JP2006323160A - Pairing arithmetic unit, pairing arithmetic method and pairing arithmetic program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem, wherein a pairing arithmetic speed is slow, since the amount of operation required for pairing arithmetic is much larger than that of a regular ellipse arithmetic operation. <P>SOLUTION: In the invention, high speed is achieved by using a characteristic of a finite field. Assuming r as an element on the finite field GF(p<SP>k/2</SP>) and f as an element on the finite field GF(p<SP>k</SP>) which is calculated by Miller algorithm, calculation is performed using the algorithm in which a calculating amount is less than Miller algorithm for imaging to an element f' on the finite field GF(p<SP>k</SP>) which satisfies f'=rf. Instead of calculating an inverse element, p to the k-th power of a multiplying element is calculated as a quasi inverse element. The polynomial expansion of multiplications of elements of GF(p<SP>k</SP>) in which the calculation amount is large, is performed by using the quasi inverse elements. High speed is achieved by calculating terms beforehand, in which calculation amount is large, as a common term of a repeated calculation, by performing the polynomial expansion. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an apparatus, a method, and a program using an operation on an elliptic curve, in particular, an operation for realizing a security technique.

A method of realizing ID-base encryption using elliptic curve pairing or a short signature digital signature has been proposed (Patent Document 1).
An outline of encryption and signature by Tate pairing is shown in FIG. Let the ellipse defined on the finite field GF (p) be E / GF (p). Let GF (p) rational point on the ellipse E / GF (p) be P (x, y), and GF (p ^k ) rational point on the ellipse E / GF (p) be Q (x _Q , y _Q ). . In Tate pairing, P and Q are input, an element f on a finite field GF (p ^k ) is output by the Miller algorithm, and f is raised to the power of (p ^k −1) / m by a power operation. Map to element e on GF (p ^k ) and output. Here, p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest integer that satisfies m | (p ^k −1), and m is a factor of (p−1). It is not a number, and the greatest common divisor of p and m is 1.

FIG. 2 shows a functional configuration example of a pairing arithmetic device 1000 using Tate pairing. In order to perform the processing shown in FIG. 1, a Miller arithmetic unit 30 that converts and outputs inputs P and Q to elements f on a finite field GF (p ^k ) using the Miller algorithm and a finite input f by a power operation. The power calculation unit 20 is to be mapped to the element e on the field GF (p ^k ) and output.
FIG. 3 shows an example of the internal configuration of the Miller arithmetic unit 30 occupying a calculation amount of 90% in Tate pairing, and FIG. 4 shows an example of the processing flow. The Miller arithmetic device 30 includes a control unit 100, an assignment unit 200, an elliptical point generation unit 400, an ellipse addition unit 500, an input / output unit 600, a GF (p ^k ) multiplication unit 700, a GF (p ^k ) inverse element unit 850, And a recording unit 190. The control unit 100 controls other components in order to execute processing according to the processing flow shown below. The recording unit 190 may be a non-volatile memory such as a hard disk or a volatile memory that temporarily records only during a series of calculations. Moreover, you may combine.

