JP2010210844A - Method, device, and program for efficiently generating point on elliptic curve - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve generation of points on an elliptic curve which can be applied to general elliptic curves without causing great variations in processing performance according to the input. <P>SOLUTION: A method for generating points on an elliptic curve is provided wherein a GF(q) rational point of a quadratic curve C defined on a predetermined finite field GF(q) (q: power of an odd prime number p) is generated from the elements of a finite set, a GF(q<SP>2</SP>) rational point of the elliptic curve E is generated from the generated GF(q) rational point of the quadratic curve C, and a GF(q) rational point of the elliptic curve E is generated from the GF(q<SP>2</SP>) rational point of the elliptic curve E and a part of the elements of the finite set. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a security technique, and more particularly to a processing technique for generating points on an elliptic curve.

  A digital signature (hereinafter referred to as a signature) serves as a seal for electronic data. For the electronic data to be signed, the signer generates signature data using a secret signature key, and transmits it to the verifier together with the original electronic data. The verifier uses the electronic data and the public verification key to verify whether the signature data is generated by the signer. Therefore, the signature data can be generated only by the person who holds the signature key, and the signature data that is generated effectively is accepted as “valid” at the time of signature verification, and the others are rejected as “invalid”. It must be.

  The above-mentioned signature method was developed in 1978 by R.C. Rivest, A.M. Shamir, L .; Implemented by Adleman using public key cryptography. After that, not only the construction and maintenance of security proof theory that cryptographically proves the security of signatures, but also techniques for improving efficiency, as well as signatures with special functions such as group signatures that take privacy problems into account. It has been studied.

  In general, a signature is composed of a combination of a hash function for compressing arbitrary length data into fixed length data and a public key cryptographic primitive using a mathematical function. Among these public key cryptographic primitives, those based on elliptic curves defined on a finite field have a shorter key length and the same level of security than those based on the difficulty of the prime factorization problem (RSA, Rabin, etc.) In particular, it is attracting attention because it can achieve high speed and thus high speed processing is possible.

Ciphers and signatures using elliptic curves are Koblitz, V.M. S. Proposed by Miller. In general, among elliptic curves defined on a finite field GF (q), a so-called Weierstrass type is y ² = F (x) = x ³ + ax + b (both a and b are elements of a finite field GF (q)) ( Formula 1)
It is given by a definition formula of the form For the elliptic curve defined above, the original set (x, y) of GF (q) that satisfies (Expression 1) is called a GF (q) rational point.

  In recent years, signatures using elliptic curves have been proposed which have a high security reduction that has been unsolved for a long time (see, for example, Non-Patent Document 1). Here, the right security reduction is the difficulty of forging a signature, and the number theory problem (for example, prime factorization problem, multiplicative group of finite fields) based on the security of the public key cryptographic primitive that is a component of the signature. / It means that the difficulty for solving the elliptic curve discrete logarithm problem defined on a finite field is the same (equivalent).

  For signatures described in Non-Patent Document 1 and Non-Patent Document 2 described above, a hash function having a value on an elliptic curve is used. A hash function having a value on a general elliptic curve is described in Non-Patent Document 3, and a hash function having a value on a special elliptic curve is described in Non-Patent Documents 3 and 4, respectively.

B. Chevallier-Mames, “An Efficient CDH-based Signature Scheme With a Tight Security Reduction”, Advances in Cryptology-CRYPTO 2005, LNCS 3621, Springer-Verlag, pp.511-526, 2005. E. J. Goh, S. Jarecki, “A signature Scheme as secure as the Diffie-Hellman Problem”, Advances in Cryptology-EUROCRYPT 2003, LNCS 2656, Springer-Verlag, pp.401-415, 2003. D. Boneh, H. Shacham, and B. Lynn, “Short Signatures from the Weil Pairing”, Advances in Cryptology-ASIACRYPT 2001, LNCS 2248, Springer-Verlag, pp.514-532, 2001. P. S. L. M. Barreto and H. Y. Kim, “Fast Hashing onto Elliptic Curves over Fields of Characteristic 3”, Cryptology ePrint Archive, Report 2001/098, 2001. available from: http://eprint.iacr.org/2001/098

    With the advancement of the information society, signatures for electronic information and technologies for authenticating communication partners and devices have become indispensable. As described above, requirements imposed on cryptographic techniques include security and efficiency.

  A hash function having a value in a general elliptic curve described in Non-Patent Document 3 generates a candidate for the x coordinate of (Formula 1) from a predetermined set element r, and the corresponding y coordinate is a defining body. If it is not included, x is replaced by a certain method and repeated until the y coordinate is included (hereinafter referred to as trial and error method). In the case of trial and error method, it is known from Hase's theorem that the average number of iterations is about 1.5. It often happens. A certain amount of processing is required to determine whether or not the y coordinate is included in the definition body. Even if the number of times is acceptable if it is about two or three times, it becomes a bottleneck in the whole processing if it is exceeded.

  On the other hand, the hash function having a value in the special elliptic curve described in Non-Patent Documents 3 and 4 generates a candidate for the x coordinate of (Expression 1) from the element r of a predetermined set, and the corresponding y This is a method of determining coordinates using the properties of the above-mentioned special elliptic curve definition equation (hereinafter referred to as the special curve method), and iteratively performing a hash function having a value in the above-mentioned general elliptic curve Is a method proposed to improve efficiency.

  In general, hash functions often require high efficiency and input-independent processing time, such as when used for signatures, and processing performance varies greatly depending on the input as in the trial and error method described above (repetition) This is not desirable because the number of times changes. The above-mentioned special curve method can be applied only to a special elliptic curve, and the same method cannot be used for a general elliptic curve.

  The present invention has been made in view of the above problems, and can be applied to a general elliptic curve. On the elliptic curve that realizes generation of points on an elliptic curve that does not vary greatly in processing performance according to input. A point generation method and a point generation apparatus are provided.

  In order to solve the above problems, the present invention uses a rational point in an extension field of an elliptic curve.

For example, the present invention generates a GF (q) rational point of a quadratic curve C defined on a predetermined finite field GF (q) (q: power of odd prime number p) from elements of a finite set. When,
Generating a GF (q ² ) rational point of the elliptic curve from a GF (q) rational point of the generated quadratic curve C;
Generating a GF (q ² ) rational point of the elliptic curve E from a GF (q ² ) rational point of the elliptic curve E and a part of an element of the finite set;
It is characterized by providing.

A more specific aspect of the present invention is that on the finite field GF (q) from an element of a set S having (q + 1) / 2 (q should be a prime number of 5 or more) and an element of a set T having 2 elements. A point generation method for generating a GF (q) rational point of an elliptic curve E defined,
The point generation method on the elliptic curve is
Generating a GF (q) rational point of the quadratic curve C defined on the predetermined finite field GF (q) from an element of the set S;
A second step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q) rational point of the quadratic curve C generated in the first step;
A third step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q ² ) rational point of the elliptic curve E generated in the second step and the element of the set T;
It is characterized by providing.

