JP2015135452A - Pairing computation device, multi-pairing computation device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve conventional arts about a pairing on an elliptic curve, and further to high-speed a calculation velocity.SOLUTION: A pairing computation device according to the present invention comprises: a record unit; an input conversion unit; an expression evaluation generation unit; and an expression evaluation computation unit. When an expression evaluation Lis L=αy+βxw+γvw, the record unit records ahaving a prescribed relationship with A, and bhaving a prescribed relationship with B. The input conversion unit obtains x' and y' in which x'=γ/(B*β*x), y'=(α*y)/(A*β*x) from xand y. The expression evaluation generation unit reads the aand bfrom the record unit, and generates an expression evaluation L' like L'=dv(Ay'+w+Bx'vw) using the aand b. The expression evaluation computation unit outputs a computation result of f*L' with f,L' as an input.

Description

  The present invention relates to a pairing arithmetic device, a multi-pairing arithmetic device, and a program for information security technology.

FIG. 1 is a diagram showing a conventional algorithm for Optimal Ate pairing on a Barreto-Naehrig elliptic curve (BN curve, E: y ² = x ³ + b, b ≠ 0∈F (p)). And when one element of the input of such a pairing operation is fixed, the calculation speed when the element is input can be calculated in advance and recorded. Non-Patent Document 1 is known as a technique for speeding up the process.

C. Costello, D. Stebila, "Fixed Argument Pairings," LATINCRYPT 2010, LNCS 6212, pp. 92-108, 2010.

  In the pairing encryption, a highly convenient encryption method such as ID-based encryption or functional encryption can be configured. Since these encryption methods require a pairing operation, it is required that the pairing operation can be calculated at high speed for a practical system configuration. In the pairing encryption system, secret information (for example, a secret key) is distributed in advance, and the secret information may be calculated as one of the inputs during the pairing calculation. In this case, by making use of the fact that one of the inputs is fixed, the pairing calculation can be speeded up by off-line pre-calculation. In addition, in advanced cryptosystems such as functional cryptography, one input may be fixed in a multi-pairing operation that calculates the product of multiple pairing operations. Calculation speed can be increased. However, due to the progress of higher functionality in cryptographic systems, higher speed is required.

  An object of the present invention is to improve the prior art for pairing on an elliptic curve and further increase the calculation speed.

First, m is an integer of 2 or more, j is an integer of 0 to m−1, p is a prime number or a power of a prime number, N is a predetermined integer of 0, 1, 2, and k is a positive integer. F (p) and F (p ^k ) are finite fields, P _j is an elliptic curve point on the finite field F (p), and Q _j is an elliptic curve point on the finite field F (p ¹² ). Points, the points of the elliptic curve on the finite field F (p ¹² ) corresponding to Q _j , T _j1 and T _j2 , T _j1 = (x _j1 , y _j1 ), T _j2 = (x _j2 , y _j2 ) , P _j = (x _jP , y _jP ), a symbol indicating a pairing operation in which e is input to the point P _j and the point Q _j and outputs an element on the finite field F (p ¹² ), and f is a finite field F ( p ¹²⁾ on the original, expression evaluation a straight line passing through the _{L j} the point _{T j1} and the point _{T j2} was evaluated by _{P j, α j, β j} , γ j, a j, B j and F ^{(p 2} Top of the original, the d _j as a small integer,
The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
It will be expressed as The expression evaluation L _j is
L _j = α _j y _jP + β _j x _jp w + γ _j vw
It is.

The pairing arithmetic unit of the present invention obtains a pairing e (P ₀ , Q ₀ ) between the element P ₀ of the group G ₁ and the element Q ₀ of the group G ₂ . The pairing calculation device of the present invention includes a recording unit, an input conversion unit, an expression evaluation generation unit, and an expression evaluation calculation unit. The recording unit records a ₀ which is a value having a predetermined relationship with A ₀ and b ₀ which is a value having a predetermined relationship with B ₀ . Input conversion _unit, the _{x 0P} and _{y 0P, x 0P '= γ} 0 / (B 0 · β 0 · x 0P), y 0P' = (α 0 · y 0P) / (A 0 · β 0 · x X _0P ′ and y _0P ′ satisfying ( _0P ) are obtained. The expression evaluation generator reads a ₀ and b ₀ from the recording unit, and uses a ₀ and b ₀ ,
L ₀ '= d ₀ v ^N (A ₀ y _0P ' + w + B ₀ x _0P 'vw)
An expression evaluation L ₀ ′ is generated as follows. The expression evaluation calculation unit receives f and L ₀ ′ and outputs a calculation result of f × L ₀ ′.