When m, P, and Q are input to the input / output unit 600, m, P, and Q are recorded in the recording unit 190 (S700). Next, the assigning unit 200 substitutes P for T and 1 for F, and records the result in the recording unit 190 (S710). The point on the ellipse 400 generates a point S (∈E / GF (p ^k )) on the ellipse defined on the finite field GF (p ^k ) that satisfies the conditions S ≠ P and S ≠ Q. The data is recorded in the recording unit 190 (S720). S may be determined in advance or may be randomly generated as long as it satisfies the conditions. The ellipse addition unit 500 reads Q and S from the recording unit 190, calculates Q ′ (= Q + S), and records it in the recording unit 190 (S730). In the assigning unit 200, an integer obtained by rounding up the decimal point of log (m) -1 is substituted into n and recorded in the recording unit 190 (S740). The control unit 100 reads n from the recording unit 190 and checks whether n <0. If yes, the process proceeds to step S910, and if no, the process proceeds to step S760 (S750). In the case of Yes, the input / output unit 600 reads and outputs F from the recording unit 190 (S910), and the calculation by the Miller algorithm ends. In the case of No, the ellipse addition unit 500 reads T from the recording unit 190, calculates 2T, and records it in the recording unit 190 (S760). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, and 2T from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and 2T, l ₂ (x, y) Assuming = 0 as a straight line connecting 2T and O, l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190 (S770). . However, l ₁ (Q ′) is a value obtained by substituting the x and y coordinates of Q ′ into l ₁ (x, y). If S is selected from elements of a finite field GF (p) (in this case, the elements of the remaining k−1 finite fields GF (p) are 0), l ₁ (S), l ₂ ( The calculation of S) can be omitted, and l ₁ (S) and l ₂ (S) can be omitted in the subsequent steps. Next, the assigning unit 200 reads 2T from the recording unit 190, assigns a value of 2T to T, and records T in the recording unit 190 (S780). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S790). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８１０）。制御部１００は、記録部１９０からｍとｎを読み取り、ｍのｎ番目のビットが１かを確認し、Ｙｅｓの場合にはステップＳ８３０へ進み、Ｎｏの場合にはステップＳ９００へ進む（Ｓ８２０）。Ｙｅｓの場合、楕円加算部５００で、記録部１９０からＴ、Ｐを読み取り、Ｔ＋Ｐを計算し、記録部１９０に記録する（Ｓ８３０）。ＧＦ（ｐ^ｋ）乗算部７００は、Ｑ’、Ｓ、Ｔ、Ｐ，Ｔ＋Ｐを記録部１９０から読み取り、ｌ_１（ｘ，ｙ）＝０をＴとＰとを結ぶ直線、ｌ_２（ｘ，ｙ）＝０をＴ＋ＰとＯとを結ぶ直線とし、ｌ_１（Ｑ’）、ｌ_２（Ｑ’）、ｌ_１（Ｓ）、ｌ_２（Ｓ）を計算して、記録部１９０に記録する（Ｓ８４０）。代入部２００は、記録部１９０からＴ＋Ｐを読み取り、ＴにＴ＋Ｐを代入し、Ｔを記録部１９０に記録する（Ｓ８５０）。ＧＦ（ｐ^ｋ）逆元部８５０は、記録部１９０からｌ_２（Ｑ’）、ｌ_１（Ｓ）を読み取り、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を計算し、記録部１９０に記録する（Ｓ８６０）。ＧＦ（ｐ^ｋ）乗算部７００は、記録部１９０からＦ、ｌ_１（Ｑ’）、ｌ_２（Ｓ）、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を読み取り、

Is recorded in the recording unit 190 as a value of F (S810). The control unit 100 reads m and n from the recording unit 190 and checks whether the n-th bit of m is 1. If Yes, the process proceeds to step S830, and if No, the process proceeds to step S900 (S820). . In the case of Yes, the ellipse addition unit 500 reads T and P from the recording unit 190, calculates T + P, and records it in the recording unit 190 (S830). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, T + P from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and P, l ₂ (x, y) = 0 is a straight line connecting T + P and O, and l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190. (S840). The assigning unit 200 reads T + P from the recording unit 190, substitutes T + P for T, and records T in the recording unit 190 (S850). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S860). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８８０）。ステップＳ８２０でＮｏと判断した場合とステップＳ８８０が終了した場合、代入部２００は、記録部１９０からｎを読み取り、ｎ−１をｎに代入し、ｎを記録部１９０に記録する（Ｓ９００）。次にステップＳ７５０に戻り、ステップＳ７５０の判断がＹｅｓとなるまで処理が繰り返される。
特開2004-177673号公報

And is recorded in the recording unit 190 as the value of F (S880). When it is determined No in step S820 and when step S880 ends, the assigning unit 200 reads n from the recording unit 190, substitutes n−1 for n, and records n in the recording unit 190 (S900). Next, the process returns to step S750, and the process is repeated until the determination in step S750 becomes Yes.
JP 2004-177673 A

  The amount of calculation required for the pairing calculation is very large compared to the normal elliptic calculation, and the problem is that the calculation speed is slow. In the case of Tate pairing, Miller's algorithm is used for operations that evaluate devisor rational expressions. The problem to be solved by the present invention is to increase the calculation speed of Miller's algorithm.