In the above point generation method on an elliptic curve,
The set S is a set GF (q) ^* / {1, −1} ∪ {0}, and the set T is {1, −1},
In the first step, α (t) and β (t) are calculated for rational functions α and β on two predetermined GF (q) from the element t of the set S, and the two Generate a GF (q) rational point R = (α, β) of the quadratic curve C;
The second step includes a basis (ξ, 1) on the finite field GF (q) of the predetermined finite field GF (q ² ) and a GF (q) rational point of the quadratic curve C ( GF (q ² ) rational point P = (α + βξ, √ (F (α + βξ))) of the elliptic curve E from α, β) (F is a Weierstrass type definition equation of the elliptic curve E y ² = x ³ + ax + b = F (x) = x ³ + ax + b) is generated for F (x),
In the third step, the GF (q) rational point (P + σ (P) of the elliptic curve E is obtained using the Frobenius automorphism σ of the elliptic curve E from the GF (q ² ) rational point P of the elliptic curve E. )) May be generated.

Further, another specific aspect of the present invention provides a finite field from an element of a set S having the number of elements (q ² +1) / 2 (q should be a prime number of 5 or more) and an element of the set T having 2 elements. A point generation method for generating a GF (q) rational point of an elliptic curve E defined on GF (q),
The point generation method on the elliptic curve is
A fourth step of generating a GF (q ² ) rational point of a quadratic curve C defined on the predetermined finite field GF (q ² ) from the set S;
A fifth step of generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ² ) rational point of the quadratic curve C generated in the fourth step;
A sixth step of generating a GF (q ⁴ ) rational point of the elliptic curve E from a GF (q ⁴ ) rational point of the elliptic curve E generated in the fifth step and the element of the set T;
It is characterized by providing.

In the above point generation method on an elliptic curve,
The set S is a set GF (q ² ) ^* / {1, −1} ∪ {0}, and the set T is {1, −1},
The fourth step calculates α (t) and β (t) for the rational functions α and β on two predetermined GF (q ² ) from the element t of the set S, and Generate a GF (q ² ) rational point R = (α, β) of the quadratic curve C;
The fifth step includes a basis (ξ, 1) on the finite field GF (q ² ) of the predetermined finite field GF (q ⁴ ), and a GF (q ² ) rationality of the quadratic curve C. GF (q ² ) rational point P of the elliptic curve E with respect to the point (α, β) P = (α + βξ, √ (F (α + βξ))) (F is a Weierstrass-type definition equation y ^{2 of the} elliptic curve E) = X ³ + ax + b = F (x) polynomial)
In the sixth step, the GF (q) rational point P + σ (P) of the elliptic curve E is obtained from the GF (q ⁴ ) rational point P of the elliptic curve E using the Frobenius automorphism σ of the previous elliptic curve E. ) + Σ ² (P) + σ ³ (P) may be generated.

  According to the present invention, it is possible to generate a point on an elliptic curve that can be applied to a general elliptic curve and does not have a large variation in processing performance according to input. Thereby, it is possible to generate a hash value having a value in a general elliptic curve.

The figure which illustrates the outline of a function structure of the point generator which is 1st embodiment and 2nd embodiment. The schematic diagram of the hardware constitutions of a computer. The figure which illustrates the sequence which shows the point production | generation process on an elliptic curve in a point production | generation apparatus. The flowchart which illustrates the point production | generation process in the process part in 1st embodiment. The flowchart which illustrates the point production | generation process in the process part in 2nd embodiment.

  Embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a schematic diagram of a functional configuration of a point generation device 100 according to the first embodiment of the present invention.

  As illustrated, the point generation device 100 includes a storage unit 111, a processing unit 120, an input unit 131, an output unit 132, and a communication unit 133.

In the present embodiment, the point generator defines the above finite field GF (q) for the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. A point on the elliptic curve E (GF (q)) is generated. Here, q = ^{p r} should be of prime numbers p.

  The storage unit 111 includes a rational function storage area 112, a base storage area 113, and a parameter storage section 114.

The rational function storage area 112 stores information on two rational functions from the finite field GF (q) to the quadratic curve C defined on the finite field GF (q) and information associated with the two rational functions. Is done. Here, the two rational functions from the finite field GF (q) to the quadratic curve C defined on the finite field GF (q) are linear or quadratic having the finite field GF (q) as a coefficient. Are expressed as φ / ω and ψ / ω using the polynomials φ, ω, and ψ, and two functions from the finite field GF (q) to the quadratic curve C defined on the finite field GF (q) The information regarding the rational function is, for example, each coefficient of φ, ω, and ψ. Furthermore, the rational function phi / omega, the [psi / omega poles _{(i.e., ω (z 0) = 0} ) and becomes the original _{z 0,} and zeros of the polynomials [psi of the finite field GF (q) (i.e., [psi ( z ₁₎ = 0) and it becomes a former _{z 1} of the finite field GF (q). The reason why the zero points z ₀ and z ₁ that are the zeros of the polynomials ω and ψ are stored in the information associated with the two rational functions will be described later.

The base storage area 113 stores information related to the base of the secondary extension GF (q ² ) of the finite field GF (q). For example, in the present embodiment, an element ξ such that ξ∈GF (q ² ) −GF (q), c = ξ ² ∈GF (q) is a quadratic extension GF (q ² ) of the finite field GF (q). Information about the base of. The element cεGF (q) may also be stored as information related to the base. Here, GF (q ² ) −GF (q) represents a set obtained by removing the element of the finite field GF (q) from the secondary expansion GF (q ² ) of the finite field GF (q). The unit element 1 related to the multiplication of the ξ and the finite field GF (q) is a base on the finite field GF (q) of the secondary expansion GF (q ² ).

  The parameter storage unit stores information on the finite field GF (q) and the elliptic curve E (GF (q)) defined on the finite field GF (q). For example, in the present embodiment, the prime numbers q and the coefficients a and b of the defining equation (formula 1) of the elliptic curve E (GF (q)) are used.

  The processing unit 120 includes a rational function calculation unit 121 and a finite field calculation calculation unit 122.

For example, in the present embodiment, the processing unit 120 includes the elliptic curve E (GF) for the element t of the set GF (q) ^* / {1, −1} ∪ {0} and the element ι of the set {1, −1}. (Q)) Control the process of generating the upper point. Here, the set GF (q) ^* / {1, −1} ∪ {0} is g + h = 0 or g−h = with respect to the element g of the multiplicative group GF (p) ^* of the finite field. Represents a set obtained by dividing the multiplicative group GF (q) ^* of the finite field by an equivalence relation of 0. Specifically, when q = p, the set GF (p) ^* / {1, -1} = {1, 2,... (P-1) / 2}.
In the case of q = p ^r (r> = 2), the set GF (q) ^* / {1, −1} is, for example, an element u = a _r−1 γ of a multiplicative group GF (q) ^* of a finite field. ^r-1 + a _r-2 γ ^r-2 +. . . + A ₁ γ + a ₀ , where j is the maximum _i where a _i ≠ 0, j is a set of elements u satisfying 0 <= a _j ≦ (q−1) / 2.