Multi pairing computation device of the present invention, m number original _P 0 of the group _{G 1 of,} ..., _{P m-1} and the original _Q 0 of the group _{G 2, ...,} multi-pairing e (P and _{Q m-1 0} , Q ₀ ) × e (P ₁ , Q ₁ ) ×... × e (P _m−1 , Q _m−1 ) are obtained. The multi-pairing calculation device of the present invention includes a recording unit, an expression evaluation generation unit, and an expression evaluation calculation unit. The recording unit records a _j which is a value having a predetermined relationship with A _j and b _j which is a value having a predetermined relationship with B _j for j = 0,..., M−1. For j = 0,..., _M −1, the input conversion unit _calculates x _jP ′ = γ _j / (B _j · β _j · x _jP ), y _jP ′ = (α _j · y) from x _jP and y _jP. x _jP ′ and y _jP ′ _{satisfying jP} ) / (A _j · β _j · x _jP ) are obtained. The expression evaluation generation unit reads a _j and b _j from the recording unit for all of j = 0,..., M−1, and uses a _j and b _j .
L _j '= d _j v ^N (A _j y _jP ' + w + B _j x _jP 'vw)
An expression evaluation L _j ′ is generated as follows. Expression evaluation calculation _{unit, f, L 0 ', L} 1', ..., ' as _{input, f × L 0' L m} -1 outputs an operation result of _{× ... × L m-1 '} .

According to the pairing computation device and a multi-pairing device of the present invention, and a _j is a value having a pre A _j a predetermined relationship based on the fact that the point Q _j is fixed, B _j and a given B _j which is a value having a relationship is recorded. And when a variable point P _j is input,
L _j '= d _j v ^N (A _j y _jP ' + w + B _j x _jP 'vw)
An expression evaluation L _j ′ is generated as shown in FIG. With this type of expression evaluation L _j ′, in the multiplication with an arbitrary element on the finite field F (p ¹² ), the number of multiplications on the finite field F (p ² ) can be reduced as compared with L _j . That is, the calculation that increases the calculation cost by changing the expression evaluation from L _j to L _j ′ is calculated in advance using the fact that the point Q _j is fixed, and the point P _j is input. The calculation cost after being reduced. Therefore, the calculation speed after the point P _j is input can be increased.

The figure which shows the conventional algorithm of Optimal Ate pairing on a Barreto-Naehrig elliptic curve. The figure which shows the algorithm (Algorithm 2) of Optimal Ate pairing at the time of using Formula 5. FIG. The figure which shows the specific example (Algorithm 3) of the algorithm of the multiplication of step 7, 12, 21, 24 of FIG. It shows the F (p ¹²⁾ on any of the original and algorithms multiplication of the original form of Equation 4 (Algorithm 3 '). The figure which shows the function structural example of the pairing calculating apparatus of this invention. The figure which shows the example of a processing flow of the input conversion of the pairing calculating apparatus of this invention, and an expression evaluation calculation. The figure which shows the function structural example of the multi-pairing arithmetic unit of this invention. The figure which shows the example of the processing flow of the input conversion of the multi-pairing calculating apparatus of this invention, and an expression evaluation calculation. The figure which shows the example (Algorithm 4) of the multi-pairing algorithm in Optimal Ate pairing. The figure which shows the example (Algorithm 5) of the algorithm of the multiplication of step 7, 12, 21, 24 of FIG. The figure which shows the algorithm (Algorithm 6) of the calculation of step 3 of FIG. The figure which shows the algorithm (Algorithm 7) of the calculation of step 4 of FIG. The figure which shows the example (Algorithm 6 ') of the algorithm of multiplication at the time of using the formula evaluation of the format of Formula 4 which is a prior art. The figure which shows the example (Algorithm 7 ') of the algorithm of the multiplication of the elements calculated | required in FIG.

Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted. First, m is an integer of 2 or more, j is an integer of 0 to m−1, p is a prime number or a power of a prime number, N is a predetermined integer of 0, 1, 2, and k is a positive integer. F (p) and F (p ^k ) are finite fields, P _j is an elliptic curve point on the finite field F (p), and Q _j is an elliptic curve point on the finite field F (p ¹² ). Points, the points of the elliptic curve on the finite field F (p ¹² ) corresponding to Q _j , T _j1 and T _j2 , T _j1 = (x _j1 , y _j1 ), T _j2 = (x _j2 , y _j2 ) , P _j = (x _jP , y _jP ), a symbol indicating a pairing operation in which e is input to the point P _j and the point Q _j and an element on the finite field F (p ¹² ) is output, and f is a finite field F ( p ¹²⁾ on the original, expression evaluation a straight line passing through the point of _{L j T j1} and the point _{T j2} was evaluated by _{P j,} the _{d j} and the small integer. When the point T _j1 and the point T _j2 are the same point, the “straight line passing through the point T _j1 and the point T _j2 ” is a tangent at the point T _j1 . A “small integer” is an integer having a small value including at least 1. For example, a multiplication (d _j × f) of an arbitrary element f and a small integer d _j is performed by d _j −1 of the arbitrary element f. The number of times of addition (f + f +... + F) is an integer that reduces the calculation cost. A specific small integer differs depending on an arithmetic device, an arithmetic method, and a program, but a certain arithmetic device calculates by replacing the multiplication (d × f) of the integer d and the element f with addition (f + f +... + F) In the arithmetic unit, the integer d is a small integer. The small integer d _j may be a negative integer.

