JP2006330497A - Pairing computation method, and apparatus and program using same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make a computation speed of Miller algorithm high, specifically, to increase the number of bits of 0, when m is expressed in a binary digit. <P>SOLUTION: When m is expressed, not only 0 and 1 but -1 is used and when 1 is consecutive in bits for expressing m, the number of 0 is increased by using -1. Moreover, (y<SB>Q'</SB>+y<SB>P</SB>)/(X<SB>Q'</SB>-X<SB>P</SB>) is computed beforehand. When the n-th bit of m is -1, by setting a line for passing a point T and a point -P as l<SB>1</SB>(x,y), a parallel line to x-axis for passing T-P as l<SB>2</SB>(x,y) and a parallel line to y-axis for passing a point PF as l<SB>3</SB>(x,y), A=l<SB>1</SB>(Q')/l<SB>3</SB>(Q') is independently computed by utilizing expression using (y<SB>Q'</SB>+y<SB>P</SB>)/(X<SB>Q'</SB>-X<SB>P</SB>)-λ, and F×(A×l<SB>2</SB>(S)l<SB>3</SB>(S))/(l<SB>2</SB>(Q')l<SB>1</SB>(S)) is computed. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an apparatus, a method, and a program using an operation on an elliptic curve, in particular, an operation for realizing a security technique.

A method of realizing ID-base encryption using elliptic curve pairing or a short signature digital signature has been proposed (Patent Document 1).
An outline of encryption and signature by Tate pairing is shown in FIG. Let the ellipse defined on the finite field GF (p) be E / GF (p). The GF (p) rational point on the ellipse E / GF (p) is P (x _P , y _P ), and the GF (p ^k ) rational point on the ellipse E / GF (p) is Q (x _Q , y _Q ). And In Tate pairing, P and Q are input, an element f on a finite field GF (p ^k ) is output by the Miller algorithm, and f is raised to the power of (p ^k −1) / m by a power operation. Map to element e on GF (p ^k ) and output. Here, p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest integer that satisfies m | (p ^k −1), and m is a factor of (p−1). It is not a number, and the greatest common divisor of p and m is 1.

FIG. 2 shows a functional configuration example of a pairing arithmetic device 1000 using Tate pairing. In order to perform the processing shown in FIG. 1, a Miller arithmetic unit 30 that converts and outputs inputs P and Q to elements f on a finite field GF (p ^k ) using the Miller algorithm and a finite input f by a power operation. The power calculation unit 20 is to be mapped to the element e on the field GF (p ^k ) and output.
FIG. 3 shows an example of the internal configuration of the Miller arithmetic unit 30 occupying a calculation amount of 90% in Tate pairing, and FIG. 4 shows an example of the processing flow. The Miller arithmetic device 30 includes a control unit 100, an assignment unit 200, an elliptical point generation unit 400, an ellipse addition unit 500, an input / output unit 600, a GF (p ^k ) multiplication unit 700, a GF (p ^k ) inverse element unit 850, And a recording unit 190. The control unit 100 controls other components in order to execute processing according to the processing flow shown below. The recording unit 190 may be a non-volatile memory such as a hard disk or a volatile memory that temporarily records only during a series of calculations. Moreover, you may combine.

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８１０）。ここで、ステップＳ７６０からＳ８１０までの過程を、楕円２倍演算（ＴＤＢＬ、Ｓ８００）と呼ぶ。制御部１００は、記録部１９０からｍとｎを読み取り、ｍのｎ番目のビットが１かを確認し、Ｙｅｓの場合にはステップＳ８３０へ進み、Ｎｏの場合にはステップＳ９００へ進む（Ｓ８２０）。Ｙｅｓの場合、楕円加算部５００で、記録部１９０からＴ、Ｐを読み取り、Ｔ＋Ｐを計算し、記録部１９０に記録する（Ｓ８３０）。ＧＦ（ｐ^ｋ）乗算部７００は、Ｑ’、Ｓ、Ｔ、Ｐ，Ｔ＋Ｐを記録部１９０から読み取り、ｌ_１（ｘ，ｙ）＝０をＴとＰとを結ぶ直線、ｌ_２（ｘ，ｙ）＝０をＴ＋ＰとＯとを結ぶ直線とし、ｌ_１（Ｑ’）、ｌ_２（Ｑ’）、ｌ_１（Ｓ）、ｌ_２（Ｓ）を計算して、記録部１９０に記録する（Ｓ８４０）。代入部２００は、記録部１９０からＴ＋Ｐを読み取り、ＴにＴ＋Ｐを代入し、Ｔを記録部１９０に記録する（Ｓ８５０）。ＧＦ（ｐ^ｋ）逆元部８５０は、記録部１９０からｌ_２（Ｑ’）、ｌ_１（Ｓ）を読み取り、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を計算し、記録部１９０に記録する（Ｓ８６０）。ＧＦ（ｐ^ｋ）乗算部７００は、記録部１９０からＦ、ｌ_１（Ｑ’）、ｌ_２（Ｓ）、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を読み取り、