The method of constructing the set GF (q) ^* / {± 1} is not particularly limited as long as it can be realized.
The number of elements of the set GF (q) ^* / {1, −1} ∪ {0} is (q−1) / 2 + 1 = (q + 1) / 2. When the bit length | q | = m of the prime power q, since q ≦ 2 ^m −1, the bit length of (q + 1) / 2 | (q + 1) / 2 | ≦ | {(2 ^m −1) +1} / 2 | = | 2 ^m / 2 | = 2 ^m−1 .

For example, in the present embodiment, the processing unit 120 performs the rational functions φ / ω, ψ / ω stored in the rational function storage area 112 and the basis for the element t and the element ι that are input data. The element ξ of GF (q ² ) −GF (q) stored in the storage area 113 is acquired and transmitted to the rational function calculation unit 121 together with t. The rational function calculation unit 121 performs calculation using a predetermined algorithm, and generates two elements α and β of the finite field GF (q). Then, the rational function calculation unit 121 transmits the α, β, ξ, and a and b stored in the parameter storage unit 114 to the finite field calculation calculation unit 122.

  The finite field calculation calculation unit 122 performs calculation using a predetermined algorithm, and generates the point Q on the elliptic curve E (GF (q)). The finite field calculation calculation unit 122 outputs the generated point P on the elliptic curve E (GF (q)) to the processing unit 120. The input unit 131 receives information from the outside of the point generation device 100 via a storage medium 144 or a communication medium (a network connected to the point generation device 100 or a digital signal or carrier wave propagating through the network). Accept input. The output unit 132 outputs information to the outside of the point generation device 100 via the storage medium 144 or the communication medium. The communication unit 133 transmits and receives information between the storage unit 111, the processing unit 120, the input unit 131, and the output unit 132.

  The point generator 100 described above includes, for example, a CPU 141, a memory 142, an external storage device 143 such as an HDD, a CD-ROM, a DVD-ROM, and the like as shown in FIG. 2 (schematic diagram of the computer 140). A reading device 145 for reading information from a portable storage medium 144, an input device 146 such as a keyboard and a mouse, an output device 147 such as a display, and a NIC (Network Interface Card) for connecting to a communication network And a general computer 140 including the communication device 148.

  For example, the storage unit 111 can be realized by the CPU 141 using the memory 142 or the external storage device 143, and the processing unit 120 loads a predetermined program stored in the external storage device 143 into the memory 142. The input unit 131 can be realized by the CPU 141 using the input device 146, and the output unit 132 can be realized by the CPU 141 using the output device 147. The communication unit 133 can be realized by the CPU 141 using the communication device 148.

  The predetermined program is downloaded to the external storage device 143 from the storage medium 144 via the reading device 145 or from the communication medium via the communication device 148, and then loaded onto the memory 142 and executed by the CPU 141. You may make it do. Alternatively, the program may be directly loaded onto the memory 142 from the storage medium 144 via the reading device 145 or from the communication medium via the communication device 148 and executed by the CPU 141.

  FIG. 3 is a sequence diagram showing point generation processing in the point generation device 100.

  First, the processing unit 120 of the point generation device 100 acquires an element tεGF (q) of a finite field input via the input unit 131 or stored in the data storage area 131 (S10).

Next, the processing unit 120 includes two rational functions φ / ω and ψ / ω stored in the rational function storage area 112 of the storage unit 123, and ξ∈GF (q ² ) stored in the base storage area 113. ) −GF (q), the prime power q stored in the parameter storage area 114, and the coefficients a and b of the definition equation (formula 1) of the elliptic curve E (GF (q)) are read ( S11).

Then, the processing unit 120 defines the definition equations for the two read rational functions φ / ω, ψ / ω, ξ∈GF (q ² ) −GF (q), prime power q, and elliptic curve E (GF (q)). The coefficients a and b of (Equation 1) and the finite field element tεGF (q) are input to the rational function calculation unit 121 (S12).

The rational function calculation unit 121 receives the two input rational functions φ / ω, ψ / ω, ξ∈GF (q ² ) −GF (q), prime power q, and elliptic curve E (GF (q) ), The elements α and β of the finite field GF (q) are calculated from the coefficients a and b of the definition equation (formula 1) and the element tεGF (q) of the finite field (S13).

The rational function calculation unit 121 then calculates the elements α and β of the calculated finite field GF (q), ξ∈GF (q ² ) −GF (q), prime power q, and elliptic curve E (GF (q )) The coefficients a and b of the definition equation (formula 1) are output to the finite field calculation calculation unit 122 (S14).

The finite field calculation calculation unit 122 receives the elements α and β of the received finite field GF (q), ξ∈GF (q ² ) −GF (q), prime power q, and elliptic curve E (GF (q) The point P on the elliptic curve is generated from the coefficients a and b of the definition equation (formula 1) (S15).

  The finite field calculation calculation unit 122 outputs the calculated point P on the elliptic curve to the processing unit 120 (S16).

In step S11, two rational functions φ / ω, ψ / ω, ξ∈GF (q ² ) −GF (q), prime power q, and elliptic curve E (GF (q)) defining equations (formula 1) As for the acquisition timing of the coefficients a and b, two rational functions φ / ω, ψ / ω, ξ∈GF (q ² ) −GF (q), prime power q, elliptic curve E ( GF (q)) may be before the coefficients a and b of the definition equation (Formula 1) are output, for example, before obtaining the finite field element tεGF (q) (S10). . Further, in the calculation of step S13, the coefficients a and b of the definition equation (formula 1) of the elliptic curve E (GF (q)) are not used, so there is no need to read in step S11, and it may be before step S14. .

  The processing unit 120 that has acquired the point P on the elliptic curve E (GF (q)) stores the elliptic curve E (GF (q)) in the storage unit 111 or via the output unit 132 or the communication unit 133. ) The upper point P is output (S17).

  FIG. 4 is a flowchart showing a process of generating a point P on the elliptic curve E (GF (q)) in the rational function calculation unit 121 and the finite field calculation calculation unit 122.

  Here, in this embodiment, E is an elliptic curve defined on a finite field GF (q) in which a and b are coefficients of the definition equation (Equation 1), φ, ψ, and ω are converted into a finite field GF (q ) Is a first-order or second-order polynomial having a coefficient.

Hereinafter, the point P on the elliptic curve E (GF (q)) is generated from the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. The method of performing will be specifically described.

The process of generating points on the elliptic curve by the rational function calculation unit 121 and the finite field calculation calculation unit 122 is performed by using the element t of the set GF (q) ^* / {1, −1} ∪ {0} and the set {1, -1} is received from the processing unit 120 (S20).

