JP2007286380A - Finite commutative group operation method, device, and program for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the cost of arithmetic operation and square, while avoiding inverse element operations, in a group operation of elements of a finite commutative group formed of points on an algebraic curve defined on a finite field. <P>SOLUTION: A finite commutative group operation device includes a pseudo-inverse element operating means for calculating a pseudo-inverse element v(p), satisfying N(p)=v(p)×p [where N(p) is an element of a subfield of GF(q<SP>m</SP>), v(p) is an element of GF(q<SP>m</SP>)] with respect to the element p of a finite field GF(q<SP>m</SP>) [q is a prime number or a power of the prime number, m is an integer of m>1]; and a complement pseudo-inverse element operating means for calculating a complement pseudo-inverse element N(p). In the finite commutative group operation, a group operation of elements of a finite commutative group formed of points on an algebraic curve defined on GF(q<SP>m</SP>) is performed, while avoiding an inverse element operation of a divisor in a group operation, by independently calculating a divisor and a dividend that appear in a division on GF(q<SP>m</SP>) and associating the divisor with an expanded coordinate. The pseudo inverse element operating means calculates a pseudo-inverse element, the complement pseudo inverse element operating means calculates a complement pseudo-inverse element, the pseudo inverse element is included in a dividend, and the complement pseudo-inverse element is set as a divisor. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a technique for performing an original group operation of a finite commutative group.

In public key cryptography and digital signatures using algebraic curves defined on finite fields (hereinafter, unless otherwise noted, simply algebraic curves are algebraic curves defined on finite fields) The original group operation of the finite commutative group defined on the algebraic curve is performed. For example, when a cryptographic algorithm based on an algebraic curve based on the amount of calculation required to solve a number theoretic problem is constructed on an algebraic curve, there is a discrete logarithm problem as such a number theoretic problem. The discrete logarithm problem is a problem of finding n∈Z _N satisfying α = nβ where G is a finite commutative group, α and β are elements of G, and N is the order of G. In this example, α = nβ = β + β +... + Β (a scalar multiplication operation in which β is added n times) is expressed by a group operation. And this group operation is comprised by the operation of the finite field in which an algebraic curve is defined.

In order to facilitate understanding, a specific example will be described.
An elliptic curve defined on a finite field GF (q ^m ) is selected as an example of an algebraic curve defined on a finite field [q is a prime number or a power of a prime number, and m is an integer of m> 1. ]. This elliptic curve is a genus 1 hyperelliptic curve, and the rational point set E (GF (q ^m )) is a finite commutative group [see Equation (1). However, in the Weierstrass format of the Affine coordinate system, the characteristics q ≠ 2, q ≠ 3, and 4a ³ + 27b ² ≠ 0, and the point O is a point at infinity. ].

At this time, the elliptic discrete logarithm problem is that P∈E (GF (q ^m )), Q∈E (GF (q ^m )), k∈Z / q ^m Z, Q = kP = P + P +. This is a problem of finding k that satisfies (an elliptic scalar multiplication operation in which P is added k times).

  The elliptic scalar multiplication is generally composed of addition of points on an elliptic curve and doubling. The addition and doubling of points on an elliptic curve are each composed of four arithmetic operations of a finite field in which the curve is defined.

The point R ₁ (x ₁ , y ₁ ), the point R ₂ (x ₂ , y ₂ ), and the point R ₃ (x ₃ , y ₃ ) are points on the elliptic curve. If x ₁ = x ₂ and y ₁ = −y ₂ , R ₁ + R ₂ = O (point at infinity), otherwise R ₁ + R ₂ = R ₃ . At this time, Expression (2) is established. The case where P ≠ Q is an elliptic addition formula, and the case where P = Q is an elliptic doubling formula.

An example of the algorithm (calculation procedure) of the ellipse addition formula in the Affine coordinate system and its calculation cost are shown in FIG. Input: (x ₁ , y ₁ ) ∈GF (q ^m ) ² , (x ₂ , y ₂ ) ∈GF (q ^m ) ² , Output: (x ₃ , y ₃ ) ∈GF (q ^m ) ² The actual calculation content is shown on the left side of the figure. In addition, the calculation cost corresponding to the calculation contents is shown on the right side of the figure, where I is the calculation cost of the inverse element on the finite field, M is the calculation cost of multiplication on the finite field, and S is the calculation cost of square on the finite field. . Note that the calculation cost of addition or subtraction on a finite field or 1/2 multiplication is negligible because it is sufficiently smaller than the calculation cost of the inverse element on the finite field, the calculation cost of multiplication, and the calculation cost of square. Please note that it is not described in. In addition, in the calculation of the calculation cost, it should be noted that when the value used for the calculation content is calculated based on the previous calculation content, it is not necessary to recalculate the value. In the example shown in FIG. 1, Λ is calculated in the first calculation step and Λ is calculated in the second and third calculation steps, but Λ calculated in the first calculation step is stored in the memory. It is possible to avoid recalculation of Λ by storing Λ in the storage means and reading Λ from the storage means in the second and third calculation steps.

Similarly, FIG. 2 shows an example of an algorithm (calculation procedure) of an elliptic doubling formula in the Affine coordinate system and its calculation cost. However, input: (x ₁ , y ₁ ) εGF (q ^m ) ² and output: (x ₃ , y ₃ ) εGF (q ^m ) ² . The calculation cost symbols are as described above.

  As is clear from FIG. 1 and FIG. 2, in order to execute the ellipse addition once, it is necessary to perform an inverse element on the finite field, one multiplication, and one squaring. In order to execute once, it is necessary to perform an inverse element once on the finite field, two multiplications, and two squares.

  Inverse element operations on a finite field are generally more complex to implement and slower than multiplications on a finite field. Therefore, various methods have been devised for avoiding the inverse operation by expressing the points on the elliptic curve not by two finite field elements (x, y) but by three or more finite field elements. That is, the elliptic curve expressed in the Affine coordinate system is converted into the elliptic curve expressed in the projective coordinate system.

For example, the Jacobian coordinate system, which is one of the projected coordinate systems, is a representation method based on three elements of a finite field, and the Affine coordinates (x, y) are Jacobian coordinates ( xZ ² , yZ ³ , Z). Conversely, when Jacobian coordinates (X, Y, Z) with Z ≠ 0 are given (X / Z ² , Y / Z ³ ), the corresponding Affine coordinates can be obtained at any time (see Non-Patent Document 1). .