The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
It will be expressed as

がＬ_０に相当する。また、アルゴリズムの具体例を示す図では、Ｆ（ｐ^ｋ）は、

のように示されている。 In the algorithm shown in FIG. 1, T corresponds to T ₀₁ , T, Q, Q ′, −Q ″ corresponds to T ₀₂ , a _opt corresponds to e,

Corresponds to L ₀ . In the figure showing a specific example of the algorithm, F (p ^k ) is

It is shown as follows.

<Analysis of conventional technology>
The pairing calculation includes point addition / doubling and expression evaluation for the points T _j1 , T _j2, and P _j . Next, description will be given while showing a specific example of a coordinate system.

In the following description of the specific example, a Barreto-Naehrig elliptic curve (BN curve, E: y ² = x ³ + b, b ≠ 0∈F (p)) is used. In the BN curve, the prime number p and the order r of the F (p) rational point group on the BN curve with respect to the integer z are
p = 36z ⁴ + 36z ³ + 24z ² + 6z + 1
r = 36z ⁴ + 36z ³ + 18z ² + 6z + 1
It is. In the BN curve, the minimum k that is divisible by r (p ^k −1) is 12.

Sequential expansion of the extension field F (p ^k ) F (p ² ) = F (p) [u] / (u ² −β)
F (p ⁶ ) = F (p ² ) [v] / (v ³ −ξ)
F (p ¹² ) = F (p ⁶ ) [w] / (w ² −v)
However, v ³ = ξ, w ² = v, β is configured as a non-square residue, and ξ is configured as a non-square residue and a cubic non-residue. Then, the element C on F (p ¹² ) is changed to C = c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w (Formula 1)
Where c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ ∈ F (p ² )
Express like this. The sixth-order twist curve E ′ is y ² = x ³ + b / ξ. At this time, the same map (x, y) → (xw ² , yw ³ ) of E ′ and E with respect to the point (x, y) becomes Φ: E ′ (F (p ² )) → E (F ( p ¹²⁾⁾
Exists.

Affine coordinate system example T _j1 = (x _j1 , y _j1 ), T _j2 = (x _j2 , y _j2 ), P _j = (x _jP , y _jP ). For λ _j = (y _j2 −y _j1 ) / (x _j2 −x _j1 ), point addition and expression evaluation (when the points T _j1 and T _j2 are different) are:
x _j3 = λ _j ² -x _j1 -x _2j
y _j3 = λ _j (x _j1 −x _j3 ) −y _{1j
L j = y jP -λ j x} jp w + (λ j x j1 -y j1) vw ( Equation 2)
It becomes. Also, the point doubling and the expression evaluation (when the points T _j1 and T _j2 are the same) are as follows: λ _j = 3x _j1 ² / 2y _j1 x _j3 = λ _j ² -2x _j1
y _j3 = λ _j (x _j1 −x _j3 ) −y _{j1
L j = y jP -λ j x} jp w + (λ j x j1 -y j1) vw ( Equation 3)
It becomes. Here, the _element C on F (p ¹² ) shown in Equation 1 has six coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , and c _5. In the formula evaluation shown, it can be seen that three of the coefficients are zero.

Expressions 2 and 3 of expression evaluations of different forms in the Affine coordinate system are _expressed as y _jP ′ · L _j = 1−λ _j x _jp 'w + y _jP ′ (λ _j x _j1 −y _j1 ) vw (expression 4)
However, x _jp '= x _jp / y _jP , y _jP ' = 1 / y _jP
It is good also as formula evaluation by converting like this. Even if it deform _| transforms in this way, since the part of _yjP 'is removed by the last power calculation (step 14 of the algorithm of FIG. 1), it does not affect the result of a pairing operation. When transformed as shown in Equation 4, it can be seen that three coefficients are zero and one coefficient is a small integer “1”.