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８８０）。ここで、ステップＳ８３０からＳ８８０までを、楕円加算演算（ＴＡＤＤ、Ｓ９００）と呼ぶ。ステップＳ８２０でＮｏと判断した場合とステップＳ８８０が終了した場合、代入部２００は、記録部１９０からｎを読み取り、ｎ−１をｎに代入し、ｎを記録部１９０に記録する（Ｓ８９０）。次にステップＳ７５０に戻り、ステップＳ７５０の判断がＹｅｓとなるまで処理が繰り返される。
特開2004-177673号公報 When m, P, and Q are input to the input / output unit 600, m, P, and Q are recorded in the recording unit 190 (S700). Next, the assigning unit 200 substitutes P for T and 1 for F, and records the result in the recording unit 190 (S710). The point on the ellipse 400 generates a point S (∈E / GF (p ^k )) on the ellipse defined on the finite field GF (p ^k ) that satisfies the conditions S ≠ P and S ≠ Q. The data is recorded in the recording unit 190 (S720). S may be determined in advance or may be randomly generated as long as it satisfies the conditions. The ellipse addition unit 500 reads Q and S from the recording unit 190, calculates Q ′ (= Q + S), and records it in the recording unit 190 (S730). In the assigning unit 200, an integer obtained by rounding up the decimal point of log (m) -1 is substituted into n and recorded in the recording unit 190 (S740). The control unit 100 reads n from the recording unit 190 and checks whether n <0. If yes, the process proceeds to step S910, and if no, the process proceeds to step S760 (S750). In the case of Yes, the input / output unit 600 reads and outputs F from the recording unit 190 (S910), and the calculation by the Miller algorithm ends. In the case of No, the ellipse addition unit 500 reads T from the recording unit 190, calculates 2T, and records it in the recording unit 190 (S760). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, and 2T from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and 2T, l ₂ (x, y) Assuming = 0 as a straight line connecting 2T and O, l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190 (S770). . However, l ₁ (Q ′) is a value obtained by substituting the x and y coordinates of Q ′ into l ₁ (x, y). If S is selected from elements of a finite field GF (p) (in this case, the elements of the remaining k−1 finite fields GF (p) are 0), l ₁ (S), l ₂ ( The calculation of S) can be omitted, and l ₁ (S) and l ₂ (S) can be omitted in the subsequent steps. Next, the assigning unit 200 reads 2T from the recording unit 190, assigns a value of 2T to T, and records T in the recording unit 190 (S780). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S790). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

Is recorded in the recording unit 190 as a value of F (S810). Here, the process from step S760 to S810 is referred to as an elliptic doubling operation (TDBL, S800). The control unit 100 reads m and n from the recording unit 190 and checks whether the n-th bit of m is 1. If Yes, the process proceeds to step S830, and if No, the process proceeds to step S900 (S820). . In the case of Yes, the ellipse addition unit 500 reads T and P from the recording unit 190, calculates T + P, and records it in the recording unit 190 (S830). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, T + P from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and P, l ₂ (x, y) = 0 is a straight line connecting T + P and O, and l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190. (S840). The assigning unit 200 reads T + P from the recording unit 190, substitutes T + P for T, and records T in the recording unit 190 (S850). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S860). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

And is recorded in the recording unit 190 as the value of F (S880). Here, steps S830 to S880 are referred to as ellipse addition calculation (TADD, S900). When it is determined No in step S820 and when step S880 ends, the assigning unit 200 reads n from the recording unit 190, substitutes n−1 for n, and records n in the recording unit 190 (S890). Next, the process returns to step S750, and the process is repeated until the determination in step S750 becomes Yes.
JP 2004-177673 A

