as the elliptic curve. Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the fourth embodiment, a description will be given of a method in which the calculation method of the first embodiment is expanded to a general window width w. In the fourth embodiment, the functional block of the scalar multiplication unit shown in FIG. 12 is used. The scalar multiplication calculation unit 115 (135 in FIG. 1) includes an encoding unit 1202, a previous calculation unit 1203, and an actual calculation unit 1204. The encoding unit 1202 includes a BinaryToMOF encoding unit 1205 and a MOFTowcMOF encoding unit 1207. The BinaryToMOF encoding unit 1205 has the same configuration as the BinaryToMOF encoding unit 305 of the first embodiment. The MOFTowcMOF encoding unit 1207 includes an iterative determination unit 1271 and a conversion unit 1272. The pre-calculation unit 1203 includes an addition unit 1231, a doubling unit 1232, and an iterative determination unit 1233. The actual calculation unit 1204 has the same configuration as the actual calculation unit 304 of the first embodiment.

  A fourth calculation method in which the scalar multiplication calculator 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 1202 converts the input scalar value d into a numerical sequence d _w [ j]. The pre-calculation unit 1203 creates a pre-calculation table from the input point P on the elliptic curve. The pre-calculation table is composed of P, 3P, ..., (2 ^w-1 -1) P. The actual calculation unit 1204 calculates the scalar multiple dP using the encoded scalar value and the pre-calculation table.

  The encoding process performed by the encoding unit 1202 may be performed after the scalar value d is received and before the actual calculation unit 1204 calculates the scalar multiple. That is, it may be performed before or after the pre-calculation unit 1203 creates the pre-calculation table.

  When the point P is a fixed point, the pre-calculation table creation process performed by the pre-calculation unit 1203 may be performed only once. That is, once a pre-calculation table is created, it is not necessary to re-create the pre-calculation table for subsequent scalar multiplication.

  Next, each process performed by the encoding unit 1202, the previous calculation unit 1203, and the actual calculation unit 1204 will be described in detail.

First, processing performed by the encoding unit 1202 will be described.
The encoding unit 1202 converts the binary string d into a numeric string cmd.

  When the binary string d is input to the encoding unit 1202, the BinaryToMOF encoding unit 1205 converts the binary string d into a signed binary string md.

The MOFTowcMOF encoding unit 1207 converts the signed binary string md converted by the BinaryToMOF encoding unit 1205 into a numeric string cmd. However, the possible values for each numeric cmd _{i in} the numeric column cmd are:
-2 ^w-1 ≤cmd _i ≤2 ^w-1 , cmd _i = 0 or odd (equation 32)
It is.

The encoding unit 1202 outputs the numerical sequence cmd converted by the MOFTowcMOF encoding unit 1207 as an encoded numerical sequence d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

  Next, processing performed by the BinaryToMOF encoding unit 1205 will be described. The processing performed by the BinaryToMOF encoding unit 1205 is the same as the processing performed by the BinaryToMOF encoding unit 305 of the first embodiment.

  Next, processing performed by the MOFTowcMOF encoding unit 1207 will be described with reference to FIG.

  The variable i is initialized with n (1301).

The conversion unit 1272 determines whether md _i = 0. If md _i = 0, go to step 1303. If md _i ! = 0, go to step 1311 (1302).

If md _i = 0 in step 1302,
Conversion unit 1272 substitutes md _i in cmd _i (1303).

  Decrease the variable i by 1 and go to step 1305 (1304).

If md _i ! = 0 in step 1302,
The conversion unit 1272 sets j to the minimum of j satisfying md _j ! = 0 in the range of i> = j> = i− (w−1) (1311).

The converter 1272 converts cmd _i , ..., cmd _{i-j + 1} to 0 and cmd _ij
md _i 2 ^j + md _i-1 2 ^j-1 + ... + md _ij (Formula 33)
And cmd _ij−1 ,..., Cmd _{i- (w−1)} are each substituted with 0 (1312).

  Decrease variable i by w and go to step 1305 (1313).

  The repetition determination unit 1271 determines whether i> = w−1. If i> = w-1, the process returns to step 1302. If i <w-1, go to Step 1306 (1305).

If i <w-1 in step 1305,
Determine if i> = 0. If i> = 0, go to step 1307. If i <0, go to Step 1309 (1306).

If i> = 0 in step 1306,
The conversion unit 1272 sets j to the minimum of j satisfying md _j ! = 0 within j in the range of j> = 0 (1307).

The converter 1272 converts cmd _i , ..., cmd _{i-j + 1} to 0 and cmd _ij
md _i 2 ^j + md _i-1 2 ^j-1 + ... + md _ij (Formula 34)
Are substituted for cmd _ij−1 ,..., Cmd ₀ by 0 (1308).

cmd _n , ..., cmd ₀ are output as a converted numeric string cmd (1309).

  In this specification, this numeric string cmd is referred to as wcMOF expression.

  Next, a method in which the pre-calculation unit 1203 creates a pre-calculation table from points on an elliptic curve will be described using FIG.

  The doubling unit 1232 doubles the point P by ECDBL and stores the result in the point 2P (1401).

  The initial value 1 is assigned to the variable j (1402).

The iterative determination unit 1233 determines whether j is smaller than 2 ^w−1 . If j is smaller than 2 ^w−1 , go to Step 1204. If 2 ^w-1 or more, go to Step 1411 (1403).

If j is less than 2 ^{w-1 in} step 1403,
The adding unit 1231 adds the point 2P and the point (2j-1) P by ECADD, and stores the result in the point (2j + 1) P (1404).

  The variable j is incremented by 1, and the process returns to step 1403 (1405).

If j is 2 ^w-1 or more in step 1403,
P, 3P, ..., (2 ^w-1 -1) P is output as a pre-calculation table (1411).

Also, for the point Q = (x, y) on the elliptic curve, the inverse element point -Q related to the elliptic curve addition is expressed as -Q = (x, -y), so the coordinate of the point Q is It can be easily calculated if given. Therefore, only the points P, 3P,..., (2 ^w−1 −1) P are stored as a pre-calculation table. The points -P, -3P, ...,-(2 ^w-1 -1) P required for the calculation performed by the actual calculation unit 1204 thereafter may be derived from them, and need to be stored in the pre-calculation table. Absent.

The pre-calculation table creation process performed by the pre-calculation unit 1203 only needs to calculate points P, 3P,..., (2 ^w−1 −1) P. For this reason, using Montgomery trick described on page 481 of Non-Patent Document 5, the calculation of the inverse element calculation required for the elliptic curve calculation may be made common to increase the speed.

  Finally, a method of calculating a scalar multiple in an elliptic curve from the encoded scalar value and a point on the elliptic curve will be described with reference to FIG.

  The initial value n is assigned to the variable c (601).

d _w Determine whether [c] is 0 or 0.

If d _w [c] is 0, go to Step 603. If not 0, go to step 611 (602).

  The variable c is decreased by 1, and the process returns to step 602 (603).

If d _w [c] is not 0 in step 602, assigns the d _w [c] P to the point Q (611).

  The initial value c-1 is assigned to the variable j (612).

  The repetition determination unit 1244 determines whether j is smaller than 0. If j is smaller than 0, go to Step 621. If it is greater than 0, go to step 614 (613).

If j is greater than or equal to 0 in step 613,
The doubling unit doubles the point Q by ECDBL and stores it again at the point Q (614).

The bit value determination unit 1241 determines whether d _w [j] is 0 or not 0. If d _w [j] is 0, go to Step 617. If not 0, go to step 616 (615).

If d _w [j] is not 0 in step 615,
The adding unit 1242 adds the point Q and d _w [j] P by ECADD. However, when d _w [j] is negative, addition is performed using the inverted y coordinate of (−d _w [j]) P. The result is stored at point Q and the process goes to step 617 (616).
When d _w [j] is not 0, d _w [j] is an output of the encoding unit 1202, and is any one of ¹ , 3,..., 2 ^w−1 −1. Therefore, either d _w [j] P or (−d _w [j]) P always exists in the pre-calculation table.