When the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1} are received from the processing unit 120, the rational function calculation unit 121 is input. Then, α = φ (t) / ω (t) is calculated from the element tεGF (q) ^* / {1, −1} ∪ {0} (S21).

Then, the finite field calculation calculation unit 122 calculates τ = −8α ³ −2aα + b using the α, the elliptic curves a and b, and the prime power q transmitted from the rational function calculation unit 121 (S22). ).

Then, the finite field calculation calculation unit 122 determines whether χ _q (τ) = 1 (S23). If χ _q (τ) = 1 (Yes in step S23), the process proceeds to step S24. If χ _q (τ) = 1 is not satisfied (No in step S23), the process proceeds to step S25. Here, chi _q ^{is, s∈ (GF (q) *} ) 2 if _{χ q (s) = 1,} s∈ (GF (q) *) If not _{^{2 χ q (s) = -}} 1 and definitions Is a mapping from the multiplicative group GF (q) ^{* of the} above finite field to the set {1, -1}, which is called a quadratic index (further, χ _q (0) = 0 and χ _q is GF The mapping from (q) to {0, 1, -1} may be extended, and χ _q is also defined from GF (q) as defined above to {0, 1, -1}. A mapping).

  In step S24, the finite field calculation calculation unit 122 calculates √τ from τ and substitutes it for y (S24).

In step S25, the finite field calculation calculation unit 122 calculates √τ / ξ ² from τ, substitutes it for z, calculates zω (t) / ψ (t), and substitutes it for w (S25).

  In step S26, the finite field calculation calculation unit 122 substitutes (-2α, ιy) for P and outputs the P as a point of the elliptic curve (S26).

In step S27, the finite field calculation calculation unit 122 substitutes (w ² −2α, ι (w ² −3α) w) for P, and outputs the P as a point of the elliptic curve (S27).

  The square root calculation in the finite field executed in step S24 and step S25 is described in detail in, for example, H. Cohen, “A Course in Computational Algebraic Number Theory”, Springer-Verlag, GTM 138, 1993. Yes.

  It should be noted that the fact that the P output in step S26 and step S27 is a point on the elliptic curve E (GF (q)) indicates that the equation defining the elliptic curve E (GF (q)) (formula 1) This can be easily confirmed by substituting P for.

In the present embodiment, the elliptic curve E (GF (q (q)) is obtained for the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. )) Although the method for generating the upper point P with the affine coordinates of the Weierstrasse elliptic curve has been described, a coordinate system different from the affine coordinates of the Weierstrasse elliptic curve, such as the projected coordinates of the Weierstrasse elliptic curve, the Jacobian coordinates of the Weierstrass elliptic curve, etc. Or a point on a Hessian-type elliptic curve, Montgomery-type elliptic curve, or Edwards-type elliptic curve. The reason for this will be described in the case of the Jacobian coordinates of a Weierstrass-type elliptic curve.
The affine coordinates (X / Z ² , Y / Z ³ ) of the Weierstrasse elliptic curve correspond to the Jacobian coordinates (X: Y: Z) (Z ≠ 0) of the Weierstrasse elliptic curve. At this time, in this embodiment, the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1} are output in step S26. The Jacobian coordinate point of the Weierstrasse elliptic curve corresponding to the affine coordinate point (-2α, ιy) of the Weierstrasse elliptic curve is (−2αω (t): ιyω (t): ω (t)), and step S27 in the outputted Weierstrass-type points of the affine coordinates of the elliptic curve ^{(w 2 -2α, ι (w} 2 -3α) w) in terms of Jacobian coordinates corresponding the Weierstrass-type elliptic curve (ξ ² (τ- This is because it is easily understood that 2ξ ² αβ ² ω (t)): ιξ ² (τ-3ξ ² αβ ² ω (t)) × √ (ξ ² τ): ξ ² βω (t)). Here, τ = −8α ³ ω (t) −2aαω (t) ³ + bω (t) ⁴ . Therefore, a Jacobian coordinate point of the Weierstrass-type elliptic curve is generated for the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. For this, the steps from step S21 to step S27 (and the steps from step S21 to step S27 in FIG. 4) may be changed as follows:
α = φ (t) and γ = ω (t) are calculated (S21).

τ = −8α ³ γ−2aαγ ³ + bγ ⁴ is calculated (S22).

It is determined whether χ _q (τ) = 1 (S23). If χ _q (τ) = 1 (Yes in step S23), the process proceeds to step S24. If χ _q (τ) = 1 is not satisfied (No in step S23), the process proceeds to step S25.

  √τ is calculated and substituted for y (S24).

√ (τξ ² ) is calculated and substituted for z (S25).

  P = (− 2αγ: ιyγ: γ), and P is output as a point of the elliptic curve (S26).

P = (ξ ² (τ−2ξ ² αβ ² γ): ιξ ² (τ−3ξ ² αβ ² γ) × √ (ξ ² τ): ξ ² βγ), and the P is output as a point of the elliptic curve (S27).

The reason why the zero points z ₀ and z ₁ that are the zeros of the polynomials ω and ψ are stored with the information associated with the two rational functions is as follows. In step S21, α = φ (t) / ω (t) is calculated. This is because ω (z ₀ ) = ₀ if t = z ₀ and α cannot be calculated (the rational function φ / ω is not defined by t = z ₀ ). Furthermore, in step S25, w = zω (t) / ψ (t) is calculated. This is because if t = z ₁ ψ (z ₁ ) = 0, w cannot be calculated (the rational function zω / ψ is not defined by t = z ₁ ).

Therefore, points P ₀ and P ₁ on the elliptic curve E (GF (q)) corresponding to z ₀ and z ₁ are determined in advance, and t = z ₀ or t = z ₁ is input in step S20. In this case, the predetermined points P ₀ and P ₁ may be output. When t = z ₀ or t = z ₁ is input, t = t + 1, t ≠ z ₀ and t ≠ z ₁ T = t + 1 may be repeated until the element tεGF (q) ^* / {1 from the set GF (q) ^* / {1, −1} ∪ {0} to ω (t) = 0. , −1} ∪ {0} and the element t∈GF (q) ^* / {1, −1} ∪ {0} where ψ (t) = 0 may be removed in advance.

The number of elements z ₀ ∈GF (q) ^* / {1, −1} ∪ {0} with ω (z ₀ ) = 0, and the element z ₁ ∈GF (q) ^* / with ψ (z ₁ ) = 0. Since the number of {1, -1} ∪ {0} is at most two, the number of repetitions of t = t + 1 is four at most, and the processing time of the repetition of t = t + 1 is the above-described step S24, Alternatively, since the processing time of the square root calculation in step S25 is very small, the point generation processing time does not vary greatly depending on the input in step S20.