The amount of calculation required for the pairing calculation is very large compared to a normal elliptic calculation, and the problem is that the calculation speed is slow. In the case of Tate pairing, Miller's algorithm is used for operations that evaluate devisor rational expressions. The problem to be solved by the present invention is to increase the calculation speed of Miller's algorithm.
In particular, the ellipse addition operation S900 shown in FIG. 4 is performed by the number of 1 when m is expressed in binary. Therefore, when m is expressed in binary, if the number of 0 bits can be increased, the calculation speed can be increased. The problem to be solved by the present invention is to increase the number of 0 bits when m is expressed in binary.

In the present invention, when m is expressed, not only 0 and 1 but also −1 is used, and when 1 continues to a bit expressing m, the number of 0 is increased using −1. For example, when m is expressed as 101111 as shown in FIG. 5, it is expressed as 11000 (−1). This expression means 110000-1, which is the same value as 101111. Thus, when −1 is used, an elliptic subtraction operation is required. Therefore, when the n-th bit of m is −1, a straight line passing through the point T and the point −P is l ₁ (x, y), and a straight line passing through the TP and parallel to the y-axis is l ₂ ( A straight line parallel to the y-axis passing through x, y) and P is defined as l ₃ (x, y), and F · (l ₁ (Q ′) l ₂ (S) l ₃ (S)) / (l ₂ (Q ') El ₃ (Q') l ₁ (S)) is substituted into F for elliptic subtraction.

Further, assuming that the coordinates of Q ′ are (x _{Q ′} , y _{Q ′} ), l ₁ (x, y) is a straight line passing through the point T and the point −P, so (y _{Q ′} + y _P ) −λ ( x _{Q ′} −x _P ). Since l ₃ (x, y) is a straight line passing through P and parallel to the y-axis, it can be expressed using (x _{Q ′} −x _P ). Therefore, l ₁ (x, y) / l ₃ (x, y) can be expressed using (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) −λ. In addition, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is a value determined by Q ′ and P. Therefore, if it is calculated first, it can be used repeatedly. Therefore, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance, and A = l ₁ (Q ′) / l ₃ (Q ′) is changed to (y _{Q ′} + y _P ) / ( x · _{Q ′} −x _P ) −λ can be expressed separately using the fact that it can be expressed using F · (A · l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₁ ( S)) is calculated.

According to the present invention, since the number of 0 bits increases in the representation of m, the frequency of performing the ellipse addition operation is reduced, and the amount of calculation can be reduced. Also, since l ₁ (x, y) and l ₃ (x, y) are straight lines passing through P, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance. By calculating l ₁ (x, y) / l ₃ (x, y) together, the amount of calculation can be reduced. Furthermore, it can be applied to an elliptic curve of an arbitrary characteristic and has a wide application range.

Below, in order to avoid duplication of description, the same number is given to the structural part which has the same function, and the process step which performs the same process, and abbreviate | omits description.
[First Embodiment]
FIG. 6 shows a Miller arithmetic unit 30 ′ according to the present invention. The difference from FIG. 3 is that an m encoding unit 300 is provided. The m encoding unit 300 changes the expression of m shown in FIG. FIG. 7 shows a processing flow of the Miller arithmetic device 30 ′ of FIG. Differences from the conventional processing flow shown in FIG. 4 are as follows. After step S740, m bit string conversion (S110) is added, and when step S820 is No, a process of confirming whether the nth bit of m is −1 (S130) is added, step S130 In the case of Yes, an ellipse subtraction operation (TSUB, S140 or S140 ′) is added.