In the present invention, speeding up is performed using the properties of a finite field. FIG. 5 shows the principle of high-speed operation according to the present invention. Tate The pairing, while mapping the original f on the finite field GF ^{(p k)} based on e on the finite field GF by exponentiation ^{(p k),} the finite field GF ^{(p k)} above satisfies the following condition: Is also mapped to the element e on the finite field GF (p ^k ) by a power operation.
f ′ = rf where r is an element on the finite field GF ( ^{pk / 2} ) (1)
Therefore, in the present invention, when k is an even number, the property of this finite field is used, and an element f ′ is obtained by an algorithm having a smaller calculation amount than the Miller algorithm (hereinafter referred to as “pseudo Miller algorithm”). The element e is obtained by calculating the power of f ′.

In the pseudo Miller algorithm, the process of obtaining an inverse element using the Miller algorithm is replaced with a process of obtaining an element that is r times the inverse element obtained with a small amount of calculation (hereinafter referred to as “pseudo inverse element”). Specifically, when k is an even number and L is an element on a finite field GF (p ^k ),

を満足する有限体ＧＦ（ｐ^ｋ／２）上の元ｎが存在する。したがって、

であり、式（１）の関係を満足する。そこで、

を擬似逆元として使用する。
また、前記のMillerのアルゴリズムの多項式の乗算では、多項式を展開して計算する。具体的には、ステップＳ８１０とＳ８８０の多項式の乗算には、

There exists an element n on a finite field GF (p ^{k / 2} ) that satisfies Therefore,

And satisfies the relationship of the formula (1). Therefore,

Is used as a pseudo inverse element.
In addition, in the multiplication of the polynomial of the Miller algorithm, the polynomial is expanded and calculated. Specifically, for the multiplication of the polynomials in steps S810 and S880,

が含まれるが、前記の擬似逆元を用いると、

に置き換えることができる。また、Ｑ’＝（Ｘ_Ｑ’，Ｙ_Ｑ’）とすると、
ｌ_１（Ｑ’）＝ｃＸ_Ｑ’＋ｄＹ_Ｑ’＋ｅ、ｌ_２（Ｑ’）＝ｇＸ_Ｑ’＋ｈ （７）
と表すことができる。ここで、ｃ、ｄ、ｅ、ｇ、ｈはＧＦ（ｐ）上の元である。さらに、フェルマーの小定理から、

Is included, but using the above pseudo inverse element,

Can be replaced. If Q ′ = (X _{Q ′} , Y _{Q ′} ),
l ₁ (Q ′) = cX _{Q ′} + dY _{Q ′} + e, l ₂ (Q ′) = gX _{Q ′} + h (7)
It can be expressed as. Here, c, d, e, g, and h are elements on GF (p). From Fermat's little theorem,

と変形することができる。ここでＸ＾_Ｑ’はＸ_Ｑ’の共役元である。
したがって、式（６）は、
（ｃＸ_Ｑ’＋ｄＹ_Ｑ’＋ｅ）・（ｇＸ＾_Ｑ’＋ｈ） （９）
と表現できる。
そこで、あらかじめＡ＝Ｘ_Ｑ’Ｘ＾_Ｑ’、Ｂ＝Ｙ_Ｑ’Ｘ＾_Ｑ’を求めておき、
ｃｇＡ＋ｄｇＢ＋ｅｇＸ＾_Ｑ’＋ｃｈＸ_Ｑ’＋ｄｈＹ_Ｑ’＋ｅｈ （１０）
により計算する。

And can be transformed. Here, X ^ _{Q '} is a conjugate element of XQ _' .
Therefore, equation (6) becomes
_{(CX Q '+ dY Q'} + e) · (gX ^ Q '+ h) (9)
Can be expressed.
Therefore, A = X _{Q ′} X ^ _{Q ′} and B = Y _Q′X ^ _{Q ′} are obtained in advance,
cgA + dgB + egX ^ _{Q ′} + chX _{Q ′} + dhY _{Q ′} + eh (10)
Calculate with

According to the present invention, in the Tate pairing operation on an elliptic curve, when k is an even number, the mapping from E / GF (p ^k ) to GF (p ^k ) is performed at high speed using the property of a finite field. Can be done. In the present invention, the speed can be increased without using special elliptic curve properties. Furthermore, it can be applied to an elliptic curve of an arbitrary characteristic and has a wide application range.