An example of the algorithm (calculation procedure) of the ellipse addition formula in the Jacobian coordinate system and its calculation cost are shown in FIG. However, input: (X ₁ , Y ₁ , Z ₁ ) ∈GF (q ^m ) ³ , (X ₂ , Y ₂ , Z ₂ ) ∈GF (q ^m ) ³ , output: (X ₃ , Y ₃ , Z ₃ ) ∈ GF (q ^m ) ³ The calculation cost symbols are as described above.
Similarly, FIG. 4 shows an example of an algorithm (calculation procedure) of the elliptic doubling formula in the Jacobian coordinate system and its calculation cost. However, the input is (X ₁ , Y ₁ , Z ₁ ) εGF (q ^m ) ³ , and the output is (X ₃ , Y ₃ , Z ₃ ) εGF (q ^m ) ³ . The calculation cost symbols are as described above.

In the Jacobian coordinate system, in order to execute general ellipse addition once, 12 multiplications and 4 square operations on a finite field are required. When Z ₂ = 1, ellipse addition is executed once. It is necessary to perform 8 multiplications and 3 squaring operations on a finite field. In addition, in order to execute general elliptic doubling once, four multiplications and six squares on a finite field are required. When a = -3, elliptic doubling is executed once. In addition, 4 multiplications and 4 squaring operations on a finite field are required.

In the case of the above ellipse addition, in the Affine coordinate system, an inverse element operation is required for calculating Λ [Λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ) = (y ₂ − _{y 1) × (x 2 -x} 1) ^-1. ]. If the Λ numerator in the Affine coordinate system is the dividend Λ _n = y ₂ −y ₁ and the Λ denominator in the Affine coordinate system is the divisor Λ _d = x ₂ −x ₁ , In the Affine coordinate system, the inverse operation of the divisor Λ _d cannot be avoided [Λ = Λ _n × Λ _d ⁻¹ . ].

On the other hand, in the Jacobian coordinate system, Λ in the Affine coordinate system is transformed and the numerator equivalent Y ′ ₂ -Y ′ ₁ is used as the dividend Λ _n, and Λ in the Affine coordinate system is transformed into the denominator equivalent X ′. the ₂ -X _'1 and divisor lambda _d, and calculates independently the the coordinates except the coordinates of Affine coordinate system of the coordinates of the enlarged coordinates [projective coordinate system divisor lambda _d. This corresponds to the third coordinate Z in the Jacobian coordinate system. ], The inverse operation of the divisor Λ _d is avoided. Note that Λ _{Jacobian obtained} by converting Λ in the Affine coordinate system into the Jacobian coordinate system has Λ _Jacobian = (Y ′ ₂ −Y ′ ₁ ) / (X ′ ₂ −X ′ ₁ ) × f (Z ₁ , Z ₂ ), Y ′ ₂ -Y ′ ₁ is called “corresponding to the numerator” and X ′ ₂ -X ′ ₁ is called “corresponding to the denominator”.
This is the same in the above-described example of elliptic doubling, and also in the projective coordinate system such as the Projective coordinate system and the Chudnovsky coordinate system as well as the Jacobian coordinate system [however, always Λ _n = Y ′ ₂ It does not mean that -Y ′ ₁ , Λ _d = X ′ ₂ −X ′ ₁ . ].

As can be seen from the above examples, in the Jacobian coordinate system, although the inverse element calculation can be avoided as compared with the case of the Affine coordinate system, the calculation costs of multiplication and square increase.
H. Cohen, A. Miyaji, and T. Ono, “Efficient elliptic curve exponentiation using mixed coordinates”, Advances in Cryptology-Proceedings of ASIACRYPT '98, Lecture Notes in Computer Science, Springer-Verlag, 1514 (1998), 51- 65.

Although illustrated by elliptic addition and elliptic doubling of elliptic curves defined on a finite field, in general, in the original group operation of a finite commutative group formed by points on an algebraic curve defined on a finite field In the Affine coordinate system, an inverse operation on a finite field is inevitable. On the other hand, by converting the algebraic curve into the projective coordinate system, it is possible to avoid the inverse element operation on the finite field that appears in the group operation.
However, such an avoidance method has a problem that even if the inverse element operation on the finite field can be avoided, the operation cost of multiplication and square increases.

  In view of the above problems, the present invention is an original group operation (finite commutative group operation) of a finite commutative group formed by points on an algebraic curve defined on a finite field, and avoids an inverse element operation. It is another object of the present invention to provide a finite commutative group calculation method, apparatus, and program that reduce the calculation cost of calculation and square.

In order to solve the above problems, the present invention is configured as follows. That is, a finite field GF (q ^m ) [where q is a prime number or a power of a prime number, and m is an integer of m> 1. ] N (p) = v (p) × p [where N (p) is an element of a finite field GF (q ^m ) and v (p) is a finite field GF ( q ^m ). ] Pseudo inverse element calculation means for calculating pseudo inverse element v (p) satisfying the above and complementary pseudo inverse element calculation means for calculating complementary inverse element N (p). An algebraic curve defined on the finite field GF (q ^m ) [suppose that it is expressed in a projective coordinate system. ] The original group operation of the finite commutative group formed by the above points is calculated by dividing the divisor and the dividend appearing in the division on the finite field GF (q ^m ) independently, and the divisor is expanded coordinates [coordinates of the above projective coordinate system] Are coordinates excluding the coordinates of the Affine coordinate system. ] Is a finite commutative group operation that avoids the inverse operation of the divisor in the above group operation, the pseudo inverse element calculation means calculates the pseudo inverse element, and the complementary pseudo inverse element calculation means complements it. The pseudo inverse element is calculated, the pseudo inverse element is included in the dividend, and the complementary pseudo inverse element is divided.
Thus, by calculating the finite GF ^{(q m)} is the original pseudo inverse element v (p) and finite GF ^{(q m)} is a part of the original auxiliary pseudo inverse element N (p), The pseudo inverse element is included in the dividend and the complementary pseudo inverse element is used as the divisor.

Further, the enlarged coordinates of the points on the algebraic curve expressed in the projective coordinate system may be given under the subfield of the finite field GF (q ^m ).
This means that the element of the enlarged coordinate can be given by the field to which the complementary pseudo-inverse element N (p) belongs, and the calculation on the subfield of the finite field GF (q ^m ) is possible. That is, it is possible to calculate at a calculation cost on the partial body.

The complementary pseudo inverse element N (p) may be the norm of the element p on the finite field GF (p ^m ). Then, the complementary pseudo inverse element N (p) may be expressed as a norm by the expression (r1), and the pseudo inverse element v (p) may be expressed by the expression (r2).
Norm of the original p over a finite GF ^{(p m)} can provide the original portion of the finite field GF ^{(p m).}

Each term p ^{θ of the} pseudo inverse element v (p) represented by the equation (r2) [where θ = q ⁱ . ] May be obtained by the Frobenius map, the pseudo-represented by the formula (r2) inverse element v a (p) is expressed as Equation (r3), may be obtained by adding a chain of p ^u appearing in equation (r3) .