  FIG. 8 shows details of step S110, and FIG. 9 shows details of step S140. In step S110, 0 is first substituted for i and recorded in the recording unit 190 (S111). The control unit 100 confirms whether the i-th bit of m is 1 (S112). If the confirmation in step S112 is No, the process proceeds to step S115. When the confirmation in step S112 is Yes, the control unit 100 confirms whether the bit of the i + 1th night of m is 1 (S113). If the confirmation in step S113 is No, the process proceeds to step S115. If the confirmation in step S113 is Yes, the control unit 100 sets the i-th bit of m to -1, sets the i + 1-th bit to 2, and records the new m in the recording unit 190 (S114). Next, the control unit 100 confirms whether the i-th bit of m is 2 (S115). When step S115 is No, it progresses to step S117. When Step S115 is Yes, the control unit 100 sets the i-th bit of m to 0, adds 1 to the i + 1-th bit, and records the new m in the recording unit 190 (S116). Next, it is confirmed whether i = n (S117). If No, the process proceeds to step S118. In step S118, the assigning unit 200 assigns i + 1 to i (S118). In the case of Yes, the control unit 100 checks whether the n + 1-th bit of m is 1 (S119). If step S119 is No, step S110 is terminated. If step S119 is Yes, the assigning unit 200 assigns n + 1 to n, records it in the recording unit 190 (S120), and ends step S110.

を計算し、Ｆの値として記録部１９０に記録する（Ｓ１４５）。このような処理によって楕円減算演算（Ｓ１４０）は終了する。
上述のように処理することによって、ｍを表現するビット列の０を多くすることができ、演算量の削減が期待できる。 FIG. 9 shows the details of the ellipse subtraction operation (TSUB, S140). The ellipse adding unit 500 reads T and P from the recording unit 190, calculates TP, and records it in the recording unit 190 (S141). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, and TP from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and −P, l ₂ Let (x, y) = 0 be a straight line parallel to the y-axis passing through TP, and l ₃ (x, y) = 0 be a straight line parallel to the y-axis passing through P, and l ₁ (Q ′), l ₂ (Q ′), l ₃ (Q ′), l ₁ (S), l ₂ (S), and l ₃ (S) are calculated and recorded in the recording unit 190 (S142). The assigning unit 200 reads TP from the recording unit 190, assigns TP to T, and records T in the recording unit 190 (S143). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′), l ₃ (Q ′), l ₁ (S) from the recording unit 190, and l ₂ (Q ′) ⁻¹ , l ₃ (Q ') ^-1 and l ₁ (S) ^-1 are calculated and recorded in the recording unit 190 (S144). The GF (p ^k ) multiplication unit 700 starts from the recording unit 190 with F, l ₁ (Q ′), l ₂ (S), l ₃ (S), l ₂ (Q ′) ⁻¹ , l ₃ (Q ′). ⁻¹ , l ₁ (S) ⁻¹ is read,

And is recorded in the recording unit 190 as a value of F (S145). The ellipse subtraction operation (S140) is completed by such processing.
By performing the processing as described above, it is possible to increase the number of 0s in the bit string expressing m and reduce the amount of calculation.

[Modification]
In the present modification, the amount of calculation is reduced by utilizing the fact that both l ₁ (x, y) and l ₃ (x, y) are straight lines passing through P. Specifically, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance and A = l ₁ (x, y) / l ₃ (x, y) is calculated. F · (A · l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₁ (S)). FIG. 10 and FIG. 11 show changes from the processing flow shown in the first embodiment.
FIG. 10 shows a step S730 ′ that replaces the step S730 in FIG. In step S730 ′, not only the coordinates of Q ′ are calculated, but also the coordinates of P are read out from the recording unit, and (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is also calculated. 190.

を計算し、Ｆの値として記録部１９０に記録する。このような処理によって（ｙ_Ｑ’＋ｙ_Ｐ）／（ｘ_Ｑ’−ｘ_Ｐ）をあらかじめ計算しておけるので、繰り返し処理での演算量を削減できる。 FIG. 11 shows a step S140 ′ that replaces the step S140 of FIG. Differences between step S140 ′ and step S140 are step S142 ′, step S144 ′, and step S145 ′. In step S142 ′, the GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, TP, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) from the recording unit 190. , L ₁ (x, y) = 0 is a straight line connecting T and −P, l ₂ (x, y) = 0 is a straight line passing through TP and parallel to the y axis, and l ₃ (x, y) = Let 0 be a straight line passing through P and parallel to the y-axis, and λ, l ₁ (Q ′) / l ₃ (Q ′), l ₂ (Q ′), l ₁ (S) / l ₃ (S), l ₂ (S) is calculated and recorded in the recording unit 190. In step S144 ′, the GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) / l ₃ (S) from the recording unit 190, l ₂ (Q ′) ⁻¹ , (L ₁ (S) / l ₃ (Q ′)) ⁻¹ is calculated and recorded in the recording unit 190. In step S145 ′, the GF (p ^k ) multiplication unit 700 starts from the recording unit 190 with F, l ₁ (Q ′) / l ₃ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , (L ₁ (S) / l ₃ (Q ′)) ⁻¹ is read,

Is recorded in the recording unit 190 as the value of F. Since (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) can be calculated in advance by such processing, the amount of calculation in the repetitive processing can be reduced.