  The variable j is decreased by 1, and the process returns to step 613 (617).

If j is less than 0 in step 613,
The point Q is output (621).

As described in the first embodiment, the signed binary string md output from the BinaryToMOF encoding unit 1205 satisfies Equation 18. Further, md _i is 0, 1, may take only one of the values of -1.

The numeric string cmd output by the MOFTowcMOF encoding unit 1207 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Formula 35)
Meet. The reason is as follows.
Cmd _i , ..., cmd _{i- (w-1)} converted in step 1312 are
cmd _i 2 ^w-1 + cmd _i-1 2 ^w-2 +… + cmd _{i- (w-1)} = md _i 2 ^w-1 + md _i-1 2 ^w-2 +… + md _{i- (w -1)} (Formula 36)
Meet. Also, cmd _i , ..., cmd _{i- (w-1)} converted in step 1308
cmd _i 2 ^w-1 + cmd _i-1 2 ^w-2 +… + cmd ₀ = md _i 2 ^w-1 + md _i-1 2 ^w-2 +… + md ₀ (Formula 37)
Meet. for that reason,
cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ = md _n 2 ⁿ + md _n-1 2 ^n-1 +… + md ₀ (Equation 38)
Holds. Since md is the output of the BinaryToMOF encoding unit 1205, Equation 18 is satisfied. Therefore, Expression 35 is established.

The numerical sequence cmd output from the MOFTowcMOF encoding unit 1207 satisfies Expression 32. This is because cmd _ij encoded in step 1312 is an MOF expression of md, and is always an odd number from the way of taking j.

As a result, the numerical sequence d _w [j] output from the encoding unit 1202 satisfies Expressions 13 and 14.

  Therefore, as described in the first embodiment, the point Q output from the actual calculation unit 1204 is equal to the scalar multiple dP.

  As described in the first embodiment, the processing performed by the BinaryToMOF encoding unit 1205 is left-to-right.

The processing performed by the MOFTowcMOF encoding unit 1207 is left-to-right. Because the conversion of step 1312 is because assigning the value of cmd _i using md _i from the direction successively i is greater.

  As a result, the processing performed by the encoding unit 1202 is left-to-right.

The cmd output from the MOFTo2cMOF encoding unit 1207 has a non-zero density of 1 / (w + 1). The reason is as follows.
It distributes two processes according to the value of md _i in step 1302. The occurrence probability of each bit value in the MOF representation is 1/2 for both 0 and non-zero. When the processing of step 1303 to step 1304 is executed, the number of processing bits is 1 and the number of non-zero bits is 0. Therefore, the expected value at which non-zero bits appear is 1/2. When the processing of step 1311-step 1313 is executed, the number of processing bits is w and the number of non-zero bits is 1. Therefore, the expected value at which non-zero bits appear is 1 / (2w). Since the non-zero concentration is a harmonic average of these expected values, 1 / (2 + 2w) = 1 / (w + 1). Non-Patent Document 1 shows that the non-zero density 1 / (w + 1) is the smallest with respect to the window width w.

  Therefore, the output of the encoding unit 1202 is also non-zero density 1 / (w + 1), which is the minimum non-zero density.

  The number of elliptical additions performed by the adding unit 1242 of the actual calculation unit 1204 is the number of non-zero bits in the encoded numerical sequence. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.

  As described above, the above calculation method can perform the encoding process left-to-right. In addition, since the encoded numerical sequence has a minimum non-zero density, the number of times of ellipse addition can be reduced, so that it can be calculated at high speed. In the fourth embodiment, the window width can be freely set. Therefore, when importance is attached to high speed, high speed computation can be achieved by setting a large window width.

  In the fourth calculation method, the Weierstrass-type elliptic curve was used as the elliptic curve. Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the fifth embodiment, a method for performing the encoding process of the fourth embodiment more efficiently will be described. In the fifth embodiment, the functional block of the scalar multiplication calculator shown in FIG. 15 is used. The scalar multiplication calculation unit 115 (135 in FIG. 1) includes an encoding unit 1502, a previous calculation unit 1503, and an actual calculation unit 1504. The encoding unit 1502 includes an encoding table creation unit 1508 and a BinaryTowcMOF encoding unit 1509. The encoding table creation unit 1508 includes a repetition determination unit 1581 and a conversion unit 1582. The BinaryTowcMOF encoding unit 1509 includes an iterative determination unit 1591 and a conversion unit 1592. The pre-calculation unit 1503 has the same configuration as the pre-calculation unit 1203 of the fourth embodiment. The actual calculation unit 1204 has the same configuration as the actual calculation unit 304 of the first embodiment.

  A fifth calculation method in which the scalar multiplication calculator 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 1502 converts the input scalar value d into a numerical sequence d _w [ j]. The pre-calculation unit 1503 creates a pre-calculation table from the input point P on the elliptic curve. The pre-calculation table is composed of P, 3P, ..., (2 ^w-1 -1) P. The actual calculation unit 1504 calculates the scalar multiple dP using the encoded scalar value and the pre-calculation table.

  It is to be noted that the encoding process performed by the encoding unit 1502 only needs to be performed after the scalar value d is received and before the actual calculation unit 1504 calculates the scalar multiple, as in the fourth embodiment.

  Further, when the point P is a fixed point, the pre-calculation table creation process performed by the pre-calculation unit 1503 may be performed only once, as in the fourth embodiment.

  Next, each process performed by the encoding unit 1502, the previous calculation unit 1503, and the actual calculation unit 1504 will be described in detail.

First, processing performed by the encoding unit 1502 will be described.
The encoding unit 1502 converts the binary string d into a numeric string d _w [j].

  When the binary string d is input to the encoding unit 1502, the encoding table creation unit 1508 creates an encoding table.

  The BinaryTowcMOF encoding unit 1509 converts the input binary string d into a numeric string cmd using the encoding table created by the encoding table creation unit 1508.

The encoding unit 1502 outputs the numerical sequence cmd converted by the BinaryTowcMOF encoding unit 1509 as an encoded numerical sequence d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

  The encoding table creation process performed by the encoding table creation unit 1508 may be performed only once for a given window width w. Therefore, when the same window width is used, it is not necessary to recreate the encoding table.

  The encoding table creation process may be performed before the BinaryToMOF encoding unit 1509 performs the encoding process, or may be performed before the binary string d is input to the encoding unit 1508.

  Next, the configuration of the encoding table will be described with reference to FIG.

  In the conversion performed by the encoding unit 1202 of the fourth embodiment, processing is performed such that two bits of the input binary string are scanned, and if these bits do not match, the w + 1 bits are scanned and converted into corresponding numerical values. Has been done. Therefore, efficient conversion can be performed by preparing a table indicating correspondence before and after conversion as a table for encoding for a w + 1-bit binary string d in which the upper 2 bits do not match.

When w + 1 bit binary string d is given, the upper 2 bits do not match, the corresponding w bit MOF representation md is expressed using md = sdm * 2 ^sde and integers sdm, sde (1701). At this time, the integers sdm and sde are
-2 ^w-1 ≦ sdm ≦ 2 ^w-1 , sdm = odd (Equation 39)
0 ≦ sde ≦ w-2 (Formula 40)
It becomes the range. By using the sdm and sde, the converted numeric string cmd can be expressed as (0, ..., 0, sdm, 0, ..., 0) (1702). Therefore, an encoding table may be configured using these sdm and sde.

The encoding table is determined from the window width w and consists of two arrays, sdm and sde. Both sdm and sde have 2 ^w elements. For the w + 1 bit non-zero binary string d whose upper 2 bits do not match, j = d-2 of sdm, sde The sdm corresponding to the ^w- 1th element sdm [j], sde [j] , stores sde. The correspondence in the case of w = 2 is shown in 1703, and the correspondence in the case of w = 3 is shown in 1704. d is a w + 1 bit binary string d whose upper 2 bits do not match, d _dec is its decimal representation, d _dec -2 ^w-1 is the index of the encoding table, md is the w bit MOF representation of d , Md _dec represents its decimal representation, sdm represents the corresponding sdm corresponding to d, sde represents the sde corresponding to d, and cmd represents the wcMOF representation corresponding to the MOF representation md.