  If the group operation is an addition operation and / or a doubling operation, for example, the scalar doubling operation is constituted by an adding operation and / or a doubling operation, which contributes to the realization of an efficient scalar doubling operation.

  Further, the computer can be operated as a finite commutative group computing device by a finite commutative group computing program that causes the computer to function as the finite commutative group computing device of the present invention.

According to the present invention, in an original group operation (finite finite commutative group operation) of a finite commutative group formed by points on an algebraic curve defined on a finite field, a pseudo inverse that is an element of a finite field GF (q ^m ). A complementary pseudo-inverse element N (p) that is an element of a subfield of the element v (p) and the finite field GF (q ^m ) is calculated, and the pseudo-inverse element v (p) is included in the dividend to obtain the complementary pseudo-inverse element N Let (p) be a divisor. Calculation of the finite field GF (q ^m) of the portion of the original in which the auxiliary pseudo inverse element N (p) is a finite field GF (q ^m) is smaller than the computational cost of multiplication and square on. In addition, the calculation of the pseudo inverse element v (p) is smaller than the calculation cost of the inverse element on the finite field GF (q ^m ), and there is a more efficient calculation method. Therefore, it is possible to perform a finite commutative group calculation with reduced calculation cost and square calculation cost while avoiding the inverse element calculation.

"theory"
An operation called a pseudo inverse element operation can be defined for a finite field having a subfield.
<Pseudo inverse operation>
The pseudo inverse element operation is N (x) = x × v (x) with respect to an element x on a finite field GF (q ^m ) where q is a prime number or a prime power and m is an integer of m> 1. This is an operation for outputting (v (x), N (x)). However, v (x) is an element of a finite field GF (q ^m ), and N (x) is an element of a subfield GF (ξ) of the finite field GF (q ^m ).
Here, v (x) is referred to as a pseudo inverse element and N (x) is referred to as a complementary pseudo inverse element.

Using the pseudo inverse element v (x) and the complementary pseudo inverse element N (x), the inverse element x ⁻¹ of x is given by v (x) × N (x) ⁻¹ . In other words, the inverse element x ⁻¹ is given as a division with the dividend v (x) as the numerator and the divisor N (x) as the denominator.
Focusing on this, in the example of elliptic addition in the Jacobian coordinate system, the dividend Λ _n is v (X ′ ₂ −X ′ ₁ ) × (Y ′ ₂ −Y ′ ₁ ), and the divisor λ _d is N _{(X '2} -X' ₁₎ and then, a computed independently, by associating the divisor lambda _d, i.e. the complement pseudo inverse _N to _{(X '2} -X' ₁₎ expand coordinates, inverse of the divisor lambda _d The original calculation can be avoided [x = X ′ ₂ −X ′ ₁ may be considered. ]. This is the same not only in the case of elliptic doubling in the Jacobian coordinate system but also in other projective coordinate systems and algebraic curves. However, it does not always mean that Λ _n = v (X ′ ₂ −X ′ ₁ ) × (Y ′ ₂ −Y ′ ₁ ), λ _d = N (X ′ ₂ −X ′ ₁ ). For example, in the case of elliptic doubling in the Projective coordinate system, λ _d = N (2Y ₁ ) × z ₁ is given. However, even in this case, the configuration may be given by λ _d = N (2Y ₁ ) and λ ′ _d = λ _d × z ₁ , and even in this case, the overall calculation cost does not change. In short, it is assumed that v (X ′ ₂ −X ′ ₁ ) is included in the dividend Λ _n and that the divisor λ _d is N (X ′ ₂ −X ′ ₁ ), and that each operation is performed independently. By associating the divisor λ _d with the enlarged coordinates, the inverse operation of the divisor λ _d is avoided.

  In the case of the inverse element avoidance technique using such a pseudo inverse element operation, the operation cost of the pseudo inverse element v (x) and the complementary pseudo inverse element N (x) is lower than that of the conventional inverse element avoidance technique. I need it. Since there is a method for efficiently performing the pseudo inverse element calculation, an example will be described.

One method for efficiently performing the pseudo inverse element calculation is a method using, for example, a qn- ^th power map (Frobenius map). Here, for convenience of explanation, a partial field GF (ξ) of a finite field GF (q ^m ) will be described as a finite field GF (q).

<Pseudo inverse operation with q ^n-th power mapping>
For x where x∈GF (q ^m ), z given by Equation (3) is called norm. It is known that norm z is always z∈GF (q).

Equation (4) is obtained from Equation (3).

If Equation (4) is regarded as z = xy, the parenthesis part corresponds to y. That is, y is expressed by the formula (5). At this time, it can be considered that z corresponds to the complementary pseudo-inverse element N (x) and y corresponds to the pseudo-inverse element v (x).

<Norm>
Since norm z is generally guaranteed to be z∈GF (q), the operation cost of z = xy is sufficiently smaller than the operation cost of multiplication or square on GF (q ^m ).

^{<Q n-th} power mapping>
Usually, ^m elements x _i (0 ≦ i <m) on the finite field GF (q) are used to represent the element x on the finite field GF (q ^m ). A typical method for associating a set of m x _i εGF (q), (0 ≦ i <m) with an element on GF (q ^m ) is m α _i εGF (q ^m ), Using the group (0 ≦ i <m), the correspondence shown in the equation (6) is taken.

At this time, α _i (0 ≦ i <m) must be a combination that allows one-to-one correspondence between GF (q) ^m and GF (q ^m ). This α _i (0 ≦ i <m) is called a base.

By the way, according to the binomial theorem, Equation (7) is established.

The coefficient (q, i) of each term on the right side of Equation (7) is a constant called a binomial coefficient, and is always a multiple of q when i ≠ 0 and i ≠ q. When a, bεGF (q ^m ), since the integer multiple of q is equal to 0 (the characteristic of GF (q ^m ) is q), Equation (8) is established.

Furthermore, c ^q = c holds for c where c∈GF (q). In general, when a _i ∈GF (q ^m ), (0 ≦ i <n), and c _i ∈GF (q), (0 ≦ i <n), Expression (9) is established.

Therefore, when α _i εGF (q ^m ) and x _i εGF (q), x ^q which is the qth power of x represented by equation (6) is given by equation (10).

Therefore, if c _ij εGF (q) given in Expression (11) has been calculated in advance, Expression (10) can be rewritten into Expression (12), so that the expression of x ^q using the basis α _i Σ _{j = 0} ^m−1 c _ij x _i can be obtained.