The rational functions φ / ω and ψ / ω can be determined by the following method, for example. In general, one point (α ₀ , β ₀ ) on the quadric curve C defined on the finite field GF (q) is determined and fixed. For an arbitrary point (α, β) other than the point (α ₀ , β ₀ ) of the quadratic curve C, a straight line connecting the point (α ₀ , β ₀ ) and the point (α, β) A mapping from the set obtained by removing the point (α ₀ , β ₀ ) from the quadratic curve C to the finite field GF (q) is formed by setting the intersection point with the x-axis (or y-axis) as t. it can. The inverse mapping (t → (φ / ω) (t), (ψ / ω) (t)) may be the rational function.

The reason why a hash function having a value on an elliptic curve can be easily configured by using this embodiment is as follows. For example, in the signature described in Non-Patent Document 2, a hash function H: {0, 1} ^* → E (GF (q from an arbitrary length bit string {0, 1} ^* to an elliptic curve E (GF (q)) )). Let h be a cryptographic hash function (for example, SHA-256, etc.) from an arbitrary-length bit string {0, 1} ^* to a fixed-length bit string {0, 1} ^m , and the bit length | q | = M. For an arbitrary length bit string Mε {0,1} ^* , the hash value h (M) of the above M is calculated, and the upper m−1 bits are t, and the lowest 1 bit is ι. That is, M = t || ι. Here, || represents a combination of two bit strings.

The above t is regarded as an element of GF (q) by a predetermined method (for example, for a bit string t = t _m−2 t _m−1 ... T ₀ , t = t _m−2 2 ^m−2 + t _m−1 2 ^m−1 +... + t ₀ ), the above for t∈GF (q) ^* / {1, −1}｝ {0} and ι∈ {1, −1} By using the point P generated by the point generation method described in the embodiment as a hash value for the bit string M, an elliptic curve from an arbitrary-length bit string {0, 1} ^* described in the signature described in Patent Document 2 A hash function H: {0, 1} ^* → E (GF (q)) to E (GF (q)) can be constructed.

Also, a method of constructing a hash function from an arbitrary-length bit string {0, 1} ^* to {GF (q) ^* / {1, -1} ∪ {0}) × {1, -1} is feasible. Any method is acceptable. Furthermore, other hash functions having a value on the elliptic curve (for example, Non-Patent Document 1) can be realized by a method similar to the hash function H.

  As described above, the point generation on the elliptic curve of the present embodiment can be applied to a general elliptic curve, and it is possible to generate a point on the elliptic curve so that there is no large variation in processing performance according to the input. .

  Next, a method for generating points on an elliptic curve according to the second embodiment will be described.

The method for generating points on the elliptic curve described in the first embodiment is Φ, and the mappings f ₁ , f ₂ , and f ₃ are
f ₁ : GF (q) ^* / {1, −1} ∪ {0} → C (GF (q)),
t → f ₁ (t) = (α = φ (t) / ω (t), β = ψ (t) / ω (t))
(Formula 2)
f ₂ : C (GF (q)) → E ⁽¹⁾ (GF (q ² ) / GF (q)),
(Α, β) → Q = (α + βξ, √F (α + βξ)) (Formula 3)
f ₃ : E ⁽¹⁾ (GF (q ² ) / GF (q)) → E (GF (q)),
Q = (α + βξ, √F (α + βξ)) → Q + σ (Q) (Formula 4)
And Here, φ, ψ, and ω in (Expression 2) are first-order or second-order polynomials having the above-mentioned finite field GF (q) as coefficients, and F (α + βξ) in (Expression 3) is From the right side F (x) = x ³ + ax + b of the definition equation, F (α + βξ) = (α + βξ) ³ + a (α + βξ) + b. With respect to the points P ₁ and P ₂ on the elliptic curve E, when P ₁ = P ₂ or P ₁ = −P ₂ , an equivalence relation of P _{1 to} P ₂ is defined. E ⁽¹⁾ (GF (q ² ) / GF (q)) and E (GF (q)) are respectively set {(x, y) εE (GF (q ² )) | xεGF (q ² ) −GF (q), y ² εGF (q)} and set E ((GF (q)) divided by the equivalence relation ˜. Σ is a qth power Frobenius map. The point P generated by the method described in the first embodiment from the element t of (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1} is P = f ₃ (f ₂ (f ₁ (t, ι))).

In the second embodiment, the finite field GF (q) in the first embodiment is a quadratic extension field GF (q ² ), and the multiplicative group GF (q) ^* of the finite field GF (q) is quadratic extension. body GF ^{(q 2)} of the multiplicative group ^GF (q ²⁾ *, 4-order quadratic extension of secondary extension field GF ^{(q 2)} a secondary extension field GF ^{(q 2)} (the finite field GF (q) (Enlarged) A GF (q ² ) rational point of the elliptic curve E is generated by the method described in the first embodiment as GF (q ⁴ ), and further from the point on the elliptic curve E (GF (q ² )). This is a method for generating a point on the elliptic curve E (GF (q)) using (Equation 9).

  Here, similarly to the first embodiment, the point generation device in the present embodiment also includes a storage unit 111, a processing unit 120, an input unit 131, an output unit 132, and a communication unit 133.

In the present embodiment, on the finite field GF (q) with respect to the element t of the set GF (q ² ) ^* / {1, -1} ０ {0} and the element ι of the set {1, -1} by the point generator. A point on the defined elliptic curve E (GF (q)) is generated.

  The functional configuration of the storage unit 111 is the same as that of the first embodiment.

Information rational function storage area 112 associated with the finite field GF two information regarding rational function from (q ²⁾ to finite GF (q ²⁾ above defined quadratic curve C, and the two rational function Is stored. Here, the finite field GF ^{(q 2)} from the finite field GF ^{(q 2)} The two rational function onto defined quadratic curve C, 1 primary with the finite field GF a ^{(q 2)} to the coefficient Or a quadratic curve defined on the finite field GF (q ² ) from the finite field GF (q ² ), which is a function expressed as φ / ω, ψ / ω using quadratic polynomials φ, ω, and ψ. The information regarding the two rational functions for C is, for example, the coefficients of φ, ω, and ψ. Furthermore, the rational function phi / omega, poles of [psi / omega _{(i.e., ω (z 0) = 0} ) and becomes the original _{z 0,} and zeros of the polynomials [psi of the finite field GF ^{(q 2)} (i.e., [psi _(z 1) = 0) and it becomes a former _{z 1} of the finite field GF ^{(q 2).} The reason why the zero points z ₀ and z ₁ that are the zeros of the polynomials ω and ψ are stored in the information associated with the two rational functions will be described later.