  Next, processing performed by the encoding table creation unit 1508 will be described with reference to FIG.

The variable d is initialized with 2 ^w-1 (1601).

The repetition determination unit 1581 determines whether d <= 3 * 2 ^w−1 . If d <= 3 * 2 ^w−1 , go to Step 1603. If d> 3 * 2 ^w−1 , go to step 1621 (1602).

If d <= 3 * 2 ^w-1 in step 1602,
The conversion unit 1582 substitutes (d & (2 ^w −1)) − (d >> 1) for the variable md (1603). However, “&” represents a logical product for each bit, and “>>” represents a right shift. These operations are provided as instructions in almost all CPUs, and can be executed efficiently on the CPUs.

D-2 ^w-1 is assigned to the variable j (1604).

  The conversion unit 1582 initializes the element sde [j] of the conversion table with 0 (1605).

  The conversion unit 1582 determines whether (md & 1) = 0. If (md & 1) = 0, go to step 1611. If (md & 1)! = 0, go to step 1607 (1606).

If (md & 1) = 0 in step 1606,
The conversion unit 1582 increases the element sde [j] of the conversion table by 1 (1611).

  The conversion unit 1582 shifts the variable md to the right by 1 bit, and returns to Step 1606 (1612).

If (md & 1)! = 0 in step 1606,
The conversion unit 1582 substitutes md for the element sdm [j] of the conversion table (1607).

  The variable d is incremented by 1, and the process returns to step 1602 (1608).

If d> 3 * 2 ^{w-1 in} step 1602,
The conversion tables sde and sdm are output (1621).

  Next, processing performed by the BinaryTowcMOF encoding unit 1509 will be described with reference to FIG.

Initialize variable i with n. Initialize the numeric column cmd with 0. d _n is initialized to 0 (1801).

  The repetition determination unit 1591 determines whether i> = 1. If i> = 1, go to step 1803. If i <1, go to Step 1811 (1802).

If i> = 1 in step 1802,
The conversion unit 1592 determines whether d _i XOR d _{i + 1} = 0. If d _i XOR d _{i + 1} = 0, go to Step 1807. If d _i XOR d _{i + 1} ! = 0, go to step 1804 (1803). “XOR” represents an exclusive OR. This calculation is provided as an instruction in almost all CPUs, and can be executed efficiently on the CPU.

If d _i XOR d _{i + 1} = 0 in step 1803,
The variable i is decreased by 1, and the process returns to Step 1802 (1807).

If d _i XOR d _{i + 1} ! = 0 in step 1803,
The conversion unit 1592 substitutes ((d >> (iw)) & (2 ^{w + 1} −1)) − 2 ^w−1 for the variable j (1804).

The conversion unit 1592 substitutes sdm [j] for cmd _{i-w + 1 + sde [j]} (1805).

  The variable i is decreased by w, and the process returns to Step 1802 (1806).

If i <1 in step 1802,
Determine if i = 0 & d ₀ = 0. If i = 0 & d ₀ = 0, go to Step 1812. If i! = 0 | d ₀ ! = 0, go to Step 1813 (1811). “|” Represents a logical sum.

If i = 0 & d ₀ = 0 in step 1802,
The conversion unit 1592 substitutes −1 for cmd ₀ and goes to Step 1813 (1812).

cmd _n , ..., cmd ₀ are output as a numeric string cmd (1813).

Next, processing performed by the pre-calculation unit 1503 will be described.
The processing performed by the pre-calculation unit 1503 is the same as the processing performed by the pre-calculation unit 1203 of the fourth embodiment.

Finally, processing performed by the actual calculation unit 1504 will be described.
The process performed by the actual calculation unit 1504 is the same as the process performed by the actual calculation unit 1204 of the fourth embodiment.

The numeric string cmd output by the BinaryTowcMOF encoding unit 1509 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Formula 41)
Meet. The reason is as follows.
The processing of Step 1804 and Step 1805 is to perform the corresponding w-bit conversion, and corresponds to the processing of Step 1312 in FIG. Therefore, Formula 41 is established.

  Further, the numerical value sequence cmd output from the BinaryTowcMOF encoding unit 1509 satisfies Expression 32 as described in the fourth embodiment.

As a result, the numerical sequence d _w [j] output from the encoding unit 1502 satisfies Expressions 13 and 14.

  Therefore, as described in the first embodiment, the point Q output from the actual calculation unit 1504 is equal to the scalar multiple dP.

The processing performed by the BinaryTowcMOF encoding unit 1509 is left-to-right. This is because the values of cmd _i are assigned in descending order of i in the conversions in step 1804 and step 1805.

  As a result, the processing performed by the encoding unit 1502 is left-to-right.

The numerical sequence d _w [j] output from the encoding unit 1502 has a non-zero density of 1 / (w + 1), which is the minimum non-zero density. This is because the output of the encoding unit 1502 matches the output of the encoding unit 1202 of the fourth embodiment.

  The number of ellipse additions executed by the addition unit 1542 of the actual calculation unit 1504 is the number of non-zero bits in the encoded numerical sequence. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.

  As described above, the above calculation method can perform the encoding process left-to-right. In addition, since the encoded numerical sequence has a minimum non-zero density, the number of times of ellipse addition can be reduced, so that it can be calculated at high speed. In the fifth embodiment, the window width can be set freely. Therefore, when importance is attached to high speed, high speed computation can be achieved by setting a large window width. Further, efficient encoding processing can be performed, and there are advantages such as simplification of the program and downsizing of the hardware logic circuit.

  In the fifth calculation method, the Weierstrass-type elliptic curve was used as the elliptic curve, but the elliptic curve defined on the characteristic 2 finite field or the ellipse defined on the OEF (Optimal Extension Field) Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the sixth embodiment, the encoding process of the fifth embodiment is incorporated into the process performed by the real calculation unit, and a method of sequential conversion and use when performing an elliptic operation will be described. In the sixth embodiment, the functional block of the scalar multiplication calculator shown in FIG. 19 is used. The scalar multiplication calculation unit 115 (135 in FIG. 1) includes an encoding table creation unit 1908, a previous calculation unit 1903, and an actual calculation unit 1904. The encoding table creation unit 1908 has the same configuration as the encoding table creation unit 1508 of the fifth embodiment. The pre-calculation unit 1503 has the same configuration as the pre-calculation unit 1203 of the fourth embodiment. The actual calculation unit 1204 includes a conversion determination unit 1941, an addition unit 1942, a doubling unit 1943, and a repetition determination unit 1944.

  A sixth calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding table creation unit 1908 creates an encoding table. The pre-calculation unit 1903 creates a pre-calculation table from the input point P on the elliptic curve. The pre-calculation table is composed of P, 3P, ..., (2 ^w-1 -1) P. The actual calculation unit 1904 calculates a scalar multiple dP using the input scalar value, pre-calculation table, and encoding table.

  Note that when the point P is a fixed point, the pre-calculation table creation process performed by the pre-calculation unit 1903 may be performed only once, as in the fourth embodiment.

  Similarly to the fifth embodiment, the encoding table creation processing performed by the encoding table creation unit 1908 may be performed only once for a given window width w.

  The encoding table creation process may be performed before the actual calculation unit 1904 calculates a scalar multiple. That is, it may be performed before or after the pre-calculation unit 1903 creates the pre-calculation table.

  Next, each process performed by the encoding table creation unit 1908, the previous calculation unit 1903, and the actual calculation unit 1904 will be described in detail.

First, processing performed by the encoding table creation unit 1908 will be described.
The processing performed by the encoding table creation unit 1908 is the same as the processing performed by the encoding table creation unit 1508 of the fifth embodiment.

Next, processing performed by the pre-calculation unit 1903 will be described.
The process performed by the pre-calculation unit 1903 performs the same process as the process performed by the pre-calculation unit 1203 of the fourth embodiment.

  Finally, processing performed by the actual calculation unit 1904 will be described with reference to FIGS.