That is, a vector expressing x ^q can be obtained simply by multiplying the vector (x _i ) expressing x∈GF (q ^m ) by the matrix (c _ij ). This calculation cost is generally equal to the calculation cost for one multiplication on GF (q ^m ). Further, if the matrix (c _ij ) ⁿ , (n = 2, 3,...) Is obtained in advance, simply multiplying by the matrix (c _ij ) ⁿ gives x ^w [where w = q ⁿ . ] Is obtained. Alternatively, if (c _ij ) ⁻¹ is obtained in advance, a vector expressing x ^{1 / q} can be obtained by simply multiplying by (c _ij ) ⁻¹ . Thus, computational cost of x ^w for general integer n is equal to general GF (q ^m) multiplied batch of computational cost on.

Further, there are two methods shown in the equation (13) as typical ways of selecting the basis α _i . However, β and γ are elements on GF (q ^m ) such that a one-to-one correspondence can be obtained between GF (q) ^m and GF (q ^m ) in each method.

When such a base is selected, the calculation cost may be further reduced. For example, in the case of the method based on the normal basis, the qth power of the basis α _{i has} the relationship shown in the equation (14), and therefore the matrix (c _ij ) is given by the equation (15).

That, m-number of _{x i} ∈GF input (q), the calculation of ^{x q} simply outputs rearranged the order of (0 ≦ i <m) is completed. completed only in the same rearrangement is also the case of the operation of x ^w. The calculation cost of this rearrangement can be ignored with respect to the calculation cost of multiplication or square on GF (q ^m ).

In the case of a method based on a polynomial basis, the operation of x ^w is generally equal to the operation cost of multiplication on GF (q ^m ), but the operation cost can be reduced by selecting a special element on GF (q ^m ) as γ. May be reduced. For example, when γ has a relationship of γ ^m −ω = 0 with respect to ω∈GF (q), the base α _{i to} the q ⁿ power has a relationship shown in the equation (16). However, the symbol [iq ⁿ / m] represents a maximum integer equal to or less than iq ⁿ / m.

That is, ω ^[T] [where T = iq ⁿ / m, for each of the input m x _i εGF (q), (0 ≦ i <m). ] The over operation of only in the x ^w and outputs the rearranged the order is completed. This calculation cost is also negligible for the calculation cost of multiplication or square on GF (q ^m ).

<Addition chain>
Next, an example of a method for efficiently calculating y represented by Expression (5) will be described.
y can be transformed into equation (17).

Here, the symbol u is defined by equation (18).

At this time, Expression (17) is rewritten to Expression (19), and x ^u can be calculated as Expression (20).

When performing an operation such as equation (20), the q ⁱ power operation can be performed at a higher speed than the multiplication on GF (q ^m ) as described above. Times [corresponds to the number of crosses on the right side of equation (20). ] Multiplication on GF (q ^m ) to be performed.

By the way, for example, if m-1 = ²ⁿ , u can be expressed by being decomposed as shown in Expression (21).

In this case, as a method for calculating x ^u , for example, when an arithmetic method such as Expression (22) is used, x ^u is calculated by multiplying GF (q ^m ) n times, that is, log ₂ (m−1) times. it can.

Such a calculation method can be generally configured even if n is not a power of 2, and can be configured as follows as an example.
Integers (1 =) n ₀ ,..., n _r (= m−1) are given by equation (23) where i, j, and k are integers. This integer sequence n ₀ ,..., N _r is called an (optimal) addition chain of m−1.

An (optimal) addition chain containing q times can be constructed using an (optimal) addition chain of m-1. The (optimal) addition chain including this q 冪 multiple is given by equation (24). At this time, Expression (25) is established. Incidentally, a power number _{n k} of q in equation (24) corresponds to _{n k} of the formula (23).

Using this (optimal) addition chain including q times, the calculation of x ^u can be performed as follows. First, an (optimal) addition chain n ₀ ,..., N _r of m−1 is given. According to the correspondence of i, j, k in this (optimum) addition chain n _j = n _j + n _k (j, k <i), A = 0 is obtained by the operation of Expression (26) for i = 0,. ₀ ,..., _An are obtained. At this time, Expression (27) is established.

Here, since Expression (28) is satisfied, A _r is x ^u to be obtained.

The length L (m−1) of the shortest addition chain of m−1 can be suppressed to L (m−1) ≦ 2 log ₂ (m−1) at worst. That, _{A r} can also be determined by the worst 2log ₂ (m-1) times of about GF ^{(q m)} on the multiplication. In general, if it is desired to obtain ^xu efficiently, an efficient m-1 addition chain may be provided. Reference Document 1 below shows a tree diagram of the optimum addition chain regarding the number of additions of integers of 1 to 100. By using such an addition chain, the calculation of x ^u can be optimized.
(Reference 1) Knuth, "The Art of Computer Programming", VOLUME 2 Seminumerical Algorithms Third Edition, p.465, Addison Wesley, ISBN: O-201-89684-2

Here, as one of the methods for efficiently performing the pseudo inverse element calculation, for example, a method using the qn- ^th power mapping is shown, but there is a method using the Euclidean mutual division method in addition to this method.
As being induction from the above description, the complement pseudo inverse z subfield is the elements of the finite field GF (q ^m) is different from the finite GF (q ^m) computational cost of multiplication and the square of the It can be said that calculation is possible with a sufficiently small calculation cost. Further, it can be said that the pseudo inverse element y can be calculated at an efficient calculation cost that is smaller than the calculation cost of the inverse element on the finite field GF (q ^m ).

Furthermore, the former is a complement pseudo inverse subfields of finite GF (q ^m) and dividing the number lambda _d, from associating the divisor lambda _d expansion coordinates, the enlarged coordinate portion of the finite field GF (q ^m) The calculation cost of the calculation using the enlarged coordinates can be reduced.
If this is explained by an example of elliptic addition in the Jacobian coordinate system, the third coordinate of the Jacobian coordinate system can be given by the element z of the subfield GF (ξ) of the finite field GF (q ^m ). . For example, the operation Z ₃ ← Λ _d Z ′ ₃ in the conventional method is changed to z ₃ ← λ _d z ′ ₃ . In this case, the calculation cost of multiplication on the finite field GF (q ^m ) in the case of the conventional method is changed to the calculation cost of multiplication on the partial field GF (ξ) of the finite field GF (q ^m ). Calculating the cost of the subfield GF (xi]) on the multiplication of the finite field GF ^{(q m)} is sufficiently small compared to the computational cost of the finite field GF ^{(q m)} on the multiplication. Therefore, the calculation cost can be reduced as compared with the conventional method. Further, for example, the calculation of X " ₁ <-X ' ₁ Λ _d ² in the conventional method is changed to X" ₁ <-X' ₁ λ _d ² . In this case, the calculation cost of one multiplication and one square on the finite field GF (q ^m ) in the case of the conventional method is that of the subfield GF (ξ) of the finite field GF (q ^m ). since the change back and finite GF (q ^m) based on the multiplication and once subfield GF (xi]) square one operation cost on the finite field GF (q ^m) of, being able to reduce the computational cost become.
As described above, since the enlarged coordinates can be given under the subfield of the finite field GF (q ^m ), the calculation cost of the calculation using the enlarged coordinates can be reduced.