The base storage area 113 stores information related to the base of the secondary extension GF (q ⁴ ) of the finite field GF (q ² ). For example, in the present embodiment, the element ξ such that ξ∈GF (q ⁴ ) −GF (q ² ), c = ξ ² ∈GF (q ² ) is the quadratic extended GF () of the finite field GF (q ² ) information on the basis of q ⁴ ). The element cεGF (q ² ) may also be stored as information on the base. ^{Here, GF (q 4) -GF (} q 2) represents the set except for the finite field GF ^{(q 2)} of the secondary expansion GF ^{(q 4)} from the finite field GF ^{(q 2)} original. The xi], and identity element 1 relating to the multiplication of the finite field GF ^{(q 2)} is a base on the finite field GF ^{(q 2)} of the secondary expansion GF ^{(q 4).}

  The parameter storage unit stores information on the finite field GF (q) and the elliptic curve E (GF (q)) defined on the finite field GF (q). For example, in the present embodiment, the prime power q and the coefficients a and b of the defining equation (formula 1) of the elliptic curve E (GF (q)) are used.

  The functional configuration of the processing unit 120 is the same as that of the first embodiment.

For example, in the present embodiment, the processing unit 120 performs the elliptic curve E () on the element t of the set GF (q ² ) ^* / {1, −1} ∪ {0} and the element ι of the set {1, −1}. Controls the process of generating points on GF (q)). Here, the set GF (q ² ) ^* / {1, −1} ∪ {0} is g + h = 0 or g− with respect to the element g of the multiplicative group GF (q ² ) ^* of the finite field. A set obtained by dividing the multiplicative group GF (q ² ) ^* of the finite field by an equivalence relation of h = 0.

For example, in the present embodiment, the processing unit 120 performs the rational functions φ / ω, ψ / ω stored in the rational function storage area 112 and the basis for the element t and the element ι that are input data. The element ξ of GF (q ⁴ ) −GF (q ² ) stored in the storage area 113 is acquired and transmitted to the rational function calculation unit 121 together with t. The rational function calculation unit 121 performs calculation using a predetermined algorithm, and generates two elements α and β of the finite field GF (q ² ). Then, the rational function calculation unit 121 transmits the α, β, ξ, and a and b stored in the parameter storage unit 114 to the finite field calculation calculation unit 122.

  The finite field calculation calculation unit 122 performs calculation using a predetermined algorithm, and generates a point P on the elliptic curve E (GF (q)). The finite field calculation calculation unit 122 outputs the generated point P on the elliptic curve E (GF (q)) to the processing unit 120. The input unit 131 receives input of information. The output unit 132 outputs information. The communication unit 133 transmits and receives information between the storage unit 111, the processing unit 120, the input unit 131, and the output unit 132.

  Similarly to the first embodiment, the point generation device 100 described above also has, for example, a CPU 141, a memory 142, an external storage device 143 such as an HDD, as shown in FIG. 2 (a schematic diagram of the computer 140), A reader 145 that reads information from a portable storage medium 144 such as a CD-ROM or DVD-ROM, an input device 146 such as a keyboard or a mouse, an output device 147 such as a display, and a communication network It can be realized by a general computer 140 including a communication device 148 such as a NIC (Network Interface Card). Similarly to the first embodiment, the processing unit 120 can be realized by loading a predetermined program stored in the external storage device 143 into the memory 142 and executing it by the CPU 141.

The sequence diagram showing the point generation processing in the point generation device 100 of this embodiment is also the same as that of the first embodiment (FIG. 3). However, t in step S10 is an element of GF (q ² ) ^* / {1, -1} ∪ {0}, φ, ω, and ψ in steps S11 and S12 are the finite field GF (q ² ). The first-order or second-order polynomial for the coefficients, ξ of step S11 and step 14 is the basis on GF (q ² ) of GF (q ⁴ ), and α and β of step S13 and step S14 are the finite field It is an element of GF (q ² ).

  FIG. 5 is a flowchart showing a process of generating a point P on the elliptic curve E (GF (q)) in the rational function calculation unit 121 and the finite field calculation calculation unit 122.

Here, in the present embodiment, E is an elliptic curve defined on a finite field GF (q) in which a and b are coefficients of the definition equation (Equation 1), φ, ψ, and ω are converted to the finite field GF ( Let q ² ) be a first-order or second-order polynomial having a coefficient.

Hereinafter, a point P on the elliptic curve E (GF (q)) is calculated from the element t of the set GF (q ² ) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. The generation method will be specifically described.

The process of generating points on the elliptic curve by the rational function calculation unit 121 and the finite field calculation calculation unit 122 is performed by using the element t of the set GF (q ² ) ^* / {1, −1} ∪ {0} and the set {1 , −1} is received from the processing unit 120 (S30).

Upon receiving the element t of the set GF (q ² ) ^* / {1, -1} ／ {0} and the element ι of the set {1, -1} from the processing unit 120, the rational function calculation unit 121 inputs Α = φ (t) / ω (t) is calculated from the above-mentioned element tεGF (q ² ) ^* / {1, −1} ∪ {0} (S31).

Then, the finite field calculation calculation unit 122 calculates τ = −8α ³ −2aα + b using the α, the elliptic curves a and b, and the prime power q transmitted from the rational function calculation unit 121 (S32). ).

Then, the finite field calculation calculation unit 122 determines whether χ _q ² (τ) = 1 (S33). If χ _q ² (τ) = 1 (Yes in step S33), the process proceeds to step S34. If χ _q ² (τ) = 1 is not satisfied (No in step S33), the process proceeds to step S35. move on. Here, χ _q ^{2 is, s∈ (GF (q 2)} *) 2 if ^{_{χ q 2 (s) = 1}} , s∈ (GF (q 2) *) if it is not a ^{2 χ} _q ² (s) Is a mapping from the multiplicative group GF (q ² ) ^{* of the} finite field defined as = −1 to the set {1, −1} (further, χ _q ² (0) = 0, and χ _q ² is GF ( q ² ) to {0, 1, -1}, and may be extended.Hereafter, χ _q ² is also defined as described above from GF (q) to {0, 1, -1}. ).

  In step S34, the finite field calculation calculation unit 122 calculates √τ from τ and substitutes it for y (S34).

In step S35, the finite field calculation calculation unit 122 calculates √τ / ξ ² from τ, substitutes it for z, calculates zω (t) / ψ (t), and substitutes it for w (S35).

  In step S36, the finite field calculation calculation unit 122 substitutes (-2α, ιy) for Q (S36).

In step S37, the finite field calculation calculation unit 122 substitutes (w ² −2α, ι (w ² −3α) w) for Q (S37).

In step S38, Q + σ (Q) is substituted for P, and P is output as a point of the elliptic curve (S37). Here, σ is a q-th power Frobenius map.
For the square root calculation in the finite field executed in step S34, step S35, and step S37 (calculation of Q + σ (Q)), see, for example, H. Cohen, “A Course in Computational Algebraic Number Theory”, Springer-Verlag, It is described in detail in GTM 138, 1993.

  Note that the P output in step S37 is a point on the elliptic curve E (GF (q)), as in the first embodiment, the defining equation for the elliptic curve E (GF (q)). This can be easily confirmed by substituting P into (Equation 1).