  The variable i is initialized with n and the point Q is initialized with an infinite point O (2001). Here, the point O at infinity is a unit element relating to the addition of ellipses, and for any point P, P + O = O + P = P is satisfied.

  The repetition determination unit 1944 determines whether i> = 1. If i> = 1, go to step 2011. If i <1, go to step 2021 (2002).

If i> = 1 in step 2002,
The conversion determination unit 1941 determines whether d _i XOR d _{i + 1} = 0. If d _i XOR d _{i + 1} = 0, go to step 2012. If d _i XOR d _{i + 1} ! = 0, go to step 2131 (2011).

If d _i XOR d _{i + 1} = 0 in step 2011,
The doubling unit 1943 doubles the point Q by ECDBL and stores it again at the point Q (2012).

  Decrease variable i by 1 and return to step 2002 (2013).

If d _i XOR d _{i + 1} ! = 0 in step 2011,
The conversion determining unit 1941 assigns ((d >> (iw)) & (2 ^{w + 1} −1)) − 2 ^w−1 to the variable j (2131).
The variable k is decreased by 1 (2132).

  The conversion determination unit 1941 determines whether k <= w-sde [j]. If k <= w-sde [j], go to Step 2134; if k> w-sde [j], go to Step 2141 (2133).

If k <= w-sde [j] in step 2133,
The doubling unit 1943 doubles the point Q by ECDBL and stores it again at the point Q (2134).

  The variable k is increased by 1, the variable i is decreased by 1, and the process returns to step 2133 (2135).

If k> w-sde [j] in step 2133,
The adder 1942 adds the point Q and the point sdm [j] P by ECADD and stores the result in the point Q (2141).

  1 is assigned to variable k (2142).

  The conversion determination unit 1941 determines whether k <= sde [j]. If k <= sde [j], go to step 2144. If k> sde [j], the process returns to step 2002 (2143).

If k <= sde [j] in step 2143,
The doubling unit 1943 doubles the point Q by ECDBL and stores it again at the point Q (2144).

  The variable k is increased by 1, the variable i is decreased by 1, and the process returns to step 2143 (2145).

If i <1 in step 2002,
Determine if i = 0. If i = 0, go to step 2022. If i! = 0, go to Step 2025 (2021).

If i = 0 in step 2021,
The doubling unit 1943 doubles the point Q by ECDBL and stores it again at the point Q (2022).

Determine if d ₀ = 0. If d ₀ = 0, go to Step 2024. If d ₀ ! = 0, go to Step 2025 (2023).

  The point Q is output as a scalar multiple dP (2025).

  The point Q output from the actual calculation unit 1904 is equal to the scalar multiple dP. This is because the processes in step 2012 and step 2131 to step 2145 are elliptic operations corresponding to the processes in step 1303 and step 1311 to step 1312 in FIG.

  Also, the processing performed by the actual calculation unit 1904 is left-to-right due to the correspondence with the fifth embodiment.

  The number of ellipse additions performed by the actual calculation unit 1904 is minimum. This is because the processing performed by the conversion determination unit 1941 of the actual calculation unit 1904 can correspond to the processing of the encoding unit 1502 of the fifth embodiment.

  As described above, the above calculation method can perform left-to-right scalar multiplication. In addition, since the number of times of ellipse addition is minimum, it can be calculated at high speed. In the sixth embodiment, the window width can be set freely. Therefore, when importance is attached to high speed, high speed computation can be achieved by setting a large window width. In addition, since the encoding process and the ellipse calculation are performed at a time, it is not necessary to store the encoding result in the memory once, and the memory usage can be reduced.

  Although the Weierstrass-type elliptic curve was used as the elliptic curve in the sixth calculation method, an elliptic curve defined on a characteristic 2 finite field or an ellipse defined on the OEF (Optimal Extension Field) Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the seventh embodiment, by replacing the MOFTowcMOF encoding method in the encoding process of the fourth embodiment with the MOFTowNAF encoding method, a numerical sequence encoded with wNAF expression, which is another expression method with a small non-zero density, is generated, A method for efficiently executing the ellipse operation will be described. In the seventh embodiment, the function block of the scalar multiplication unit shown in FIG. 22 is used. The scalar multiplication calculation unit 115 (135 in FIG. 1) includes an encoding unit 2202, a previous calculation unit 2203, and an actual calculation unit 2204. The encoding unit 2202 includes a BinaryToMOF encoding unit 2205 and a MOFTowNAF encoding unit. The BinaryToMOF encoding unit 2205 includes an iterative determination unit 2251 and a conversion unit 2252. The MOFTowNAF encoding unit 2207 includes an iterative determination unit 2271 and a conversion unit 2272. The pre-calculation unit 2203 has the same configuration as the pre-calculation unit 1203 of the fourth embodiment. The actual calculation unit 2204 has the same configuration as the actual calculation unit 1204 of the fourth embodiment.

  A seventh calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication calculation unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 2202 converts the input scalar value d into a numerical sequence d _w [ j]. The pre-calculation unit 2203 creates a pre-calculation table from the input point P on the elliptic curve. The pre-calculation table is composed of P, 3P, ..., (2 ^w-1 -1) P. The actual calculation unit 2204 calculates the scalar multiple dP using the encoded scalar value and the pre-calculation table.

  Note that the encoding process performed by the encoding unit 2202 only needs to be performed after the scalar value d is received and before the actual calculation unit 2204 calculates the scalar multiple, as in the fourth embodiment.

  Further, when the point P is a fixed point, the pre-calculation table creation process performed by the pre-calculation unit 2203 may be performed only once as in the fourth embodiment.

  Next, each process performed by the encoding unit 2202, the previous calculation unit 2203, and the actual calculation unit 2204 will be described in detail.

First, processing performed by the encoding unit 2202 will be described.
The encoding unit 2202 converts the binary string d into a numeric string cmd.

  When the binary string d is input to the encoding unit 2202, the BinaryToMOF encoding unit 2205 converts the binary string d into a signed binary string md.

The MOFTowNAF encoding unit 2207 converts the signed binary string md converted by the BinaryToMOF encoding unit 2205 into a numeric string cmd. However, the possible values for each numeric cmd _{i in} the numeric column cmd are:
-2 ^w-1 ≤cmd _i ≤2 ^w-1 , cmd _i = 0 or odd number (Formula 42)
It is. This conversion is done right-to-left.

The encoding unit 2202 outputs the numerical sequence cmd converted by the MOFTowNAF encoding unit 2207 as an encoded numerical sequence d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

  Next, processing performed by the BinaryToMOF encoding unit 2205 will be described. The processing performed by the BinaryToMOF encoding unit 2205 is the same as the processing performed by the BinaryToMOF encoding unit 305 of the first embodiment.

  Next, processing performed by the MOFTowNAF encoding unit 2207 will be described with reference to FIG.

  The variable i is initialized with 0 (2301).

The conversion unit 2272 determines whether md _i = 0. If md _i = 0, go to step 2303. If md _i ! = 0, go to step 2311 (2302).

If md _i = 0 in step 2302,
Conversion unit 2272 substitutes md _i in cmd _i (2303).

  The variable i is incremented by 1, and the process goes to Step 2305 (2304).

If md _i ! = 0 in step 2302,
The converter 1272 converts to cmd _i
md _{i + w-1} 2 ^w-1 + md _{i + w-2} 2 ^w-2 + ... + md _i (Formula 43)
Is substituted for cmd _{i + 1} ,..., Cmd _{i + w−1} by substituting 0 (1311).

  The variable i is increased by w and the process goes to Step 2305 (2312).

  The repetition determination unit 2271 determines whether i <= n. If i <= n, the process returns to step 2302. If i> n, go to Step 2321 (2305).

If i <w-1 in step 2305,
cmd _n , ..., cmd ₀ are output as the converted numeric string cmd (2321).

  In the present specification, this numeric string cmd is referred to as a wNAF expression.

Next, processing performed by the pre-calculation unit 2203 will be described.
The processing performed by the pre-calculation unit 2203 performs the same processing as the processing performed by the pre-calculation unit 1203 of the fourth embodiment.