<Specific example>
Next, as a specific example, FIG. 5 shows an example of an algorithm (calculation procedure) of ellipse addition in the Jacobian coordinate system using the pseudo inverse element calculation and its calculation cost. However, input: (X ₁ , Y ₁ , z ₁ ) εGF (q ^m ) ² × GF (ξ), (X ₂ , Y ₂ , z ₂ ) εGF (q ^m ) ² × GF (ξ), Output: (X ₃ , Y ₃ , z ₃ ) εGF (q ^m ) ² × GF (ξ). In addition to the above-described calculation cost symbol, V is the calculation cost of the pseudo inverse element v (x). Note that the computation cost of the complementary pseudo inverse element N (x), the computation cost of GF (q ^m ) × GF (ξ) multiplication, the computation cost of multiplication on GF (ξ), the computation cost of square on GF (ξ), GF Note that the calculation cost of (ξ) upper addition is not shown in the figure because it is sufficiently smaller than GF (q ^m ) upper multiplication cost M and can be ignored.

Similarly, FIG. 6 shows an example of an algorithm (calculation procedure) of the elliptic doubling formula in the Jacobian coordinate system using the pseudo inverse element calculation and its calculation cost. However, input: (X ₁ , Y ₁ , z ₁ ) ∈GF (q ^m ) ² × GF (ξ), output: (X ₃ , Y ₃ , z ₃ ) ∈GF (q ^m ) ² × GF (ξ ). The calculation cost symbols are as described above.

For example, when the order m of the finite field GF (q ^m ) is m = 5, the pseudo inverse element v (x) is supplemented as shown in Equation (29) by using the above (optimal) addition chain method. since it is possible to obtain the pseudo-inverse element v (x) and the auxiliary pseudo-inverse n (x), it can be performed by ^{q n-th} power mapping 3 times and GF ^{(q m)} on the multiplication twice.

As mentioned previously, for example in the case of using the norm as complement pseudo inverse is the computational cost of q ^n-th power mapping in that you appropriately selecting the base in q ^n-th power mapping GF (q ^m) of the above multiplication Since the calculation cost can be made sufficiently small, when m = 5, the calculation cost V may be approximately equivalent to the calculation cost 2M.

From the calculation costs shown in FIG. 5 and FIG. 6, in order to execute the elliptic addition in the Jacobian coordinate system using the pseudo inverse element calculation once, the pseudo inverse element on GF (q ^m ) once, the multiplication twice, the square 1 Operations are required, and in order to execute the elliptic doubling in the Jacobian coordinate system using the pseudo-inverse operation once, the pseudo-inverse on GF (q ^m ) once, the multiplication twice, and the square twice Is necessary.

In the case of the order m = 5, considering that one pseudo inverse element is equivalent to approximately two multiplications, it is approximately GF (q to execute the elliptic addition in the Jacobian coordinate system using the pseudo inverse element calculation once. ^m ) 4 multiplications and 1 square are required, and approximately 4 multiplications on GF (q ^m ) to execute the elliptic doubling in the Jacobian coordinate system using the pseudo-inverse operation once, Two squares are required.
Compared to the computation cost in the conventional Jacobian coordinate system, this saves 8 multiplications and 3 squares on GF (q ^m ) for elliptic addition, and 4 squares on GF (q ^m ) for elliptic doubling. Means saving.

In the above, the case of the Jacobian coordinate system using the pseudo-inverse operation has been described as a specific example. However, as another specific example, the algorithm of the ellipse addition and the elliptic doubling in the Projective coordinate system and the Chudnovsky coordinate system (calculation) An example of the procedure) and its calculation cost are shown.
FIG. 7 shows an example of an algorithm (calculation procedure) for ellipse addition in the Projective coordinate system and its calculation cost, and FIG. 8 shows an example of an algorithm (calculation procedure) for ellipse addition in the Projective coordinate system using a pseudo inverse element calculation and its calculation cost. FIG. 9 shows an example of an algorithm (calculation procedure) for elliptic doubling in the Projective coordinate system and its operation cost, and FIG. 10 shows an algorithm (calculation procedure) for ellipse doubling in the Projective coordinate system using a pseudo-inverse operation. An example and its calculation cost are shown.
FIG. 11 shows an example of an algorithm (calculation procedure) for elliptic addition in the Chudnovsky coordinate system and its operation cost, and FIG. 12 shows an example of an algorithm (calculation procedure) for ellipse addition in the Chudnovsky coordinate system using a pseudo-inverse operation. FIG. 13 shows an example of an algorithm for doubling an ellipse in the Chudnovsky coordinate system (calculation procedure) and its operation cost. FIG. 14 shows an algorithm for doubling an ellipse in the Chudnovsky coordinate system using a pseudo inverse element operation (calculation procedure). ) And its calculation cost.
In each figure, the underlined portion represents a value that does not need to be calculated again because the calculation result appears once before that. For example, in the calculation procedure (a) Y ← X ² X, (b) Z ← X ² , X ² is calculated when Y is obtained. should you use the value that had been stored without re-calculate the X ^2.
In any case, as is apparent when the order m = 5, for example, it can be seen that the calculation costs of multiplication and square are reduced when the pseudo inverse element calculation is used as compared with the conventional method.

<Embodiment>
Subsequently, specific embodiments of the present invention will be described, but the following points should be noted. That is, as is clear from the above examples of each coordinate system, the specific embodiment can vary depending on the coordinate system. Further, as is apparent from the examples of ellipse addition and elliptic doubling, the specific embodiment may vary depending on the type of group operation. Of course, the specific embodiment may vary depending on the type of algebraic curve. Furthermore, since the group operation algorithm can be changed as appropriate, the specific embodiment can be changed accordingly. Furthermore, when the present invention is implemented by a computer, the arithmetic processing is usually performed by a CPU, so that it depends on an instruction set (for example, presence / absence of SIMD [Single Instruction / Multiple Data] type instruction) implemented in the CPU. However, specific embodiments may vary.