In Non-Patent Document 1, the concept of calculating and recording in advance a value that can be calculated in advance is applied to this format, and ( _{−λ j} , λ _j x _j1 −y _j1 ) is calculated and recorded in advance. ing. Also,
x _jp '= x _jp / y _jP , y _jP ' = 1 / y _jP
Is calculated only once for the input of the point P _j , so that the calculation cost after the point P _j is input can be reduced.

<Formula evaluation used in the present invention>
In the present invention, the calculation cost is reduced by transforming the expression evaluation into a form different from Expression 4. First, a specific example of formula evaluation will be described. Specific examples are:
L _j ′ = −1 / (λ _j · x _jp ) · L _j
= (-1 / λ _j ) y _jP '+ w + (-(λ _j x _j1 -y _j1 ) / λ _j ) x _jP ' vw (Formula 5)
However, x _jP '= 1 / x _jP , y _jP ' = y _jP / x _jP
It is. In the case of this evaluation formula, (−1 / λ _j , − (λ _j x _j1 −y _j1 ) / λ _j ) may be calculated and recorded in advance. The calculation of (−1 / λ _j , − (λ _j x _j1 −y _j1 ) / λ _j ) requires an inverse operation, which is slower than the multiplication, but the point P _j is input It does not affect later calculation costs. Also, x _jP '= 1 / x _jP , y _jP ' = y _jP / x _{jP with} respect to the input of the point P _j
Is calculated once. Since the part of -1 / (λ _j · x _jp ) is removed by the final power calculation, the result of the pairing operation is not affected. Also, it is considered most efficient to calculate and record -1 / λ _{j and-} (λ _j x _j1 -y _j1 ) / λ _j in advance. However, multiplication and a -1 / lambda _j without requiring slower calculation such as inverse calculation _{- (λ j x j1 -y j1} ) / λ be recorded another value obtained for _j Good.

  FIG. 2 shows an algorithm for Algorithm Ate pairing (Algorithm 2) when Expression 5 is used. FIG. 3 is a specific example (Algorithm 3) of the multiplication algorithm of Steps 7, 12, 21, and 24 of FIG. A pairing operation can be performed with such an algorithm. In the algorithm of FIG. 2, step 25 is the final power calculation. In FIG. 2, the expression evaluation is indicated by a lowercase letter L.

Next, the difference between Formula 4 and Formula 5 will be described. The algorithm shown in FIG.
A = a ₀ + a ₁ v + a ₂ v ² + a ₃ w + a ₄ vw + a ₅ v ² w
An arbitrary element A on F (p ¹² ) that can be expressed as
B = b ₀ + w + b ₄ vw
This is an algorithm for multiplication with the element B in the form of Expression 5 that can be expressed as follows. For comparison, FIG. 4 shows an algorithm (Algorithm 3 ′) of multiplication between an arbitrary element on F (p ¹² ) and an element of the form of Equation 4. In FIG. 4, the element of the form of Formula 4 is B = 1 + b ₃ w + b ₄ vw
It expresses. In the algorithms shown in FIG. 3 and FIG. 4, the number of multiplications of the original coefficients on F (p ² ) is an element that determines the calculation cost. In FIG. 3, there are three multiplications between the coefficients in Steps 1, 4, and 7, so there are nine multiplications between elements on F (p ² ). On the other hand, in FIG. 4, there is multiplication of coefficients four times in steps 1 and 6 and one time in steps 2 and 7, so that multiplication between elements on F (p ² ) is 10 times. Therefore, it can be seen that the calculation cost is lower when converted into the form of Equation 5.

In the case of multiplication between arbitrary elements on F (p ¹² ), since there are 36 combinations when coefficients are simply combined, there are 36 multiplications between elements on F (p ² ). It is known that the calculation can be performed by 18 multiplications by using the Karatsuba method (Karatsuba method). In the algorithms shown in FIGS. 3 and 4, since the coefficient having a value of zero or a small integer is included, the number of multiplications is further reduced. The formats of Formula 4 and Formula 5 are the same in that there are three coefficients each having a zero value, and one coefficient is “1”. Therefore, the difference in the number of multiplications occurs depending on which coefficient is set to “1”. The present invention has an effect of reducing the calculation cost depending on which coefficient is set to “1”.

The expression evaluation “small integer d _j ” that provides the same effect is obtained by multiplying an arbitrary element f by a small integer d _j (d _j × f), and adding d _j −1 times of the arbitrary element f (f + f + ... + F) is an integer that reduces the calculation cost. Therefore, even if the coefficient part “1” is changed to another small integer, the calculation cost can be reduced as compared with the conventional case. Therefore,
_{L j '= d j ((} -1 / λ j) y jP' + w + (- (λ j x j1 -y j1) / λ j) x jP 'vw),
Even in the expression evaluation L _j ′ expressed as follows, the calculation cost can be reduced as compared with the conventional case.