Finally, processing performed by the actual calculation unit 2204 will be described.
The process performed by the actual calculation unit 2204 is the same as the process performed by the actual calculation unit 1204 of the fourth embodiment.

As described in the first embodiment, the signed binary string md output from the BinaryToMOF encoding unit 2205 satisfies Expression 18. Further, md _i is 0, 1, may take only one of the values of -1.

The numeric string cmd output by the MOFTowNAF encoding unit 2207 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Formula 44)
Meet. The reason is as follows.
Cmd _i , ..., cmd _{i + w-1} converted in step 2311
cmd _i 2 ^w-1 + cmd _i-1 2 ^w-2 +… + cmd _{i- (w-1)} = md _i 2 ^w-1 + md _i-1 2 ^w-2 +… + md _{i- (w -1)} (Formula 45)
Meet. Also, cmd _i converted in step 2303 is cmd _i = md _i . for that reason,
cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ = md _n 2 ⁿ + md _n-1 2 ^n-1 +… + md ₀ (Equation 46)
Holds. Since md is the output of the BinaryToMOF encoding unit 2205, Equation 18 is satisfied. Therefore, Formula 44 is established.

The numerical sequence cmd output from the MOFTowNAF encoding unit 2207 satisfies Expression 42. This is because cmd _i encoded in step 2311 is an odd number because md is an MOF expression and step 2311 is executed only when md _i ! = 0.

As a result, the numerical sequence d _w [j] output from the encoding unit 2202 satisfies Expressions 13 and 14.

  Therefore, as described in the first embodiment, the point Q output from the actual calculation unit 2204 is equal to the scalar multiple dP.

As described in the first embodiment, the processing performed by the BinaryToMOF encoding unit 2205 is left-to-right. However, processing can also be performed right-to-left. This is because each md _i is determined only from d _i and d _i−1 . That is, mdi can be determined in order from the smallest _i . Therefore, if necessary, the processing of the BinaryToMOF encoding unit 2205 may be performed right-to-left.

The processing performed by the MOFTowNAF encoding unit 2207 is right-to-left. Because step 2311, the conversion of step 2303 is because assigning the value of cmd _i using md _i from the direction successively i is smaller.

  As a result, the processing performed by the encoding unit 2202 can be performed right-to-left.

The cmd output from the MOFTowNAF encoding unit 2207 has a non-zero density of 1 / (w + 1). The reason is as follows.
It distributes two processes according to the value of md _i in step 2302. The occurrence probability of each bit value in the MOF representation is 1/2 for both 0 and non-zero. When the processing of step 2303 to step 2304 is executed, the number of processing bits is 1 and the number of non-zero bits is 0. Therefore, the expected value at which non-zero bits appear is 1/2. When the processing of step 2231 to step 2312 is executed, the number of processing bits is w and the number of non-zero bits is 1. Therefore, the expected value at which non-zero bits appear is 1 / (2w). Since the non-zero concentration is a harmonic average of these expected values, 1 / (2 + 2w) = 1 / (w + 1). Non-Patent Document 1 shows that the non-zero density 1 / (w + 1) is the smallest with respect to the window width w.

  Therefore, the output of the encoding unit 2202 is also non-zero density 1 / (w + 1), which is the minimum non-zero density.

  The number of elliptical additions executed by the addition unit 2242 of the actual calculation unit 2204 is the number of non-zero bits in the encoded numerical sequence. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.

  As described above, the above calculation method can perform right-to-left encoding processing through MOF representation. In addition, there is a feature that the number of times of ellipse addition is minimum and the calculation can be performed at high speed. In the seventh embodiment, the window width can be set freely. Therefore, when importance is attached to high speed, high speed computation can be achieved by setting a large window width.

  Although the Weierstrass-type elliptic curve was used as the elliptic curve in the seventh calculation method, the elliptic curve defined on the characteristic 2 finite field or the ellipse defined on the OEF (Optimal Extension Field) Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

  In the seventh calculation method, the encoding process has been described separately for the BinaryToMOF encoding unit 2205 and the MOFTowNAF encoding unit 2207. However, two encoding processes may be combined as in the fifth embodiment. Also, a conversion table may be used as in the fifth embodiment. Furthermore, an encoding process may be incorporated in the process performed by the actual calculation unit 2204 as in the sixth embodiment. By doing so, there are merits such as further reduction in memory usage, further speed-up, further simplification of programs, and downsizing of hardware logic circuits.

  In the eighth embodiment, a method of performing left-to-right encoding processing to the wNAF expression of the seventh embodiment will be described. In the eighth embodiment, the function block of the scalar multiplication unit shown in FIG. 24 is used. The scalar multiplication calculation unit 115 (135 in FIG. 1) includes an encoding unit 2402, a previous calculation unit 2403, and an actual calculation unit 2404. The encoding unit 2402 includes a BinaryToNAF encoding unit 2407. The BinaryToNAF encoding unit 2407 includes an iterative determination unit 2471 and a conversion unit 2472. The pre-calculation unit 2403 has the same configuration as the pre-calculation unit 1203 of the fourth embodiment. The actual calculation unit 2404 has the same configuration as the actual calculation unit 1204 of the fourth embodiment.

  An eighth calculation method in which the scalar multiplication calculation unit 115 calculates the scalar multiplication point dP in the elliptic curve from the scalar value d and the point P on the elliptic curve will be described.

When the scalar multiplication unit 115 receives the scalar value d and the point P on the elliptic curve from the encryption processing unit 112, the encoding unit 2402 converts the input scalar value d into a numerical sequence d _w [ j]. The pre-calculation unit 2403 creates a pre-calculation table from the input point P on the elliptic curve. The pre-calculation table is composed of P, 3P, ..., (2 ^w-1 -1) P. The actual calculation unit 2404 calculates the scalar multiple dP using the encoded scalar value and the pre-calculation table. In the eighth embodiment, a case where w = 2 will be particularly described.

  It is to be noted that the encoding process performed by the encoding unit 2402 may be performed after receiving the scalar value d and before the actual calculation unit 2404 calculates the scalar multiple, as in the fourth embodiment.

  Further, when the point P is a fixed point, the pre-calculation table creation process performed by the pre-calculation unit 2403 may be performed only once as in the fourth embodiment.

  Next, each process performed by the encoding unit 2402, the previous calculation unit 2403, and the actual calculation unit 2404 will be described in detail.

First, processing performed by the encoding unit 2402 will be described.
The encoding unit 2402 converts the binary string d into a numeric string cmd.

  When the binary string d is input to the encoding unit 2402, the BinaryToNAF encoding unit 2407 converts the binary string d into a numeric string cmd.

The encoding unit 2402 outputs the numerical sequence cmd converted by the BinaryToNAF encoding unit 2407 as an encoded numerical sequence d _w [j]. That is, for each j, d _w [j] = cmd _j . However, cmd _j is the value of the jth bit of cmd.

  Next, processing performed by the BinaryToNAF encoding unit 2407 will be described with reference to FIG.

  The variable i is initialized with n (2501).

d _n , d ₋₁ , and d ₋₂ are each initialized with 0 (2502).

  The iterative determination unit 2471 determines whether i> -1. If i> -1, go to step 2504. If i <=-1, go to Step 2521 (2503).

If i> -1 in step 2503,
The conversion unit 2472 substitutes d _i−1 d _i for b (2504).

  The conversion unit 2472 determines whether b = 0. If b = 0, go to step 2506. If b! = 0, go to step 2511 (2505).

If b = 0 in step 2505,
The conversion unit 2472 substitutes 0 for cmd _i (2506).

  The variable i is decreased by 1, and the process returns to step 2503 (2507).

If b! = 0 in step 2505,
The conversion unit 2472 finds the maximum j that satisfies d _ij−1 = d _ij (2511).

  The conversion unit 2472 determines whether j is an odd number. If j is an odd number, go to step 2514. If j is an even number, go to Step 2513 (2512).

If j is an odd number in step 2512,
The converter 2472 converts cmd _i , cmd _i-1 , cmd _i-2 , ..., cmd _{i-j + 2} , cmd _{i-j + 1} , cmd _ij to b, 0, -b,. Substitute., 0, -b, 0 and go to step 2515 (2514).