[Second Embodiment]
In the present invention, the speed is further increased by using the property of a finite field. FIG. 12 shows the principle of speeding up the operation. Tate The pairing, while mapping the original f on the finite field GF ^{(p k)} based on e on the finite field GF by exponentiation ^{(p k),} the finite field GF ^{(p k)} above satisfies the following condition: Is also mapped to the element e on the finite field GF (p ^k ) by a power operation.

f ′ = rf where r is an element on the finite field GF ( ^{pk / 2} ) (1)
Therefore, in the present invention, when k is an even number, the property of this finite field is used, and an element f ′ is obtained by an algorithm having a smaller calculation amount than the Miller algorithm (hereinafter referred to as “pseudo Miller algorithm”). The element e is obtained by calculating the power of f ′.

を満足する有限体ＧＦ（ｐ^ｋ／２）上の元ｎが存在する。したがって、

であり、式（１）の関係を満足する。そこで、

を擬似逆元として使用できる。
さらに、特に、ｌ_２（Ｑ’）の逆元の場合には、以下のような擬似逆元を使うことができる。ｌ_２（Ｑ’）は、
ｌ_２（Ｑ’）＝ｇＸ_Ｑ’＋ｈ （５）
と表すことができる。ここで、ｇ、ｈはＧＦ（ｐ）上の元である。さらに、フェルマーの小定理から、

と変形することができる。ここでＸ＾_Ｑ’はＸ_Ｑ’の共役元、ｌ＾_２（Ｑ’）はｌ_２（Ｑ’）の共役元である。そこで、ｌ＾_２（Ｑ’）をｌ_２（Ｑ’）の擬似逆元として用いることができる。 In the pseudo Miller algorithm, the process of obtaining an inverse element using the Miller algorithm is replaced with a process of obtaining an element that is r times the inverse element obtained with a small amount of calculation (hereinafter referred to as “pseudo inverse element”). Specifically, when k is an even number and L is an element on a finite field GF (p ^k ),

There exists an element n on a finite field GF (p ^{k / 2} ) that satisfies Therefore,

And satisfies the relationship of the formula (1). Therefore,

Can be used as a pseudo inverse element.
Furthermore, in particular, in the case of the inverse element of l ₂ (Q ′), the following pseudo inverse element can be used. l ₂ (Q ′) is
l ₂ (Q ′) = gX _{Q ′} + h (5)
It can be expressed as. Here, g and h are elements on GF (p). From Fermat's little theorem,

And can be transformed. Here X ^ _{Q 'is} X _Q' conjugate original, _{l ^} 2 (Q ') is _l 2 (Q' is a conjugate original). Therefore, l ₂ (Q ′) can be used as a pseudo inverse element of l ₂ (Q ′).

FIG. 13 shows a functional configuration example of the pairing arithmetic device of the present invention. The difference from FIG. 2 is that a pseudo Miller arithmetic device 10 is provided instead of the Miller arithmetic device 30. The pseudo Miller arithmetic device 10 is a device that realizes a pseudo Miller algorithm by using the pseudo inverse element. An example of the internal configuration of the pseudo Miller arithmetic device 10 is shown in FIG. 14 differs from FIG. 3 in that the type of data recorded in the recording unit 150 in FIG. 14 is different from the type of data recorded in the recording unit 190 in FIG. 3 and the pseudo inverse element is calculated. The pseudo GF (p ^k ) inverse element 800 is added to the above. 15 is a processing flow of the ellipse subtraction operation S140 ”replaced with FIG. 9. This processing flow is common to all of the processing flows, but“ to the recording unit 190 ”in the description of FIGS. “Recording” or “reading from the recording unit 190” is read as “recording in the recording unit 150” or “reading from the recording unit 150” in FIG. The difference between the processing flow in FIG. 15 and the processing flow in FIG. 9 is that step S144 is replaced with step S146, and step S145 is replaced with step S147.