Further, even in the expression evaluation obtained by multiplying this expression evaluation by v and the expression evaluation obtained by multiplying v ² , the multiplication of elements on F (p ² ) can be performed nine times as in the case of Expression 5. That means
L _j ′ = d _j ((−1 / λ _j ) y _jP ′ v + vw + (− (λ _j x _j1 −y _j1 ) / λ _j ) x _jP′v ² w)
Or _{L j '= d j ((} -1 / λ j) y jP' v 2 + v 2 w + (- (λ j x j1 -y j1) / λ j) x jP 'ξw)
In this case, the calculation cost can be reduced as compared with the conventional case. To summarize the above,
^{_{L j '= d j v N}} ((-1 / λ j) y jP' + w + (- (λ j x j1 -y j1) / λ j) x jP 'vw)
The same effect can be obtained if the expression evaluation L _j ′ is as follows. Note that the portion of −d _j / (λ _j · x _jp ) v ^N that is multiplied to convert the expression evaluation L _j into the expression evaluation L _j ′ is an element of F (p ⁶ ), and thus is removed in the final power calculation. Therefore, the result of the pairing operation is not affected.

Further, the same effect may be obtained even when the expression evaluation L _j is other than Expressions 2 and 3. Specifically, the expression evaluation L _j is L _j = α _j y _jP + β _j x _jp w + γ _j vw (Expression 6)
However, α _j , β _j , and γ _j are original elements on F (p ² ),
L _j ′ = 1 / (β _j · x _jp ) · L _{j
= (Α j · y jP)} / (β j · x jP)) + w + (γ j / (β j · x jP)) vw ( Equation 7)
If the coefficient of w is modified so as to be 1 as shown in FIG. 5, the multiplication of elements on F (p ² ) can be made 9 times as in the case of Expression 5. The same applies if v or v ² is further multiplied. That is, A _j and B _j are elements on F (p ² ), and the expression evaluation is L _j '= d _j v ^N (A _j y _jP ' + w + B _j x _jP 'vw)
However, A _j = s _jA (α _j / β _j ), B _j = s _jB (γ _j / β _j )
x _jP '= 1 / (s _jB · x _jP ), y _jP ' = y _jP / (s _jA · x _jP )
If s _jA and s _jB can be converted into predetermined constants, the same effect can be obtained. Although it is considered that the case of s _jA = 1 and s _jB = 1 is the simplest calculation, the calculation of x _0P ′ and y _0P ′ is an iterative process after step 3 as shown in step 2 of the algorithm of FIG. Just go once before. Thus, since only once for the input of the point P _j, even in the case of s _jA and s _jB not limited to a small integer, calculate the cost of after input of the point P _j can be made smaller than conventional. Incidentally, F if conversion expression evaluation L _j by multiplying the (p ⁶⁾ on the former in expression evaluation L _{j ',} because the original portion of multiplying are removed in the calculation of the final exponentiation of pairing computation The result is not affected.

FIG. 5 shows a functional configuration example of the pairing arithmetic device of the present invention. FIG. 6 shows a processing flow example of input conversion and expression evaluation calculation of the pairing calculation device of the present invention. The pairing arithmetic unit 10 obtains a pairing e (P ₀ , Q ₀ ) between the element P ₀ of the group G ₁ and the element Q ₀ of the group G ₂ . The pairing calculation device 10 is characterized in that the recording unit 50 records the result of the pre-calculation, the input conversion unit 15 and the expression evaluation processing means 20, such as point addition and point doubling Although it has the structure part which performs another process, they are the same as a prior art. 5 and 6, the same components as those in the prior art are omitted. The expression evaluation processing unit 20 includes an expression evaluation generation unit 30 and an expression evaluation calculation unit 40.

The recording unit 50 has a ₀ having a predetermined relationship with (−1 / λ ₀ ) and b having a predetermined relationship with (− (λ ₀ x ₀₁ −y ₀₁ ) / λ ₀ ). ₀ is recorded. As described above, it is considered most efficient to set a ₀ = −1 / λ ₀ and b ₀ = − (λ ₀ x ₀₁ −y ₀₁ ) / λ ₀ . However, for example, (- 1 / λ ₀₎ a value obtained by adding a constant is stored as a _0, even if by subtracting the constant after reading sought (-1 / λ _0), to calculate the cost The impact of is small. Therefore, multiplication and slow computation, such as inversion calculation without requiring -1 / lambda ₀ and _{- (λ 0 x 01 -y 01} ) / λ another value determined ₀ as _{a 0} and _{b 0} It may be recorded. Here, the “value having a predetermined relationship” means a value that can obtain −1 / λ ₀ and − (λ ₀ x ₀₁ −y ₀₁ ) / λ ₀ without requiring a slow calculation. .