If j is an even number in step 2512,
The conversion unit 2472 converts cmd _i , cmd _i-1 , ..., cmd _{i-j + 2} , cmd _{i-j + 1} , cmd _ij to 0, b, ..., 0, b, 0, respectively. Substitute and go to step 2515 (2513).

  The variable i is decreased by j + 1, and the process returns to step 2503 (2515).

If i <=-1 in step 2503,
cmd _n , ..., cmd ₀ is output as the converted numeric string cmd (2521).

Note that cmd _i output from the BinaryToNAF encoding unit 2407 can take only one of 0, 1, and -1. This is because b is given by d _i−1 d _i and cmd _i is assigned only one of 0, b, and −b.

Next, processing performed by the pre-calculation unit 2203 will be described.
The processing performed by the pre-calculation unit 2203 performs the same processing as the processing performed by the pre-calculation unit 1203 of the fourth embodiment.

Finally, processing performed by the actual calculation unit 2204 will be described.
The process performed by the actual calculation unit 2204 is the same as the process performed by the actual calculation unit 1204 of the fourth embodiment.

The numeric string cmd output by the BinaryToNAF encoding unit 2407 is
d = cmd _n 2 ⁿ + cmd _n-1 2 ^n-1 +… + cmd ₀ (Formula 47)
Meet. The reason is as follows.
The processing of Step 2251 to Step 2514 corresponds to performing the following conversion from the MOF expression.
0, 1, -1, 1, -1, ..., -1, 1, 0 → 0, 1, 0, -1, 0, ..., 0, -1, 0
0, -1, 1, -1, 1, ..., 1, -1, 0 → 0, -1, 0, 1, 0, ..., 0, 1, 0
0, 1, -1, 1, -1, ..., 1, -1, 0 → 0, 0, 1, 0, 1, ..., 0, 1, 0
0, -1, 1, -1, 1, ..., -1, 1, 0 → 0, 0, -1, 0, -1, ..., 0, -1, 0
Therefore, Formula 47 holds.

As a result, the numerical sequence d _w [j] output from the encoding unit 2402 satisfies Expressions 13 and 14.

  Therefore, as described in the first embodiment, the point Q output from the actual calculation unit 2404 is equal to the scalar multiple dP.

The processing performed by the BinaryToNAF encoding unit 2407 is left-to-right. This is because the values of cmd _i are assigned in descending order of i in each of the conversions in step 2511 to step 2514 and step 2506.

  As a result, the processing performed by the encoding unit 2402 is left-to-right.

  The cmd output from the BinaryToNAF encoding unit 2407 has a non-zero density of 1/3. This is because the output of the BinaryToNAF encoding unit 2407 matches the output of the MOFTowNAF encoding unit 2207 of the seventh embodiment when the window width is 2, and the non-zero density is 1/3.

  Therefore, the output of the encoding unit 2402 is also non-zero density 1/3, which is the minimum non-zero density.

  The number of ellipse additions executed by the addition unit 2442 of the actual calculation unit 2404 is the number of non-zero bits in the encoded numerical sequence. Since the number of non-zero bits is the smallest, the number of elliptical additions is the smallest.

  As described above, the above calculation method can perform the encoding process left-to-right. In addition, there is a feature that the number of times of ellipse addition is minimum and the calculation can be performed at high speed.

  Although the Weierstrass-type elliptic curve was used as the elliptic curve in the eighth calculation method, the elliptic curve defined on the finite field of characteristic 2 or the ellipse defined on the OEF (Optimal Extension Field) Similarly to the first embodiment, a curve or a Montgomery-type elliptic curve may be used.

In the eighth calculation method, the case where w = 2 is described as the encoding method performed by the BinaryToNAF encoding unit 2407, but considering the MOF expression for the input binary string, the MOF expression is
0 | 0 | r | b _i | t _i | ... | b ₂ | t ₂ | b ₁ | t ₁ | 0 ... 0
Can be divided into a single block, and the most significant block can be converted into a wNAF representation to encode the general window width w. However, r is at most w-1 bit MOF representation, each b _j is at most w-2 bit 0 value bit (including the case where 0 value bit is 0), each t _j is w bit MOF representation, Each represents the first and last zero value bits of the block, each w-1 consecutive.

  As in the third embodiment, the encoding process may be incorporated into the process performed by the actual calculation unit 2404. By doing so, there are merits such as further reduction in memory usage, further speed-up, further simplification of programs, and downsizing of hardware logic circuits.

  The operation of the scalar multiplication calculation unit 115 when the computer A101 encrypts the input message has been described above, but the same applies to the case where the computer B121 decrypts the encrypted data 141.

In that case, the scalar multiplication calculation unit 135 of the computer B121 outputs the already-explained point (x _e2 , y _e2 ) on the elliptic curve and the scalar multiple (x _d3 , y _d3 ) based on the secret information a125. At this time, the scalar multiple is obtained by performing the same processing with the scalar value d explained in the above calculation method as the secret information a125 and the point P on the elliptic curve as the point (x _e2 , y _e2 ) on the elliptic curve. be able to.
Next, an embodiment in which the present invention is applied to a signature verification system will be described with reference to FIG. 26 and FIG.

  The signature verification system of FIG. 26 includes a smart card 2601 and a computer 2621 that performs signature verification processing.

  The smart card 2601 has a configuration similar to that of the computer A in FIG. The processing unit 2612 is realized. However, the external storage device 107, the display 108, and the keyboard 109 shown in FIG.

  The computer 2621 has the same configuration as the computer A, and the signature verification processing unit 2632 is realized instead of the data processing unit when the CPU 2633 executes the program.

  The scalar multiplication calculators 2615 and 2635 have the same functions as the scalar multiplication calculator 115 or 135 shown in FIG.

  In the present embodiment, each program in the computer 2621 may be stored in advance in the storage unit in the computer, or other devices via a medium that can be used by the computer 2621 when necessary. To the storage unit.

  Furthermore, each program in the smart card 2601 may be stored in advance in the storage unit in the smart card 2601, or when necessary, a computer connected via the input / output interface 2610 or the computer uses the program. The storage unit may be introduced via a possible medium.

  The medium refers to, for example, a storage medium that can be attached to and detached from the computer, or a communication medium (that is, a network or a carrier wave that propagates through the network).

  The signature generation and signature verification operation in the signature verification system of FIG. 26 will be described with reference to FIG.

  The computer 2621 transfers the randomly selected numerical value to the smart card 2601 as the challenge code 2643.

  The signature generation processing unit 2612 (112 in FIG. 2) receives the challenge code 2643, takes the hash value of the challenge code 2643, and converts it into a numerical value f having a predetermined bit length.

  The signature generation processing unit 2612 generates a random number u, and reads out from the constant 2604 stored in the storage unit 2602 (102 in FIG. 2) (205 in FIG. 2) together with the fixed point Q on the elliptic curve, the scalar multiplication calculation unit 2615 (115 in FIG. 2) (206 in FIG. 2).

The scalar multiplication unit 2615 calculates a scalar multiple (x _u , y _u ) based on the fixed point Q and the random number u, and sends the calculated scalar multiple to the signature generation processing unit 2612 (207 in FIG. 2).

The signature generation unit 2612 generates a signature using the sent scalar multiple. For example, if the ECDSA signature described in Non-Patent Document 4,
s = x _u mod q (Formula 48)
t = u ^-1 (f + ds) mod q (Formula 49)
To obtain a signature (s, t) corresponding to the challenge code 2643 (208 in FIG. 2).

  Where q is the order of the fixed point Q, that is, the q-fold point qQ of the fixed point Q is the infinity point, and the m-fold point mQ of the fixed point Q for a numerical value m smaller than q is not the infinity point. It is a numerical value.

  The smart card 2601 outputs the signature 2641 created by the signature generation processing unit 2612 from the input / output interface 2610 and transfers it to the computer 2621.

  When the signature 2641 is input (204 in FIG. 2), the signature verification processing unit 2632 (112 in FIG. 2) of the computer 2621 has the values s and t of the signature 2641 within an appropriate range, that is, 1 ≦ s, t < Check if it is q.