Therefore, from the viewpoint of specifically showing an example of a group operation using a pseudo inverse element operation, a specific embodiment will be described with the following conditions set.
(conditions)
1. An algebraic curve defined on a finite field is defined as a finite field GF (q ^m ) [q is a prime number or a power of a prime number, and m is an integer of m> 1. ] The elliptic curve defined above is used.
2. The finite commutative group is a set of rational points E (GF (q ^m )) of the elliptic curve.
3. The group operation is elliptical doubling.
4). The elliptic doubling formula is the one in the Weierstrass format of the Affine coordinate system when the characteristics q ≠ 2, q ≠ 3, and 4a ³ + 27b ² ≠ 0, that is, P = Q in equation (2). Shall be the case.
5. The projective coordinate system is the Jacobian coordinate system.
In short, the embodiment executes the algorithm shown in FIG.

In the details of the finite commutative group computing device described in the embodiment, numerical calculation processing in number theory may be required, but numerical calculation processing in number theory itself is achieved in the same manner as in the known art. Detailed description of the arithmetic processing method and the like will be omitted (software that can perform numerical calculation processing in number theory indicating the technical level of this point includes, for example, PARI / GP, KANT / KASH, etc. PARI / GP. For example, refer to the Internet <URL: http://pari.math.u-bordeaux.fr/> [searched on April 12, 2006.] For KANT / KASH, for example, the Internet <URL: http (See http://www.math.tu-berlin.de/algebra/> [Search April 12, 2006]).
Reference literature 2 can be cited as a literature relating to this point.
(Reference 2) H. Cohen, "A Course in Computational Algebraic Number Theory", GTM 138, Springer-Verlag, 1993.

Embodiments will be described with reference to the drawings.
<Fine commutative group computing device>
As illustrated in FIG. 15, the finite commutative group computing device (1) includes an input unit (11) to which a keyboard or the like can be connected, an output unit (12) to which a liquid crystal display or the like can be connected, a CPU (Central Processing Unit; 14) [A cache memory or a register (19) may be provided. RAM (Random Access Memory) (15), ROM (Read Only Memory) (16) and external storage device (17) which is a hard disk, and these input unit (11), output unit (12), A CPU (14), a RAM (15), a ROM (16), a bus (18) connected so as to exchange data between the external storage devices (17), and the like are provided. If necessary, the finite commutative group computing device (1) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device (17) of the finite commutative group computing device (1) stores and stores a program for the finite commutative group computing and data necessary for processing of this program. Further, data obtained by the processing of these programs is appropriately stored and stored in the RAM (15), the register (19) or the like. Hereinafter, devices such as the RAM (15) and the register (19) for storing the calculation result and the address of the storage area will be simply referred to as “storage unit”.

The external storage device (17) includes a program for calculating a pseudo-inverse element, a program for calculating a complementary pseudo-inverse element, a program for calculating an operation result of multiplication on a finite field, and an operation of square on a finite field. A program for calculating a result and a program for calculating a calculation result of addition, subtraction or ½ multiplication on a finite field are stored and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate. Further, it is assumed that the external storage device (17) stores and stores the coordinate values (X ₁ , Y ₁ , z ₁ ) of the element P of the finite commutative group and the coefficient a of the elliptic curve.

  In the finite commutative group computing device (1), each program stored in the external storage device (17) and data necessary for processing of each program are read into the storage unit (20) as necessary, and the CPU ( 14) Interpretation is executed and processed. As a result, the CPU (14) is finite by realizing predetermined functions (pseudo inverse element calculation unit, complementary pseudo inverse element calculation unit, multiplication calculation unit, square calculation unit, addition / subtraction half multiplication calculation unit, control unit). A commutative group operation is realized.

<Fine Commutative Group Arithmetic Processing of Embodiment>
Next, the flow of the finite commutative group computation process in the finite commutative group computation device (1) will be described descriptively with reference to FIGS. The coordinate values (X ₁ , Y ₁ , z ₁ ) and coefficient a of the element P of the finite commutative group stored in the external storage device (17) are stored in advance in the storage unit (190) under the control of the control unit (190). 20) is read and saved. Hereinafter, when it is described that “reads XX from the storage unit”, it means “read XX from a predetermined storage area in which XX is stored in the storage unit”.
A control part (190) performs control which performs the process of the following algorithm.

[First calculation step in FIG. 6]
Λ _n ← v (2Y ₁ ) · (3X ₁ ² + az ₁ ⁴ ) is calculated. This operation is the same as the operation of Λ _n ← v (Y ₁ + Y ₁ ) · {(X ₁ ² + X ₁ ² + X ₁ ² ) + a · (z ₁ ² · z ₁ ² )}. Represents multiplication. The same applies below. ]. Here, 2Y ₁ is not obtained by multiplication of 2 · Y ₁ but instead of addition of Y ₁ + Y ₁ , and 3X ₁ ² is not obtained by multiplication of 3 · X ₁ ² but X ₁ ² + X ₁ ² + X ₁ ^{2 is} calculated by adding ² and z ₁ ⁴ is not calculated by multiplication of z ₁ · z ₁ · z ₁ · z ₁ , but by calculation of z ₁ ² · z ₁ ² or (z ₁ ² ) ^2. It should be noted that a device for reducing the above is performed [the same applies to the second and subsequent calculation steps in FIG. 6. ].

First, square operation unit (141) reads the _{X 1} from the storage unit (20) _X 1 · _{X 1} becomes performs computation [calculation cost 1S], the storage unit the result of the calculation _X ^{1 2} (20) Store in a predetermined area (step S1). Note that the values stored in the storage unit (20) at the stage of each step are shown on the right side of FIG. However, this does not mean that the value obtained in each step must be stored at all times, and a value that does not need to be used in the subsequent calculation can be released from the storage area of the storage unit (20) at an appropriate stage.

Further, the square calculation unit (141) reads z ₁ from the storage unit (20) and performs the calculation z ₁ · z ₁ [calculation cost of square on partial body], and stores the calculation result z ₁ ² in the storage unit ( 20) in the predetermined area (step S2).

Then, the addition subtraction semi doubling calculation unit (142) reads the _{Y 1} from the storage unit (20) _Y 1 + _{Y 1} becomes performs computation [calculation cost of the addition], the storage unit the result of the calculation 2Y ₁ ( 20) (step S3).

The addition subtraction semi doubling calculation unit (142) reads the _X ^{1 2} from the storage unit ^{_{(20) X 1 2 + X}} 1 2 becomes performs computation [calculation cost of the addition], the result of the calculation _2X ^{1 2} It stores in a predetermined area of the storage unit (20) (step S4).

Furthermore, the addition subtraction semi doubling calculation unit (142), _2X ^{1 2} _{+ X} ¹ 2 becomes performs computation storage unit from (20) reads _2X ^{1 2} [computational cost of addition], the result of the calculation _3X ^{1 2} Store in a predetermined area of the storage unit (20) (step S5).