The input conversion unit 15 calculates _x0P ′ = 1 / _x0P and _y0P ′ = _y0P / _x0P (S15). The expression evaluation generation unit 30 reads a ₀ and b ₀ from the recording unit 50, and uses a ₀ and b ₀ ,
L ₀ ′ = d ₀ v ^N ((−1 / λ ₀ ) y _0P ′ + w + (− (λ ₀ x ₀₁ −y ₀₁ ) / λ ₀ ) x _0P ′ vw)
An expression evaluation L ₀ ′ is generated as follows (S30). As described above, d ₀ = 1 and N = 0 are considered to be the most efficient, but an expression evaluation L ₀ ′ multiplied by d ₀ v ^N may be generated. The expression evaluation calculation unit 40 receives f and L ₀ ′ as input and outputs a calculation result of f × L ₀ ′ (S40). For example, what is necessary is just to calculate with the algorithm shown in FIG. Steps S30 and S40 are formula evaluation processing (S20). In FIG. 2, step 2 corresponds to S15, steps 6, 11, 20, and 23 correspond to S30, and steps 7, 12, 21, and 24 correspond to S40.

According to the pairing arithmetic unit 10, since the expression evaluation L ₀ ′ is used, in multiplication of an arbitrary element on the finite field F (p ¹² ) and L ₀ ′, the finite field F (p ² ) The number of multiplications can be reduced. That is, the calculation that increases the calculation cost by changing the expression evaluation is calculated in advance using the fact that the point Q ₀ is fixed, and the calculation cost after the point P ₀ is input is calculated. Reduced. Therefore, the calculation speed after the point P ₀ is input can be increased.

[Modification]
Furthermore, as described above, the expression evaluation is as shown in Expression 6.
L _j = α _j y _jP + β _j x _jp w + γ _j vw
In the case of the expression evaluation ^{_{L j '= d j v N}} (A j y jP' + w + B j x jP 'vw)
However, A _j = s _jA (α _j / β _j ), B _j = s _jB (γ _j / β _j )
x _jP '= 1 / (s _jB · x _jP ), y _jP ' = y _jP / (s _jA · x _jP )
If s _jA and s _jB are modified like predetermined constants, the same effect can be obtained. Therefore, the processing flow of the input conversion and the expression evaluation calculation of the pairing arithmetic device shown in FIG. 5 and the pairing arithmetic device shown in FIG. 6 may be as follows. However, A ₀ and B ₀ are elements on F (p ² ).

The pairing arithmetic unit 10 obtains a pairing e (P ₀ , Q ₀ ) between the element P ₀ of the group G ₁ and the element Q ₀ of the group G ₂ . The pairing arithmetic device 10 is characterized in that the recording unit 50 records the result of the pre-calculation, and includes the input conversion unit 15 and the expression evaluation processing means 20. The expression evaluation processing unit 20 includes an expression evaluation generation unit 30 and an expression evaluation calculation unit 40.

It is assumed that A ₀ = s _0A (α ₀ / β ₀ ) and B ₀ = s _0B (γ ₀ / β ₀ ). The recording unit 50 records a ₀ which is a value having a predetermined relationship with A ₀ and b ₀ which is a value having a predetermined relationship with B ₀ . It is considered most efficient to set a ₀ = A ₀ and b ₀ = B ₀ . However, for example, even if a value obtained by adding a constant to A ₀ is stored as a ₀ and the constant is subtracted after reading to obtain A ₀ , the influence on the calculation cost is small. Therefore, another value for obtaining A ₀ and B ₀ without requiring a slow calculation such as multiplication or inverse operation may be recorded as a ₀ and b ₀ . Here, the “value having a predetermined relationship” means a value that can obtain A ₀ and B ₀ without requiring a low-speed calculation.

The input conversion unit 15 calculates x _0P '= 1 / (s _0B · x _0P ), y _0P ' = y _0P / (s _0A · x _0P ) (S15). The expression evaluation generation unit 30 reads a ₀ and b ₀ from the recording unit 50, and uses a ₀ and b ₀ ,
L ₀ '= d ₀ v ^N (A ₀ y _0P ' + w + B ₀ x _0P 'vw)
An expression evaluation L ₀ ′ is generated as follows (S30). Although d ₀ = 1 and N = 0 are considered to be the most efficient, an expression evaluation L ₀ ′ multiplied by d ₀ v ^N may be generated. The expression evaluation calculation unit 40 receives f and L ₀ ′ as input and outputs a calculation result of f × L ₀ ′ (S40).