If the numerical values s and t are not within the above range, “invalid” is output as the signature verification result for the challenge code 2643, and the smart card 2601 is rejected. If the numerical values s and t are within the above range, the signature verification processing unit 2632
h = t-1 mod q (Formula 50)
h ₁ = fh mod q (Formula 51)
h ₂ = sh mod q (Formula 52)
Calculate Then, the public key aQ and the fixed point Q read out from the constant 2624 stored in the storage unit 2622 (102 in FIG. 2) and the calculated h ₁ and h ₂ are converted into a scalar multiplication unit 2635 (FIG. 2). No. 115) (206 in FIG. 2).

The scalar multiplication unit 2635 calculates a scalar multiplication point h ₁ Q based on the fixed points Q and h _{1 and} a scalar multiplication point h ₂ aQ based on the public keys aQ and h _2, and uses the calculated scalar multiplication unit as a signature verification processing unit. It is sent to 2632 (207 in FIG. 2).

The signature verification processing unit 2632 performs signature verification processing using the sent scalar multiple. For example, for ECDSA signature verification, point R
R = h ₁ Q + h ₂ aQ (Formula 53)
And the x coordinate is x _R ,
s' = x _R mod q (Formula 54)
If s ′ = s, “valid” is output as the signature verification result for the challenge code 2643, and the smart card 2601 is authenticated and accepted (208 in FIG. 2).

  If not s' = s, "invalid" is output and the smart card is rejected (208 in FIG. 2).

Since the scalar multiplication calculators 2615 and 2635 of the above embodiment have the same function as the scalar multiplication calculator 115 or 135 of FIG. 1, it is possible to execute a scalar multiplication calculation that requires a small amount of memory and can be calculated at high speed. In particular, in the calculation of Expression 53, when using the method of Non-Patent Document 1, an extra RAM area of several tens of bytes is required. However, when the method of the present invention is used, the values of h ₁ and h ₂ are set. Because it reads several bits at a time, no extra RAM area is required. Since the smart card 2601 generally has a small RAM 2603, the method of the present invention is particularly effective.

Therefore, when the smart card 2601 performs a signature generation process, the computer 2621 performs a high-speed calculation with a small amount of memory when performing a signature verification process.
Next, an embodiment in which the present invention is applied to a key exchange system will be described. In the present embodiment, the system configuration of FIG. 1 can be applied.

  The data processing units 112 and 132 in FIG. 1 function as the key exchange processing units 112 and 132, respectively, in this embodiment.

  The operation when the computer A101 of the key exchange system derives the shared information from the input data 143 will be described with reference to FIGS.

  The key exchange processing unit 132 of the computer B121 reads the secret key b from the constant 125 of the storage unit 122 (102 in FIG. 2), and calculates the public key bQ of the computer B121. Then, the public key bQ is transferred as data 143 to the computer A101 via the network 142.

  When the key exchange processing unit 112 (112 in FIG. 2) of the computer A101 receives the input of the public key bQ of the computer B121 (204 in FIG. 2), the key exchange processing unit 112 reads out from the storage unit 102 (FIG. 2). 205) The secret key a of the computer A101, which is the secret information 105, and the public key bQ of the computer B121 are sent to the scalar multiplication unit 115 (206 in FIG. 2).

  The scalar multiplication calculation unit 115 calculates a scalar multiplication point abQ based on the secret key a and the public key bQ, and sends the calculated scalar multiplication point to the key exchange processing unit 112 (207 in FIG. 2).

  The key exchange processing unit 112 derives the shared information using the sent scalar multiple and stores it as the secret information 105 in the storage unit. For example, the x coordinate of the scalar multiple point abQ is used as shared information.

  Next, an operation when the computer B121 derives shared information from the input data 141 will be described.

  The key exchange processing unit 112 of the computer A101 reads the secret key a from the constant 105 of the storage unit 102 (102 in FIG. 2), and calculates the public key aQ of the computer A101. Then, the public key aQ is transferred as data 141 to the computer B 121 via the network 142.

  When the key exchange processing unit 132 (112 in FIG. 2) of the computer B121 accepts the input of the public key aQ of the computer A101 (204 in FIG. 2), the key exchange processing unit 132 reads out from the storage unit 122 (FIG. 2). 205) The secret key b of the computer B121, which is the secret information 125, and the public key aQ of the computer A101 are sent to the scalar multiplication unit 135 (207 in FIG. 2).

  The scalar multiplication calculation unit 135 calculates a scalar multiplication point baQ based on the secret key b and the public key aQ, and sends the calculated scalar multiplication point to the key exchange processing unit 132 (207 in FIG. 2).

  The key exchange processing unit 132 derives shared information using the sent scalar multiple and stores it as the secret information 125 in the storage unit 122. For example, the x coordinate of the scalar multiple baQ is used as shared information.

  Here, since the number ab and the number ba are equal as numerical values, the point abQ and the point baQ are the same point, and the same information is derived.

  Point aQ and point bQ are transmitted to network 142, but point abQ (or baQ) is not transmitted. In order to calculate the point abQ (or baQ), the secret key a or secret key b must be used. That is, the shared information cannot be obtained without knowing the secret key a or the secret key b. The shared information obtained in this way can be used as a secret key for common key cryptography.

  Also in the present embodiment, the scalar multiplication calculators 115 and 135 have the above-described features, so that a key exchange process that allows a small amount of memory usage and high-speed calculation is possible.

  In addition, the encryption processing unit, the decryption processing unit, the signature creation unit, the signature verification unit, and the key exchange processing unit in each of the above embodiments may be performed using dedicated hardware. The scalar multiplication calculation unit may be realized by a coprocessor or other dedicated hardware.

  The data processing unit may be configured to perform any one or more of the encryption processing, decryption processing, signature generation processing, signature verification processing, and key exchange processing.

It is a system configuration diagram in an embodiment. It is a sequence diagram which shows delivery of the information in each embodiment. FIG. 6 is a configuration diagram of a scalar multiplication calculator in the embodiment of the first example. FIG. 10 is a flowchart showing an encoding method performed by a BinaryToMOF encoding unit in each of the first and fourth embodiments. FIG. 5 is a flowchart showing an encoding method performed by a MOFTo2cMOF encoding unit in the first embodiment. FIG. 10 is a flowchart showing a calculation method performed by an actual calculation unit in each of the first, second, fourth, and fifth embodiments. FIG. 10 is a configuration diagram of a scalar multiplication calculator in an embodiment of a second example. FIG. 10 is a flowchart showing an encoding method performed by an encoding unit in the second embodiment. FIG. 10 is a configuration diagram of a scalar multiplication calculator in an embodiment of a third example. FIG. 10 is a flowchart showing a calculation method performed by an actual calculation unit in the third embodiment. FIG. 10 is a flowchart showing a calculation method performed by an actual calculation unit in the third embodiment. FIG. 10 is a configuration diagram of a scalar multiplication calculator in an embodiment of a fourth example. FIG. 10 is a flowchart showing an encoding method performed by a MOFTowcMOF encoding unit in the fourth embodiment. It is a flowchart figure which shows the precomputation table production | generation method which the precomputation part in a 4th, 5th Example performs. FIG. 10 is a configuration diagram of a scalar multiplication calculator in an embodiment of a fifth example. FIG. 10 is a flowchart showing an encoding table creation method performed by an encoding table creation unit in the fifth embodiment. FIG. 10 is a diagram showing the relationship between input and output data in an encoding table creation method performed by an encoding table creation unit in the fifth embodiment. FIG. 10 is a flowchart showing an encoding method performed by a BinaryTowcMOF encoding unit in the fifth embodiment. FIG. 10 is a configuration diagram of a scalar multiplication calculator in an embodiment of a sixth example. FIG. 16 is a flowchart showing a calculation method performed by an actual calculation unit in the sixth embodiment. It is a flowchart figure which shows the calculation method which the real calculation part in a 6th Example performs. FIG. 20 is a configuration diagram of a scalar multiplication calculator in an embodiment of a seventh example. FIG. 10 is a flowchart showing an encoding method performed by a MOFTowNAF encoding unit in the seventh embodiment. FIG. 29 is a configuration diagram of a scalar multiplication calculator in an embodiment of an eighth example. FIG. 20 is a flowchart showing an encoding method performed by a BinaryToNAF encoding unit in the eighth embodiment. 1 is a configuration diagram of a signature verification system in an embodiment.