を計算し、Ｆの値として記録部１５０に記録する。 In step S146, the pseudo GF (p ^k ) inverse element unit 800 reads l ₂ (Q ′), l ₃ (Q ′), l ₁ (S) from the recording unit 150, and l ₂ (Q ′), l ₃ (Q ′), a pseudo inverse element of l ₁ (S) is calculated and recorded in the recording unit 150. In step S 147, the GF (p ^k ) multiplication unit 700 performs the pseudo inverse of l ₂ (Q ′), l ₃ (Q ′), and l ₁ (S) from the recording unit 150, and F, l ₁ (Q ′ ), L ₂ (S), l ₃ (S),

Is recorded in the recording unit 150 as the value of F.

[Modification]
In this modification, as in the modification of the first embodiment, the amount of calculation is reduced by utilizing the fact that both l ₁ (x, y) and l ₃ (x, y) are straight lines passing through P. . Specifically, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance and A = l ₁ (x, y) / l ₃ (x, y) is calculated. , Pseudo F · (A · l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₁ (S)) is calculated. FIG. 10 and FIG. 16 show changes from the processing flow shown in the second embodiment.
FIG. 10 shows a step S730 ′ that replaces the step S730 in FIG. In step S730 ′, not only the coordinates of Q ′ are calculated, but also the coordinates of P are read out from the recording unit, and (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is also calculated. Record 150.

を計算し、Ｆの値として記録部１５０に記録する。このような処理によって（ｙ_Ｑ’＋ｙ_Ｐ）／（ｘ_Ｑ’−ｘ_Ｐ）をあらかじめ計算しておけるので、繰り返し処理での演算量をさらに削減できる。 FIG. 16 shows step S140 ′ ″ instead of step S140 ″ in FIG. 15. The difference between step S140 ′ ″ and step S140 ″ is step S142 ′, step S146 ′, and step S147 ′. . In step S142 ′, the GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, TP, (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) from the recording unit 150. , L ₁ (x, y) = 0 is a straight line connecting T and −P, l ₂ (x, y) = 0 is a straight line passing through TP and parallel to the y axis, and l ₃ (x, y) = Let 0 be a straight line passing through P and parallel to the y-axis, and λ, l ₁ (Q ′) / l ₃ (Q ′), l ₂ (Q ′), l ₁ (S) / l ₃ (S), l ₂ (S) is calculated and recorded in the recording unit 150. In step S146 ′, the GF (p ^k ) inverse element unit 800 reads l ₂ (Q ′), l ₁ (S) / l ₃ (S) from the recording unit 150, and l ₂ (Q ′), (l ₁ (S) / l ₃ (Q ′)) is calculated and recorded in the recording unit 150. In step S147 ′, the GF (p ^k ) multiplication unit 700 starts recording from the pseudo-inverse element of l ₂ (Q ′) and (l ₁ (S) / l ₃ (Q ′)) F, l ₁ ( Q ′) / l ₃ (Q ′), l ₂ (S),

Is recorded in the recording unit 150 as the value of F. Since (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) can be calculated in advance by such processing, the amount of calculation in the repetitive processing can be further reduced.

  The present invention can be executed as a computer main body and a computer program, or can be realized by being mounted on a digital signal processor or a dedicated LSI.

The figure which shows the outline | summary of Tate pairing calculation. The figure which shows the function structural example of the pairing calculating device using Tate pairing. The figure which shows the internal structural example of a Miller arithmetic unit. The figure which shows the processing flow of a Miller algorithm. The figure which shows the example of the method of expressing m by the bit sequence containing (-1). The figure which shows the Miller arithmetic unit of this invention. The figure which shows the processing flow of the Miller arithmetic unit of this invention. The figure which shows the processing flow of bit string conversion of m. The figure which shows the processing flow of an ellipse subtraction calculation. The figure which shows changing step S730 into step S730 '. The figure which shows the modification of the processing flow of an ellipse subtraction calculation. The figure which shows the principle of the speeding-up of a calculation. The figure which shows the function structural example of the pairing calculating apparatus of this invention. The figure which shows the internal structural example of a pseudo Miller arithmetic unit. The figure which shows the processing flow of the ellipse subtraction calculation at the time of using a pseudo inverse element. The figure which shows the modification of the processing flow of the ellipse subtraction calculation at the time of using a pseudo inverse element.