In the present embodiment, the elliptic curve E (GF (q (q)) is obtained for the element t of the set GF (q) ^* / {1, -1} ∪ {0} and the element ι of the set {1, -1}. )) Although the method for generating the upper point P with the affine coordinates of the Weierstrasse elliptic curve has been described, a coordinate system different from the affine coordinates of the Weierstrasse elliptic curve, such as the projected coordinates of the Weierstrasse elliptic curve, the Jacobian coordinates of the Weierstrass elliptic curve, etc. Or a point on a Hessian-type elliptic curve, Montgomery-type elliptic curve, or Edwards-type elliptic curve. The reason for this is also the same as in the first embodiment.

The zeros z ₀ and z ₁ that are the zeros of the polynomials ω and ψ are stored in the information associated with the two rational functions, and the set GF (q ² ) ^* / {1, −1 } The method of generating the point P on the elliptic curve E (GF (q)) when the _element t of {0} is equal to z ₀ or z ₁ is the same as in the first embodiment.

  The rational functions φ / ω and ψ / ω are determined in the same manner as in the first embodiment.

The reason why a hash function having a value on an elliptic curve can be easily configured by using this embodiment is as follows. For example, in the signature described in Non-Patent Document 2, as described above, the hash function H: {0, 1} ^* → E from the arbitrary-length bit string {0, 1} ^* to the elliptic curve E (GF (q)) (GF (q)) is used. Let h be a cryptographic hash function (for example, SHA-256, etc.) from an arbitrary-length bit string {0, 1} ^* to a fixed-length bit string {0, 1} ^2m , and the bit length | q | = M. For an arbitrary length bit string Mε {0,1} ^* , the hash value h (M) of the M is calculated, the upper (m−1) / 2 bits are t ₁ , and the next (m−1) / 2. Let the bit be t ₂ and the least significant 2 bits be ι. That is, M = t ₁ || t ₂ || ι. Here, || represents a combination of two bit strings. The above t ₁ and t ₂ are regarded as elements of GF (q) in a predetermined method (for example, bit string t ₁ = t _{1, m−2} t _{1, m−3} ... T _1,0 , t _{2 = t 2, m-2 t} 2, m-3 ... t 2,0, ^{_{for, t 1 = t 1, m}} -2 2 m-2 + t 1, m-3 2 m-3 + .. + T ₁ , ₀ , t ₂ = t _{2, m-2} 2 ^m-2 + t _{2, m-3} 2 ^m-3 + ... + t _2,0 ), and ι = ι ₁ || ι ₂ , that is, the upper 1 bit of ι is ι ₁ and the lower 1 bit of ι is ι ₂ . In this embodiment, t = t ₁ + t ₂ ξ∈GF (q ² ) ^* / {1, −1} １ ， {0} and ι ₁ (or ι ₂ ) ∈ {1, −1}. By using the point P generated by the described point generation method as a hash value for the bit string M, an elliptic curve E (GF from an arbitrary-length bit string {0, 1} ^* described in the signature described in Patent Document 2 is used. A hash function H: {0, 1} ^* → E (GF (q)) to (q)) can be constructed. Also, a method of constructing a hash function from an arbitrary-length bit string {0, 1} ^* to {GF (q ² ) ^* / {1, -1} ∪ {0}) × {1, -1} is feasible. If so, the method does not matter. Furthermore, other hash functions having a value on the elliptic curve (for example, Non-Patent Document 1) can be realized by a method similar to the hash function H.

  As described above, the point generation on the elliptic curve of the present embodiment can be applied to a general elliptic curve, and it is possible to generate a point on the elliptic curve so that there is no large variation in processing performance according to the input. .

100: point generation device, 111: storage unit, 112: rational function storage area, 113: basis storage area, 114: parameter storage area, 120: processing unit, 121: rational function calculation unit, 122: finite field calculation calculation unit, 131: input unit, 132: output unit, 133: communication unit.

Claims (12)