Explanation of symbols

101, 121, 2621: Computer, 2101: Smart card, 102, 122, 2602, 2121: Storage unit, 111, 131, 2111, 2631: Processing unit, 115, 135, 2615, 2635: Scalar multiplication unit, 112, 132: Data processing unit, 2612: Signature generation processing unit, 2632: Signature verification processing unit, 104, 124, 2104, 2624: Constant, 105, 125, 2605, 2625: Confidential information, 110, 130, 2610, 2630: On Output interface, 108, 128, 2628: Display, 109, 129, 2629: Keyboard, 142: Network, 141, 143: Data, 2641: Signature, 2643: Challenge code, 302, 702, 1202, 1502, 2202, 2402: Encoding unit, 1203, 1503, 1903, 2203, 2403: Pre-calculation unit, 304, 704, 904, 1204, 1504, 1904, 2204, 2404: Real calculation unit, 305, 1205, 2205: BinaryToMOF encoding unit, 306: MOFTo2cMOF Encoding part, 1207: MOFTowcMOF encoding part, 1508: Encoding table creation part, 1509: BinaryTowcMOF encoding , 2207: MOFtowNAF encoding unit, 2407: BinaryToNAF encoding unit, 341, 741, 1241, 1541, 2241, 2441: bit value determination unit, 342, 742, 942, 1242, 1542, 1942, 2242, 2442: addition unit, 343 , 743, 943, 1243, 1543, 1943, 2243, 2443: doubling unit, 344, 744, 1244, 1544, 1944, 2244, 2444: repetition determination unit, 351, 1251, 2251: repetition determination unit, 352, 1252, 2252: Conversion unit, 361: Repeat determination unit, 362: Conversion unit, 721: Repeat determination unit, 722: Conversion unit, 941: Conversion determination unit, 944: Repeat determination unit, 1271: Repeat determination unit, 1272: Conversion Part, 1231, 1531, 1931, 2231, 2431: addition part, 1232, 1532, 1932, 2232, 2432: doubling part, 1233, 1533, 1933, 2233, 2433: repetition determination part, 1581: repetition determination part, 1582: Conversion unit, 1591: Repeat determination unit, 1592: Conversion unit, 1941: Conversion determination unit, 2271: Repeat determination unit, 2272: Conversion unit, 2471: Repeat determination unit, 2472: Conversion unit

Claims (23)

In an elliptic curve, a scalar multiplication method in elliptic curve cryptography that calculates a scalar multiplication from a scalar value and a point on the elliptic curve,
Performing an operation on two consecutive bits in the scalar value;
A scalar multiplication method having: The scalar multiplication calculation method according to claim 1, further comprising:
The scalar multiplication calculation method, wherein the calculation for the 2 bits is an operation for calculating a 2-bit difference. The scalar multiplication calculation method according to claim 1, further comprising:
The scalar multiplication calculation method in which the operation for the 2 bits is an operation for comparing values of 2 bits. The scalar multiplication calculation method according to claim 1, further comprising:
The scalar multiplication calculation method, wherein the operation on the 2 bits is an operation for calculating an exclusive OR of 2 bits. The scalar multiplication calculation method according to claim 1, further comprising:
Encoding the scalar value into a numeric string;
Calculating a scalar multiple from the encoded numeric sequence and points on the elliptic curve, and
The encoding step includes
A scalar multiplication calculation method including an operation on the two bits. The scalar multiplication calculation method according to claim 1, further comprising:
Encoding the scalar value into a numeric string;
Creating a pre-calculation table from points on the elliptic curve;
Calculating a scalar multiple from the encoded numeric sequence and the pre-calculation table,
The encoding step includes
A scalar multiplication calculation method including an operation on the two bits. The scalar multiplication calculation method according to claim 1, further comprising:
Creating a pre-calculation table from points on the elliptic curve;
Calculating a scalar multiple from the scalar value and the pre-calculation table,
The step of calculating the scalar multiplication includes:
A scalar multiplication calculation method including an operation on the two bits. The scalar multiplication calculation method according to claim 1,
The scalar multiplication calculation method, wherein the elliptic curve is a Weierstrass type elliptic curve, a Montgomery type elliptic curve, an elliptic curve defined on a finite field of characteristic 2, or an elliptic curve defined on OEF. A data generation method for generating second data from first data,
A data generation method comprising a step of calculating a scalar multiplication using the scalar multiplication method according to claim 1. A signature creation method for generating signature data from data,
2. A signature generation method comprising a step of calculating a scalar multiplication using the scalar multiplication method according to claim 1. A signature verification method for verifying the validity of signature data from data and signature data,
A signature verification method comprising a step of calculating a scalar multiplication using the scalar multiplication method according to claim 1. An encryption method for generating encrypted data from data,
2. An encryption method comprising a step of calculating a scalar multiplication using the scalar multiplication method according to claim 1. A decryption method for generating decrypted data from encrypted data,
A decoding method comprising a step of calculating a scalar multiplication using the scalar multiplication method according to claim 1. In an elliptic curve in elliptic curve cryptography, a scalar multiple calculation device for calculating a scalar multiple from a scalar value and a point on an elliptic curve,
A scalar multiplication calculation device including a conversion unit that performs an operation on two consecutive bits in the scalar value. The scalar multiplication apparatus according to claim 14, further comprising:
An encoding unit for encoding the scalar value into a numeric string;
A real calculation unit for calculating a scalar multiplication from the encoded numerical sequence and the points on the elliptic curve,
The encoding unit is a scalar multiplication calculation device including the conversion unit. The scalar multiplication apparatus according to claim 14, further comprising:
An encoding unit for encoding the scalar value into a numeric string;
A pre-calculation unit that creates a pre-calculation table from points on the elliptic curve;
A real calculation unit for calculating a scalar multiplication from the encoded numeric sequence and the pre-calculation table,
The encoding unit is a scalar multiplication calculation device including the conversion unit. The scalar multiplication apparatus according to claim 14, further comprising:
A pre-calculation unit that creates a pre-calculation table from points on the elliptic curve;
An actual calculation unit for calculating a scalar multiplication from the scalar value and the pre-calculation table,
The real calculation unit is a scalar multiplication calculation device including the conversion unit. A data generation device including a data conversion unit that generates second data from first data, and a scalar multiplication calculation unit that is requested by the data conversion unit to calculate a scalar multiplication,
2. The data generation apparatus including a step of calculating a scalar multiplication using the scalar multiplication calculation method according to claim 1. A signature generation apparatus having a signature creation processing unit that generates signature data from data, and a scalar multiplication calculation unit that is requested by the signature generation processing unit and calculates a scalar multiplication,
2. The signature generation device including a step of calculating a scalar multiplication using the scalar multiplication calculation method according to claim 1. A signature verification apparatus having a signature verification processing unit that verifies the validity of signature data from data and signature data, and a scalar multiplication calculation unit that is requested by the signature verification processing unit to calculate a scalar multiplication,
2. The signature verification apparatus including a step of calculating a scalar multiplication using the scalar multiplication calculation method according to claim 1. An encryption device comprising: an encryption unit that generates encrypted data from data; and a scalar multiplication calculation unit that is requested by the encryption unit and calculates a scalar multiplication,
2. The encryption apparatus including a step of calculating a scalar multiplication using the scalar multiplication calculation method according to claim 1. A decryption device comprising: a decryption unit that generates decrypted data from encrypted data; and a scalar multiplication unit that calculates a scalar multiple upon request from the decryption unit,
The decoding apparatus according to claim 1, wherein the scalar multiplication calculator includes a step of calculating a scalar multiplication using the scalar multiplication calculation method according to claim 1. A program causing a computer to execute the scalar multiplication method according to claim 1.

Images