Claims (9)

The point P on the elliptic curve on the finite field GF (p) and the point Q on the elliptic curve on the finite field GF (p ^k ) are input, and the element f on the finite field GF (p ^k ) is input from the input point. In a pairing arithmetic unit comprising: a Miller arithmetic unit for obtaining a power and a power arithmetic unit for mapping the element on the obtained finite field to the element e (P, Q) on the finite field GF (p ^k )
p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest even number satisfying m | (p ^k −1), and m is not a divisor of (p−1) , And the greatest common divisor of p and m is 1, T is an element on a finite field GF (p), S and F are elements on a finite field GF (p ^k ), and Q ′ is Q + S.
When m encoding means for expressing a value representing m in binary number using 0, 1, and -1 is provided, and the nth bit of m is -1,
TP is calculated and recorded on the recording means,
A straight line passing through the point T and the point -P is l ₁ , a straight line parallel to the y-axis passing through TP is l ₂ , and a straight line parallel to the y-axis passing through P is l ₃ , and F · (l ₁ (Q ') L ₂ (S) l ₃ (S)) / (l ₂ (Q') l ₃ (Q ') l ₁ (S)) is substituted into F and the Miller operation is performed A pairing arithmetic device comprising a unit. In the pairing arithmetic device according to claim 1,
When the coordinates of Q ′ and P are respectively (x _{Q ′} , y _{Q ′} ) (x _P , y _P ), (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance. , Record it on the recording means,
When performing the elliptical subtraction, A = l ₁ (Q ′) / l ₃ (Q ′) is calculated using (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) recorded in advance. Recorded in the recording section,
When F · (l ₁ (Q ′) l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₃ (Q ′) l ₁ (S)) is calculated, it is recorded in the recording unit. , A is read, and F · (A · l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₁ (S)) is calculated. Ring arithmetic unit. The point P on the elliptic curve on the finite field GF (p) and the point Q on the elliptic curve on the finite field GF (p ^k ) are input, and the element f on the finite field GF (p ^k ) is input from the input point. In a pairing arithmetic unit comprising: a pseudo Miller arithmetic unit for obtaining ', and a power arithmetic unit that maps the obtained element on the finite field to the element e (P, Q) on the finite field GF (p ^k ) and outputs the result ,
p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest even number satisfying m | (p ^k −1), and m is not a divisor of (p−1) , And the greatest common divisor of p and m is 1, T is an element on a finite field GF (p), S and F are elements on a finite field GF (p ^k ), and Q ′ is Q + S.
When m encoding means for expressing a value representing m in binary number using 0, 1, and -1 is provided, and the nth bit of m is -1,
TP is calculated and recorded on the recording means,
A straight line passing through the point T and the point -P is l ₁ , a straight line parallel to the y axis passing through the TP is l ₂ , and a straight line passing through the P is parallel to the y axis is expressed as l ₃ , l ₂ (Q ′). the inverse in the case of the _{L 2,} F · a _{(l 1 (Q ') l} 2 (S) l 3 (S)) · L 2 / (l 3 (Q') l 1 (S)) F Performing the elliptic subtraction to be substituted into the pseudo Miller arithmetic unit,
Mapping the element f ′ obtained by the similar Miller operation unit to the element e (P, Q) on the finite field GF (p ^k ) by a power operation;
A pairing arithmetic device comprising: In the pairing arithmetic unit according to claim 3,
When the coordinates of Q ′ and P are respectively (x _{Q ′} , y _{Q ′} ) (x _P , y _P ), (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance. , Record it on the recording means,
When performing the elliptical subtraction, A = l ₁ (Q ′) / l ₃ (Q ′) is calculated using (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) recorded in advance. Recorded in the recording section,