Below, in order to avoid duplication of description, the same number is given to the structural part which has the same function, and the process step which performs the same process, and abbreviate | omits description.
[First Embodiment]
FIG. 6 shows an example of the functional configuration of the pairing arithmetic device of the present invention. The difference from FIG. 2 is that a pseudo Miller arithmetic device 10 is provided instead of the Miller arithmetic device 30. The pseudo Miller arithmetic device 10 is a device that realizes a pseudo Miller algorithm by performing multiplication by expanding a polynomial using the pseudo inverse element. An example of the internal configuration of the pseudo Miller arithmetic device 10 is shown in FIG. 7, and the processing flow of the pseudo Miller arithmetic device 10 is shown in FIG. The difference between FIG. 7 and FIG. 3 is that the type of data recorded in the recording unit 150 in FIG. 7 is different from the type of data recorded in the recording unit 190 in FIG. In other words, the GF (p ^k ) inverse element 850 is replaced with the pseudo GF (p ^k ) inverse element 800. First, “recording to the recording unit 190” or “reading from the recording unit 190” in the description of FIG. 4 is read as “recording to the recording unit 150” or “reading from the recording unit 150” in FIG. . The other differences between the processing flow of FIG. 8 and the processing flow of FIG. 4 are as follows.

Step S110 is added between step S730 and step S740. In step S110, the X and Y coordinates of _{Q ′} are X _{Q ′} and Y _{Q ′} (∈GF (p ^k )), and the x and y coordinates of _P are x _P and y _P (∈GF (p )) and read from the recording unit _{150, X ^ Q ', a =} X Q' X ^ Q ', B = Y Q' X ^ Q ', C = (X Q' -x P) X ^ Q ', D = (Y _{Q ′} −y _P ) X ^ _{Q ′} is calculated, and X ^ _{Q ′} , A, B, C, and D are recorded in the recording unit 150.
Step S770 is replaced with step S120. In step S120, the GF (p ^k ) multiplication unit 700 reads Q ′, S, T, and 2T from the recording unit 150, and l ₁ (x, y) = 0 is a straight line connecting T and 2T, l ₂ ( Assuming that x, y) = 0 is a straight line connecting 2T and O, l ₁ (S) and l ₂ (S) are calculated and recorded in the recording unit 150. Further, c, d, e, g, and h, which are coefficients of the polynomial l ₁ (x, y) = cx + dy + e and l ₂ (x, y) = gx + h, are obtained and recorded in the recording unit 150.

Steps S790 and S810 are replaced with steps S130 to S150. In step S130, the pseudo GF ^{(p k)} inverse element unit 800 reads the _l 1 (S) from the recording unit 150 _calculates the pseudo-inverse of _l 1 (S), is recorded in the recording unit 150. In step S140, GF ^{(p k)} multiplying unit 700, A from the recording unit 150, B, c, d, e, g, h, Q and y-coordinate Y _Q 'x-coordinate X _{Q of' ',} X _{Q' 'I} read, (cX _Q' of the conjugated original X ^ _Q calculated as _{+ dY Q '+ e) ·} (gX ^ Q' + h) the _{cgA + dgB + egX ^ Q '} + chX Q' + dhY Q '+ eh,

として記録部１５０に記録する。ステップＳ１５０では、ＧＦ（ｐ^ｋ）乗算部７００が、記録部１５０からＦ、ｌ_２（Ｓ）、ｌ_１（Ｓ）の擬似逆元、および

を読み取り、

Is recorded in the recording unit 150. In step S150, the GF (p ^k ) multiplication unit 700 performs a pseudo inverse of F, l ₂ (S), l ₁ (S) from the recording unit 150, and

Read

Is recorded in the recording unit 150 as the value of F.
Step S840 is replaced with step S160. In step S160, the GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, and T + P from the recording unit 150, and l ₁ (x, y) = 0 is a straight line connecting T and P, l ₂ (x, y) = 0 is a straight line connecting T + P and O, and l ₁ (S) and l ₂ (S) are calculated and recorded in the recording unit 150. Further, c, d, g, and h which are coefficients of the polynomial l ₁ (x, y) = cx + dy and l ₂ (x, y) = gx + h are obtained and recorded in the recording unit 150. Note that comparing Steps S160 and S120, Step S160 does not have the coefficient e of the polynomial l ₁ (x, y). This is because e = 0 in step S160 and can be omitted.