FIG. 7 shows a functional configuration example of the multi-pairing arithmetic device of the present invention, and FIG. 8 shows an example of the processing flow of input conversion and expression evaluation arithmetic of the multi-pairing arithmetic device of the present invention. Multi pairing computation device 60, m pieces original _P 0 of the group _{G 1 of,} ..., _{P m-1} and the original _Q 0 of the group _{G 2, ...,} multi-pairing e _(P 0 with _{Q m-1,} Q ₀ ) × e (P ₁ , Q ₁ ) ×... × e (P _m−1 , Q _m−1 ) is obtained. The multi-pairing calculation device 60 is characterized in that the recording unit 90 records the result of the pre-calculation, the input conversion unit 65, and the expression evaluation processing means 70, such as point addition and point doubling There are also components that perform the other processes, but they are the same as in the prior art. 7 and 8, the same components as those of the conventional technology are omitted. The expression evaluation processing unit 70 includes an expression evaluation generation unit 80 and an expression evaluation calculation unit 100.

Recording unit 90, j = 0, ..., the m-1, (- 1 / λ j) and the _{a j} is a value having a predetermined _{relationship, (- (λ j x j1} -y j1) / λ j _Bj , which is a value having a predetermined relationship with). As described above, it is considered most efficient to set a _j = −1 / λ _j and b _j = − (λ _j x _j1 −y _j1 ) / λ _j . However, multiplication and a -1 / lambda _j slow calculations without requiring as inversion calculation - a different value obtained for _{(λ j x j1 -y j1)} / λ j as _{a j} and _{b j} It may be recorded. Here, the “value having a predetermined relationship” means a value that can obtain −1 / λ _j and − (λ _j x _j1 −y _j1 ) / λ _j without requiring a slow calculation. .

The input conversion unit 65 _calculates x _jP '= 1 / x _jP and y _jP ' = y _jP / x _jP for j = 0,..., _M −1 (S65). The expression evaluation generation unit 80 reads a _j and b _j from the recording unit for all of j = 0,..., M−1, and uses a _j and b _j .
^{_{L j '= d j v N}} ((-1 / λ j) y jP' + w + (- (λ j x j1 -y j1) / λ j) x jP 'vw)
An expression evaluation L _j ′ is generated as follows (S80). N is a predetermined integer of 0, 1, 2 and is the same value for all of j = 0,..., M−1. As described _above, d _{0, ...,} but consider _{d m-1 = 1, N} = 0 is the most efficient ^{_{and, d 0 v N, ...,}} d m-1 v N expression evaluation multiplied by the _{L 0} ', L ₁ ′,..., L _m−1 ′ may be generated.

The expression evaluation calculation unit 100 receives f, L ₀ ′, L ₁ ′,..., L _m−1 ′, and outputs a calculation result of f × L ₀ ′ × ... × L _m−1 ′ (S100). . Steps S80 and S100 are formula evaluation processing (S70). In step S100,
f ← f × L _j '
If the above process is repeated for j = 0,..., M−1, the same effect as the pairing arithmetic device 10 of the first embodiment can be obtained.

Moreover, if the fact that there is a zero coefficient is used in the expression evaluation, the calculation cost can be further reduced. In that case, the expression evaluation operation unit 100 includes an expression evaluation selection unit 110, an expression evaluation multiplication unit 120, an original multiplication unit 130, an operation control unit 140, and an unselected multiplication unit 150. The expression evaluation selection unit 110 selects four of the unselected expression evaluations L ₀ ′, L ₁ ′,..., L _m−1 ′, and sets them as h ₀ , h ₁ , h ₂ , h ₃ . (S110).

The expression evaluation multiplication unit 120
L ”← h ₀ × h ₁ × h ₂ × h ₃
Is calculated (S120). The expression evaluation multiplication unit 120 may multiply the h ₀ , h ₁ , h ₂ , and h ₃ by devising such that more operations are performed between elements including zero or small integer coefficients. For example,
H ₀ '← h ₀ × h ₁ , H ₁ ' ← h ₂ × h ₃
L ”← H ₀ '× H ₁ '
L ″ may be calculated as follows.