When calculating F · (l ₁ (Q ′) l ₂ (S) l ₃ (S)) · L ₂ / (l ₃ (Q ′) l ₁ (S)), A recorded in the recording unit is A pairing arithmetic device comprising the pseudo Miller arithmetic unit, characterized in that reading, F · (A · l ₂ (S) l ₃ (S)) · L ₂ / l ₁ (S) is calculated. The point P on the elliptic curve on the finite field GF (p) and the point Q on the elliptic curve on the finite field GF (p ^k ) are input, and the element f on the finite field GF (p ^k ) is input from the input point. In a pairing operation method for performing Miller operation for obtaining, and mapping the obtained element on the finite field to the element e (P, Q) on the finite field GF (p ^k ) and outputting the power,
p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest even number satisfying m | (p ^k −1), and m is not a divisor of (p−1) , And the greatest common divisor of p and m is 1, T is an element on a finite field GF (p), S and F are elements on a finite field GF (p ^k ), and Q ′ is Q + S.
In the Miller calculation unit,
Express the value of m in binary using 0, 1, and -1,
If the nth bit of m is -1,
TP is calculated and recorded on the recording means,
A straight line passing through the point T and the point -P is l ₁ , a straight line parallel to the y-axis passing through TP is l ₂ , and a straight line parallel to the y-axis passing through P is l ₃ , and F · (l ₁ (Q ') L ₂ (S) l ₃ (S)) / (l ₂ (Q') l ₃ (Q ') l ₁ (S)) is substituted into F for elliptical subtraction Method. In the pairing calculation method according to claim 5,
In the Miller calculation unit,
When the coordinates of Q ′ and P are respectively (x _{Q ′} , y _{Q ′} ) (x _P , y _P ), (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance. , Record it on the recording means,
When performing the elliptical subtraction, A = l ₁ (Q ′) / l ₃ (Q ′) is calculated using (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) recorded in advance. Recorded in the recording section,
When F · (l ₁ (Q ′) l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₃ (Q ′) l ₁ (S)) is calculated, it is recorded in the recording unit. , A is read, and F · (A · l ₂ (S) l ₃ (S)) / (l ₂ (Q ′) l ₁ (S)) is calculated. The point P on the elliptic curve on the finite field GF (p) and the point Q on the elliptic curve on the finite field GF (p ^k ) are input, and the element f on the finite field GF (p ^k ) is input from the input point. In a pairing operation method for performing a pseudo Miller operation for obtaining 'and a power operation for mapping an element e (P, Q) on a finite field GF (p ^k ) and outputting the element e (P, Q)
p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest even number satisfying m | (p ^k −1), and m is not a divisor of (p−1) , And the greatest common divisor of p and m is 1, T is an element on a finite field GF (p), S and F are elements on a finite field GF (p ^k ), and Q ′ is Q + S.
In the pseudo Miller calculation unit,
Express the value of m in binary using 0, 1, and -1,
If the nth bit of m is -1,
TP is calculated and recorded on the recording means,
A straight line passing through the point T and the point -P is l ₁ , a straight line parallel to the y axis passing through the TP is l ₂ , and a straight line passing through the P is parallel to the y axis is expressed as l ₃ , l ₂ (Q ′). the inverse in the case of the _{L 2,} F · a _{(l 1 (Q ') l} 2 (S) l 3 (S)) · L 2 / (l 3 (Q') l 1 (S)) F Perform elliptic subtraction to assign to,
In the power calculator,
A pairing operation method, wherein the element f ′ obtained by the pseudo Miller operation is mapped to an element e (P, Q) on a finite field GF (p ^k ) by a power operation. In the pairing calculation method according to claim 7,
In the pseudo Miller calculation unit,
When the coordinates of Q ′ and P are respectively (x _{Q ′} , y _{Q ′} ) (x _P , y _P ), (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) is calculated in advance. , Record it on the recording means,
When performing the elliptical subtraction, A = l ₁ (Q ′) / l ₃ (Q ′) is calculated using (y _{Q ′} + y _P ) / (x _{Q ′} −x _P ) recorded in advance. Recorded in the recording section,
When calculating F · (l ₁ (Q ′) l ₂ (S) l ₃ (S)) · L ₂ / (l ₃ (Q ′) l ₁ (S)), A recorded in the recording unit is A pairing calculation method characterized by calculating F · (A · l ₂ (S) l ₃ (S)) · L ₂ / l ₁ (S). The pairing program which implement | achieves the apparatus in any one of Claim 1 to 4 with a computer.

Images