GF (q of the elliptic curve E defined on the finite field GF (q) from the elements of the set S with the number of elements (q + 1) / 2 (q should be a prime number of 5 or more) and the elements of the set T with the number of elements 2 A point generation method for generating rational points,
Generating a GF (q) rational point of the quadratic curve C defined on the predetermined finite field GF (q) from an element of the set S;
A second step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q) rational point of the quadratic curve C generated in the first step;
A third step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q ² ) rational point of the elliptic curve E generated in the second step and the element of the set T;
A point generation method on an elliptic curve, comprising: A method for generating points on an elliptic curve according to claim 1,
The set S is a set GF (q) ^* / {1, -1} ∪ {0}, and the set T is {1, -1},
In the first step, α (t) and β (t) are calculated for rational functions α and β on two predetermined GF (q) from the element t of the set S, and the two Generate a GF (q) rational point R = (α, β) of the quadratic curve C;
The second step includes a basis (ξ, 1) on the finite field GF (q) of the predetermined finite field GF (q ² ) and a GF (q) rational point of the quadratic curve C ( GF (q ² ) rational point P = (α + βξ, √ (F (α + βξ))) of the elliptic curve E from α, β) (F is a Weierstrass type definition equation of the elliptic curve E y ² = x ³ + ax + b = F (x) = x ³ + ax + b) is generated for F (x),
In the third step, the GF (q) rational point (P + σ (P) of the elliptic curve E is obtained using the Frobenius automorphism σ of the elliptic curve E from the GF (q ² ) rational point P of the elliptic curve E. )),
A method for generating points on an elliptic curve characterized by GF of an elliptic curve E defined on a finite field GF (q) from an element of a set S having the number of elements (q ² +1) / 2 (q should be a prime number of 5 or more) and an element of the set T having two elements (Q) A point generation method for generating rational points,
Generating a GF (q ² ) rational point of a quadratic curve C defined on the predetermined finite field GF (q ² ) from the element of the set S;
A second step of generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ² ) rational point of the quadratic curve C generated in the first step;
A third step of generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ⁴ ) rational point of the elliptic curve E generated in the second step and the element of the set T;
A point generation method on an elliptic curve, comprising: A method for generating points on an elliptic curve according to claim 3,
The set S is a set GF (q ² ) ^* / {1, −1} ∪ {0}, and the set T is {1, −1},
The first step calculates α (t) and β (t) for the rational functions α and β on two predetermined GF (q ² ) from the element t of the set S, and Generate a GF (q ² ) rational point R = (α, β) of the quadratic curve C;
The second step includes a basis (ξ, 1) on the finite field GF (q ² ) of the predetermined finite field GF (q ⁴ ), and a GF (q ² ) rationality of the quadratic curve C. GF (q ² ) rational point P of the elliptic curve E with respect to the point (α, β) P = (α + βξ, √ (F (α + βξ))) (F is a Weierstrass-type definition equation y ^{2 of the} elliptic curve E) = X ³ + ax + b = F (x) polynomial)
In the third step, the GF (q) rational point P + σ (P) of the elliptic curve E is obtained from the GF (q ⁴ ) rational point P of the elliptic curve E using the Frobenius automorphism σ of the previous elliptic curve E. ) + Σ ² (P) + σ ³ (P),
A method for generating points on an elliptic curve characterized by GF (q of the elliptic curve E defined on the finite field GF (q) from the elements of the set S with the number of elements (q + 1) / 2 (q should be a prime number of 5 or more) and the elements of the set T with the number of elements 2 A point generator for generating rational points,
A first means for generating a GF (q) rational point of a quadratic curve C defined on the finite field GF (q) determined in advance from an element of the set S;
Second means for generating a GF (q ² ) rational point of the elliptic curve E from the GF (q) rational point of the quadratic curve C generated by the first means;
Third means for generating a GF (q ² ) rational point of the elliptic curve E generated by the second means and a GF (q) rational point of the elliptic curve E from the elements of the set T;
A point generation device on an elliptic curve, comprising: The point generation device on an elliptic curve according to claim 5,
The set S is a set GF (q) ^* / {1, -1} ∪ {0}, and the set T is {1, -1},
The first means calculates α (t) and β (t) for rational functions α and β on two predetermined GF (q) from the element t of the set S, and Generate a GF (q) rational point R = (α, β) of the quadratic curve C;
The second means includes a basis (ξ, 1) on the finite field GF (q) of the predetermined finite field GF (q ² ), and a GF (q) rational point of the quadratic curve C ( GF (q ² ) rational point P = (α + βξ, √ (F (α + βξ))) of the elliptic curve E from α, β) (F is a Weierstrass type definition equation of the elliptic curve E y ² = x ³ + ax + b = F (x) = x ³ + ax + b) is generated for F (x),
The third means uses the GF (q ² ) rational point (P + σ (P) of the elliptic curve E from the GF (q ² ) rational point P of the elliptic curve E using the Frobenius automorphism σ of the elliptic curve E. )),
A point generator on an elliptic curve characterized by the following. GF of an elliptic curve E defined on a finite field GF (q) from an element of a set S having the number of elements (q ² +1) / 2 (q should be a prime number of 5 or more) and an element of the set T having two elements (Q) A point generator for generating rational points,
A first means for generating a GF (q ² ) rational point of the quadratic curve C defined on the finite field GF (q ² ) determined in advance from the element of the set S;
Second means for generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ² ) rational point of the quadratic curve C generated by the first means;
Third means for generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ⁴ ) rational point of the elliptic curve E generated by the second means and the element of the set T;
A point generation device on an elliptic curve, comprising: The point generation device on an elliptic curve according to claim 7,
The set S is a set GF (q ² ) ^* / {1, −1} ∪ {0}, and the set T is {1, −1},
The first means calculates α (t) and β (t) for rational functions α and β on two predetermined GF (q ² ) from the element t of the set S, and Generate a GF (q ² ) rational point R = (α, β) of the quadratic curve C;
The second means includes a basis (ξ, 1) on the finite field GF (q ² ) of the predetermined finite field GF (q ⁴ ), and a GF (q ² ) rationality of the quadratic curve C. GF (q ² ) rational point P of the elliptic curve E with respect to the point (α, β) P = (α + βξ, √ (F (α + βξ))) (F is a Weierstrass-type definition equation y ^{2 of the} elliptic curve E) = X ³ + ax + b = F (x) polynomial)
The third means uses the Frobenius automorphism σ of the elliptic curve E from the GF (q ⁴ ) rational point P of the elliptic curve E to use the GF (q) rational point P + σ (P ) + Σ ² (P) + σ ³ (P),
A point generator on an elliptic curve characterized by the following. The computer calculates an elliptic curve E defined on a finite field GF (q) from an element of a set S having (q + 1) / 2 elements (q is a prime power of 5 or more) and an element of a set T having 2 elements. A point generation program for generating GF (q) rational points,
Generating a GF (q) rational point of the quadratic curve C defined on the predetermined finite field GF (q) from an element of the set S;
A second step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q) rational point of the quadratic curve C generated in the first step;
A third step of generating a GF (q ² ) rational point of the elliptic curve E from the GF (q ² ) rational point of the elliptic curve E generated in the second step and the element of the set T;
A point generation program comprising: A point generation program according to claim 9, wherein
The set S is a set GF (q) ^* / {1, -1} ∪ {0}, and the set T is {1, -1},
In the first step, α (t) and β (t) are calculated for rational functions α and β on two predetermined GF (q) from the element t of the set S, and the two Generate a GF (q) rational point R = (α, β) of the quadratic curve C;
The second step includes a basis (ξ, 1) on the finite field GF (q) of the predetermined finite field GF (q ² ) and a GF (q) rational point of the quadratic curve C ( GF (q ² ) rational point P = (α + βξ, √ (F (α + βξ))) of the elliptic curve E from α, β) (F is a Weierstrass type definition equation of the elliptic curve E y ² = x ³ + ax + b = F (x) = x ³ + ax + b) is generated for F (x),
In the third step, the GF (q) rational point (P + σ (P) of the elliptic curve E is obtained using the Frobenius automorphism σ of the elliptic curve E from the GF (q ² ) rational point P of the elliptic curve E. )),
A point generation program characterized by An elliptic curve defined on a finite field GF (q) from a set S element having the number of elements (q ² +1) / 2 (q should be a prime number of 5 or more) and a set T having the number of elements 2 A point generation program for generating a GF (q) rational point of E,
Generating a GF (q ² ) rational point of a quadratic curve C defined on the predetermined finite field GF (q ² ) from the element of the set S;
A second step of generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ² ) rational point of the quadratic curve C generated in the first step;
A third step of generating a GF (q ⁴ ) rational point of the elliptic curve E from the GF (q ⁴ ) rational point of the elliptic curve E generated in the second step and the element of the set T;
A point generation program comprising: A point generation program according to claim 11,
The set S is a set GF (q ² ) ^* / {1, −1} ∪ {0}, and the set T is {1, −1},
The first step calculates α (t) and β (t) for the rational functions α and β on two predetermined GF (q ² ) from the element t of the set S, and Generate a GF (q ² ) rational point R = (α, β) of the quadratic curve C;
The second step includes a basis (ξ, 1) on the finite field GF (q ² ) of the predetermined finite field GF (q ⁴ ), and a GF (q ² ) rationality of the quadratic curve C. GF (q ² ) rational point P of the elliptic curve E with respect to the point (α, β) P = (α + βξ, √ (F (α + βξ))) (F is a Weierstrass-type definition equation y ^{2 of the} elliptic curve E) = X ³ + ax + b = F (x) polynomial)
In the third step, the GF (q) rational point P + σ (P) of the elliptic curve E is obtained from the GF (q ⁴ ) rational point P of the elliptic curve E using the Frobenius automorphism σ of the previous elliptic curve E. ) + Σ ² (P) + σ ³ (P),
A point generation program characterized by

Images