Next, the square calculation unit (141) reads z ₁ ² from the storage unit (20) and performs calculation of z ₁ ² · z ₁ ² [calculation cost of square on partial body], and the calculation result z ₁ ⁴ is obtained. The data is stored in a predetermined area of the storage unit (20) (step S6).

Further, the square calculation unit (141) reads the coefficients a and z ₁ ⁴ from the storage unit (20) and performs the calculation of a · z ₁ ⁴ [the calculation cost of multiplication on a partial field], and the calculation result az ₁ ⁴ Is stored in a predetermined area of the storage unit (20) (step S7).

Subsequently, the addition subtraction semi doubling calculation unit (142), _3X ¹ 2 + _az ^{1 4} consisting performs computation storage unit from (20) reads _3X ^{1 2} and _az ^{1 4} [computational cost of the addition], this operation The result 3X ₁ ² + az ₁ ⁴ is stored in a predetermined area of the storage unit (20) (step S8).

Next, the pseudo inverse element calculation unit (143) reads 2Y ₁ from the storage unit (20), calculates the pseudo inverse element v (2Y ₁ ) [calculation cost of 1V], and obtains the result v (2Y ₁ ). The data is stored in a predetermined area of the storage unit (20) (step S9). The calculation of the pseudo inverse element v (2Y ₁ ) is as described above. For example, in the case of degree m = 5 of the extension field can be calculated by the algorithm shown in equation (29) was prepared in which to understand by replacing the x in the formula (29) to 2Y _1. ].

Subsequently, the multiplication operation unit (144) reads v (2Y ₁ ) and 3X ₁ ² + az ₁ ⁴ from the storage unit (20) and performs an operation of v (2Y ₁ ) · (3X ₁ ² + az ₁ ⁴ ). [1M calculation cost], and this calculation result v (2Y ₁ ) · (3X ₁ ² + az ₁ ⁴ ) is stored in a predetermined area of the storage unit (20) (step S10). The calculation result v (2Y ₁ ) · (3X ₁ ² + az ₁ ⁴ ) obtained here corresponds to Λ _n .

[Second calculation step in FIG. 6]
Calculation of λ _d ← N (2Y ₁ ) is performed. This calculation is the same as the calculation of λ _d ← N (Y ₁ + Y ₁ ). It should be noted here that the operation Y ₁ + Y ₁ does not have to be performed. Is because to obtain the operation result 2Y ₁ in step S3. Therefore, in the second calculation step of FIG. 6, the following calculation is performed.

That is, the complementary pseudo-inverse operation unit (145) reads 2Y ₁ from the storage unit (20), calculates the complementary pseudo-inverse element N (2Y ₁ ) [complementary pseudo-inverse operation cost], and the result N ( 2Y ₁ ) is stored in a predetermined area of the storage unit (20) (step S11). The calculation of the complementary pseudo inverse element N (2Y ₁ ) is as described above. For example, in the case of degree m = 5 of the extension field can be calculated by the algorithm shown in equation (29) was prepared in which to understand by replacing the x in the formula (29) to 2Y _1. ]. The calculation result N (2Y ₁ ) obtained here corresponds to λ _d .

[The third and subsequent calculation steps in FIG. 6]
The third and subsequent calculation steps in FIG. 6 may be the same as the calculation process described above. That is, in the third calculation step, the calculation z ₃ ← λ _d · z ₁ is performed. In the fourth calculation step, X " ₁ ← X ₁ · λ _d ² and Y" ₁ ← Y ₁ · λ _d ³ = Y ₁ · λ _d ² · λ _d are calculated (λ _d ² is recalculated) No need.) In the fifth operation step, an operation of X ₃ ← Λ _n ² − (X ″ ₁ + X ″ ₁ ) is performed. In the sixth operation step, an operation of Y ₃ ← Λ _n · (X ″ ₁ −X ₃ ) −Y ″ ₁ is performed. All of these operations are realized by a square operation unit (141), an addition / subtraction half-multiplication operation unit (142), and a multiplication operation unit (144). The processing of each calculation unit is the same as that described in the first and second calculation steps in FIG. 6 (step S11 and subsequent steps in FIG. 17 are omitted).

Next, among the above (conditions), condition 3. The finite commutative group calculation process when “group operation is ellipse addition” will be described. That is, the embodiment executes the algorithm shown in FIG.
Each calculation step in FIG. 5 may be the same as the calculation process described in the above embodiment.
In the first calculation step, the calculation z ′ ₃ ← z ₁ · z ₂ is performed.
In the second operation _{step, X '1 ← X 1 ·} z 2 2 and ^{_{Y' 1 ← Y 1 · z}} 2 3 = Y 1 · z 2 2 · z 2 comprising performing a calculation _(z ^{2 2} recalculates No need.)
In the third calculation step, X ′ ₂ ← X ₂ · z ₁ ² and Y ′ ₂ ← Y ₂ · z ₁ ³ = Y ₂ · z ₁ ² · z ₁ are calculated (z ₁ ² is recalculated. No need.)
In the fourth operation step, an operation of Λ _n ← v (X ′ ₂ −X ′ ₁ ) · (Y ′ ₂ −Y ′ ₁ ) is performed. In this operation, v (X ′ ₂ −X ′ ₁ ) and Y ′ ₂ −Y ′ ₁ are respectively obtained and multiplied.
In the fifth calculation step, a calculation of λ _d ← N (X ′ ₂ −X ′ ₁ ) is performed.
In the sixth operation step, an operation of z ₃ ← λ _d · z ′ ₃ is performed.
In the seventh calculation step, X " ₁ ← X ' ₁ · λ _d ² and Y" ₁ ← Y' ₁ · λ _d ³ = Y ' ₁ · λ _d ² · λ _{d are} calculated (λ _d ² is There is no need to recalculate.)
In the eighth calculation step, the calculation X ″ ₂ ← X ′ ₂ · λ _d ² is performed (λ _d ² does not need to be recalculated).
In the ninth operation step, an operation of X ₃ ← Λ _n ² − (X ″ ₁ + X ″ ₁ ) is performed.
In the tenth calculation step, the calculation Y ₃ ← Λ _n · (X ″ ₁ −X ₃ ) −Y ″ is performed.

In any of these operations, as described in the embodiment taking elliptic doubling as an example, the square operation unit (141), the addition / subtraction half multiplication operation unit (142), and the pseudo inverse element operation unit (143 ), A multiplication operation unit (144), and a complementary pseudo-inverse operation unit (145). In addition, the processing of each calculation unit in this embodiment taking ellipse addition as an example is the same as that described in the embodiment taking ellipse doubling as an example.
FIG. 19 shows a processing flow (overall) of the elliptic addition finite commutative group calculation process in the Jacobian coordinate system using the pseudo inverse element calculation.