Steps S860 and S880 are replaced with steps S170 to S190. In step S170, the pseudo GF ^{(p k)} inverse element unit 800 reads the _l 1 (S) from the recording unit 150 _calculates the pseudo-inverse of _l 1 (S), is recorded in the recording unit 150. In step S180, GF ^{(p k)} multiplying unit 700, coupled from the recording unit 150 C, D, c, d , g, h, 'x -coordinate of the X _Q' Q and y-coordinate Y _{Q ',} X _Q' based X ^ _{Q ',} read the _{x P} and _{y P} wherein x and y coordinates of P, (cX' calculated as + dY ') · (gX ^ Q' + h) the cgC + dgD + chX '+ dhY ',

として記録部１５０に記録する。ただし、Ｘ’＝Ｘ_Ｑ’ −ｘ_Ｐ、Ｙ’＝Ｙ_Ｑ’ −ｙ_Ｐである。ステップＳ１９０では、ＧＦ（ｐ^ｋ）乗算部７００が、Ｆ、ｌ_２（Ｓ）、ｌ_１（Ｓ）の擬似逆元、および

を記録部１５０から読み取り、

Is recorded in the recording unit 150. _{However, X '= X Q' -x} P, is a _{Y '= Y Q' -y P} . In step S190, the GF (p ^k ) multiplication unit 700 performs the pseudo inverse of F, l ₂ (S), l ₁ (S), and

From the recording unit 150,

Is recorded in the recording unit 150 as the value of F.
In the present invention, when S is selected from elements of a finite field GF (p) (in this case, the elements of the remaining k−1 finite fields GF (p) are 0), l ₁ (S), Calculation and calculation of l ₂ (S) can be omitted.
With the processing flow thus changed, the calculation amount can be reduced as compared with the Miller algorithm, and the element f ′ on the finite field GF (p ^k ) can be obtained.
According to the present invention, by using a pseudo inverse element, multiplication of elements of GF (p ^k ) having a large amount of computation can be expanded in a polynomial form. Further, since polynomial expansion can be performed, it is possible to calculate in advance a common term for iterative calculation after performing polynomial expansion of multiplication of elements of GF (p ^k ) having a large amount of calculation. If the amount of multiplication between elements of GF (p) is expressed as O (k), the amount of multiplication between elements of GF (p ^k ) is usually O (k ² ), and the Karatsuba method is used. However, the calculation amount is O (k ^1.5 ). On the other hand, the amount of calculation of multiplication of the element of GF (p ^k ) and the element of GF (p) is O (k), so the amount of calculation can be reduced. In particular, the effect of the present invention increases as k increases.

  The present invention can be executed as a computer main body and a computer program, or can be realized by being mounted on a digital signal processor or a dedicated LSI.

The figure which shows the outline | summary of Tate pairing calculation. The figure which shows the function structural example of the pairing calculating device using Tate pairing. The figure which shows the internal structural example of a Miller arithmetic unit. The figure which shows the processing flow of a Miller algorithm. The figure which shows the principle of the speeding-up of a calculation using the pseudo Miller algorithm. The figure which shows the function structural example of the pairing arithmetic unit using a pseudo Miller algorithm. The figure which shows the function structural example of a pseudo Miller arithmetic unit. The figure which shows the processing flow of a pseudo Miller algorithm.

Claims (5)

p is a prime number or a power of a prime number, k is an even number, and a point P on an elliptic curve on a finite field GF (p) and a point Q on an elliptic curve on a finite field GF (p ^k ) are input. The pseudo Miller operation unit for obtaining the element f ′ on the finite field GF (p ^k ) from the determined points, and mapping the obtained element on the finite field to the element e (P, Q) on the finite field GF (p ^k ) And a pairing operation device comprising a power operation unit to output,
When X and Y are elements on GF (p ^k ), X ^ is a conjugate element of X, and c, d, e, g, and h are elements on GF (p),
A Miller algorithm for obtaining an element f on a finite field GF (p ^k ) from P and Q is used instead of the inverse element of the element L on the finite field GF (p ^k ) used in the Miller algorithm.