  In addition to the above embodiments, the finite commutative group computing device / method according to the present invention is not limited to the above-described embodiments, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above finite commutative group computing device / method is not only executed in time series according to the order of description, but also in parallel or individually according to the processing capacity of the device that executes the processing or as necessary. It may be executed.

  When the processing functions in the finite commutative group computing device are realized by a computer, the processing contents of the functions that the finite commutative group computing device should have are described by a program. And the processing function in the said finite commutative group arithmetic unit is implement | achieved on a computer by running this program with a computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the finite commutative group computing device is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware. Good.

  The present invention is useful for operations such as algebraic curve cryptography defined on a finite field.

The figure which showed an example of the algorithm of the ellipse addition in Affine coordinate, and calculation cost. The figure which showed an example of the algorithm of the ellipse doubling in Affine coordinate, and calculation cost. The figure which showed an example of the algorithm of the ellipse addition in Jacobian coordinates, and operation cost. The figure which showed an example of the algorithm of the ellipse doubling in Jacobian coordinates, and calculation cost. The figure which showed an example of the algorithm of the ellipse addition in Jacobian coordinates using pseudo-inverse operation, and the operation cost. The figure which showed an example of the algorithm of the ellipse doubling in Jacobian coordinates using pseudo-inverse operation, and the operation cost. The figure which showed an example of the algorithm of the ellipse addition in Projective coordinates, and calculation cost. The figure which showed an example of the algorithm of the ellipse addition in the Projective coordinate using pseudo-inverse calculation, and calculation cost. The figure which showed an example of the algorithm of the ellipse doubling in Projective coordinates, and calculation cost. The figure which showed an example of the algorithm of the ellipse doubling in Projective coordinates using pseudo-inverse calculation, and calculation cost. The figure which showed an example of the algorithm of the ellipse addition in Chudnovsky coordinate, and operation cost. The figure which showed an example of the algorithm of the ellipse addition in Chudnovsky coordinate using a pseudo-inverse operation, and calculation cost. The figure which showed an example of the algorithm of the ellipse doubling in Chudnovsky coordinate, and operation cost. The figure which showed an example of the algorithm of the ellipse doubling in the Chudnovsky coordinate using a pseudo-inverse operation, and calculation cost. The figure which shows the hardware structural example of a finite commutative group arithmetic unit. The figure which shows the function structural example of a finite commutative group calculating apparatus. The figure which shows the processing flow (part) of the finite commutative group arithmetic processing (example of the elliptic doubling in the Jacobian coordinate system using the pseudo-inverse arithmetic) and the operation result stored and stored. The figure which shows the processing flow (the whole) of finite commutative group arithmetic processing (example of the elliptic doubling in the Jacobian coordinate system using pseudo-inverse arithmetic). The figure which shows the processing flow (the whole) of finite commutative group operation processing (example of the ellipse addition in the Jacobian coordinate system using pseudo-inverse operation).

Explanation of symbols

1 finite commutative group computing device 141 square computing unit 142 addition subtraction half multiplication computing unit 143 pseudo inverse element computing unit 144 multiplication computing unit 145 complementary pseudo inverse element computing unit 190 control unit

Claims (9)

Finite field GF (q ^m ) [q is a prime number or power of prime number, and m is an integer of m> 1. ] Algebraic curve defined above [suppose that it is expressed in a projective coordinate system. ] The original group operation of the finite commutative group formed by the above points is calculated by dividing the divisor and the dividend appearing in the division on the finite field GF (q ^m ) independently, and the divisor is expanded coordinates [coordinates of the above projective coordinate system] Is a finite commutative group operation method that avoids the inverse operation of the divisor in the above group operation by associating it with the coordinates excluding the coordinates of the Affine coordinate system],
Pseudo inverse operation means, the original p of a finite field ^{GF (q m), N (} p) = v (p) × p [where, N (p) is part of the finite field GF ^{(q m)} And v (p) is an element of a finite field GF (q ^m ). A pseudo inverse element calculation step for calculating a pseudo inverse element v (p) satisfying
A complementary pseudo-inverse operation means for calculating the complementary pseudo-inverse element N (p),
A finite commutative group calculation method in which the pseudo inverse element is included in the dividend and the complementary pseudo inverse element is the divisor. The finite commutative group calculation method according to claim 1, wherein the enlarged coordinates of a point on the algebraic curve expressed in a projective coordinate system are given under a subfield of a finite field GF (q ^m ). The finite commutative group operation method according to claim 1, wherein the complementary pseudo-inverse element N (p) is a norm of an element p on a finite field GF (p ^m ). The complementary pseudo-inverse element N (p) is expressed by the equation (c1),

The pseudo inverse element v (p) is expressed by the equation (c2).

The finite commutative group calculation method according to claim 3. The complementary pseudo-inverse element calculating means sets each term p ^θ [where θ = q ^i] of the pseudo-inverse element v (p) represented by Expression (c2). ] Is calculated by Frobenius map, The finite commutative group calculation method of Claim 4. The pseudo inverse element v (p) represented by the expression (c2) is expressed as an expression (c3),

Complement pseudo inverse operation means, finite-friendly換群calculation method according to claim 5 obtained by adding a chain of p ^u appearing in equation (c3). 7. The finite commutative group operation method according to claim 1, wherein the group operation is an addition operation and / or a double operation. Finite field GF (q ^m ) [q is a prime number or power of prime number, and m is an integer of m> 1. ] Algebraic curve defined above [suppose that it is expressed in a projective coordinate system. ] The original group operation of the finite commutative group formed by the above points is calculated by dividing the divisor and the dividend appearing in the division on the finite field GF (q ^m ) independently, and the divisor is expanded coordinates [coordinates of the above projective coordinate system] Is a finite commutative group operation device that avoids the inverse operation of the divisor in the group operation by associating it with the coordinates excluding the coordinates of the Affine coordinate system],
For an element p of a finite field GF (q ^m ), N (p) = v (p) × p [where N (p) is an element of a subfield of the finite field GF (q ^m ) and v (p ) Is an element of a finite field GF (q ^m ). Pseudo inverse element calculation means for calculating a pseudo inverse element v (p) satisfying
Pseudo inverse element calculation means for calculating the complementary pseudo inverse element N (p),
A finite commutative group computing device including the pseudo inverse element in the dividend and the complementary pseudo inverse element as the divisor.       A program for causing a computer to execute the finite commutative group calculation method according to any one of claims 1 to 7.

Images