Using
The calculation of (cX + dY + e) · (gX ^ + h) is obtained in advance by recording A = XX ^ and B = YX ^ in the recording means, and calculated by cgA + dgB + egX ^ + chX + dhY + eh. ,
Mapping the element f ′ obtained by the pseudo Miller operation unit to the element e (P, Q) on the finite field GF (p ^k ) by a power operation;
A pairing arithmetic device comprising: p is a prime number or a power of a prime number, k is an even number, and a point P on an elliptic curve on a finite field GF (p) and a point Q on an elliptic curve on a finite field GF (p ^k ) are input. The pseudo Miller operation unit for obtaining the element f ′ on the finite field GF (p ^k ) from the determined points, and mapping the obtained element on the finite field to the element e (P, Q) on the finite field GF (p ^k ) And a pairing operation device comprising a power operation unit to output,
When X and Y are elements on GF (p ^k ), X ^ is a conjugate element of X, and x, y, c, d, g, and h are elements on GF (p),
A Miller algorithm for obtaining an element f on a finite field GF (p ^k ) from P and Q is used instead of the inverse element of the element L on the finite field GF (p ^k ) used in the Miller algorithm.

Using
(C (X−x) + d (Y−y)) · (gX ^ + h) is calculated in advance by obtaining C = (X−x) X ^ and D = (Y−y) X ^ in the recording means. The pseudo Miller arithmetic unit, which is recorded and obtained by cgC + dgD + ch (X−x) + dh (Y−y),
Mapping the element f ′ obtained by the pseudo Miller operation unit to the element e (P, Q) on the finite field GF (p ^k ) by a power operation;
A pairing arithmetic device comprising: p is a prime number or a power of a prime number, k is an even number, and a point on the elliptic curve on the finite field GF (p ^k ) on the elliptic curve on the finite field GF (p ^k ) The element f ′ on the finite field GF (p ^k ) is ^obtained from the input point with Q as an input, and the element on the finite field GF (p ^k ) is ^{obtained as the} element e ( P, Q) In the pairing calculation method of mapping and outputting,
When X and Y are elements on GF (p ^k ), X ^ is a conjugate element of X, and c, d, e, g, and h are elements on GF (p),
In the pseudo Miller operation unit, a Miller algorithm for obtaining an element f on a finite field GF (p ^k ) from P and Q is used instead of the inverse element of the element L on the finite field GF (p ^k ) used in the Miller algorithm.

The process of using
In the pseudo Miller computing unit, the calculation of (cX + dY + e) · (gX ^ + h) is obtained in advance by recording A = XX ^, B = YX ^ on the recording means, and obtained by cgA + dgB + egX ^ + chX + dhY + eh;
A process of mapping the element f ′ obtained by the pseudo Miller operation unit to the element e (P, Q) on the finite field GF (p ^k ) by a power operation in the power operation unit;
A pairing calculation method characterized by comprising: p is a prime number or a power of a prime number, k is an even number, and a point on the elliptic curve on the finite field GF (p ^k ) on the elliptic curve on the finite field GF (p ^k ) The element f ′ on the finite field GF (p ^k ) is ^obtained from the input point with Q as an input, and the element on the finite field GF (p ^k ) is ^{obtained as the} element e ( P, Q) In the pairing calculation method of mapping and outputting,
When X and Y are elements on GF (p ^k ), X ^ is a conjugate element of X, and x, y, c, d, g, and h are elements on GF (p),
In the pseudo Miller operation unit, a Miller algorithm for obtaining an element f on a finite field GF (p ^k ) from P and Q is used instead of the inverse element of the element L on the finite field GF (p ^k ) used in the Miller algorithm.

The process of using
In the pseudo Miller operation unit, the calculation of (c (X−x) + d (Y−y)) · (gX ^ + h) is performed in advance by C = (X−x) X ^ and D = (Y−y) X. ^ Is obtained and recorded in the recording means, and obtained by cgC + dgD + ch (X−x) + dh (Y−y);
A process of mapping the element f ′ obtained by the pseudo Miller operation unit to the element e (P, Q) on the finite field GF (p ^k ) by a power operation in the power operation unit;
A pairing calculation method characterized by comprising: A pairing calculation program for realizing each process of the pairing calculation method according to claim 3 or 4 by a computer.

Images