The original multiplication unit 130
f ← f × L ”
And f is updated (S130). Arithmetic control unit _{140, L 0 ', L 1'} , ..., in L _{m-1 ',} up to the number of expression evaluation is not selected by the expression evaluator selection unit 110 is less than 4, expression evaluation selector 110, the processing (S110, S120, S130) of the expression evaluation multiplication unit 120 and the original multiplication unit 130 are repeated (S140). When there is an expression evaluation that is not selected by the expression evaluation selection section in L ₀ ′, L ₁ ′,..., L _m−1 ′, the unselected multiplication section 150 determines all the expression evaluations that are not selected. Is multiplied by f, and f is updated to the multiplication result (S150). The expression evaluation calculation unit 100 outputs f multiplied by all of L ₀ , L ₁ ,..., L _m−1 as a calculation result.

According to the multi-pairing calculation device 60, in the calculation of f × L ₀ ×... × L _m−1 included in the processing of the multi-pairing calculation, first, the expression evaluations L ₀ and L ₁ including zero or small integer coefficients are performed. ,..., L _m−1 is repeated by selecting and multiplying four expression evaluations, so that the number of operations between elements having zero or a small integer as a coefficient can be increased. Therefore, the calculation cost can be reduced and the calculation speed can be increased.

<Specific example of algorithm>
FIG. 9 shows an example of algorithm (Algorithm 4) for multi-pairing in Optimal Ate pairing. The processing of the expression evaluation processing means 70 is applied to steps 5 to 14 and 19 to 24 of the algorithm of FIG. FIG. 10 shows an example (Algorithm 5) of the multiplication algorithm of steps 7, 12, 21, and 24 in FIG. FIG. 11 shows the calculation algorithm (Algorithm 6) in step 3 of FIG. 10, and FIG. 12 shows the calculation algorithm (Algorithm 7) in step 4 of FIG. Note that step 9 in FIG. 10 may use the algorithm (algorithm 3) shown in FIG.

が選択され、
Ｈ_０’←ｈ_０×ｈ_１， Ｈ_１’←ｈ_２×ｈ_３
の計算が行われる。そして、ステップ４で
Ｌ”←Ｈ_０’×Ｈ_１’
のようにＬ”が求められている。つまり、ステップ３の式評価の選択部分がＳ１１０に相当し、ステップ３のＨ_０’とＨ_１’の計算の部分と、ステップ４がＳ１２０に相当する。また、ステップ５がＳ１３０に相当し、ステップ１，２，６がＳ１４０に相当し、ステップ７〜１０がＳ１５０に相当する。 In step 3 of FIG. 10, as h ₀ , h ₁ , h ₂ , and h ₃

Is selected,
H ₀ '← h ₀ × h ₁ , H ₁ ' ← h ₂ × h ₃
Is calculated. In step 4, L "← H ₀ '× H ₁ '
In other words, L ″ is obtained as follows: That is, the selected part of the expression evaluation in step 3 corresponds to S110, the calculation part of H ₀ ′ and H ₁ ′ in step 3 and step 4 corresponds to S120. Step 5 corresponds to S130, Steps 1, 2, and 6 correspond to S140, and Steps 7 to 10 correspond to S150.

When four expression evaluations of the form of expression 4 are multiplied by an arbitrary element f on F (p ¹² ) by the conventional multiplication method shown in FIG.
f ← f × L _j '
When the above process is repeated four times, the multiplication between elements on F (p ² ) is 40 times (4 × 10). On the other hand, when four expression evaluations of the form of Expression 5 are multiplied by an arbitrary element f on F (p ¹² ) by the conventional multiplication method shown in FIG.
f ← f × L _j '
When the above process is repeated four times, the multiplication between elements on F (p ² ) is 36 times (4 × 9). Therefore, even if the expression evaluation calculation unit 100 does not include the expression evaluation selection unit 110, the expression evaluation multiplication unit 120, the original multiplication unit 130, the calculation control unit 140, and the unselected multiplication unit 150, the effect of reducing the calculation cost compared to the conventional case. There is.

Then, when the four expression evaluations in the form of Expression 5 are multiplied by an arbitrary element f on F (p ¹² ) using the algorithm shown in FIGS. In FIG. 11, there are three times multiplication of the coefficients in step 1, so that multiplication between elements on F (p ² ) is three times. In FIG. 12, there are four multiplications for the coefficients in steps 1 and 2 and one in step 3, so that there are nine multiplications between elements on F (p ² ). Further, in the case of multiplication between arbitrary elements on F (p ¹² ), multiplication between elements on F (p ² ) is 18 times (the reason is omitted because it is a conventional technique). Therefore, the multiplication between elements on F (p ² ) is 33 times (3 × 2 + 9 + 18). Thus, in operation of the multi-pairing f × _{L 0} included in the calculation processing _{'× ... × L m-1} ', expression evaluation _{L 0 ', L 1',} ..., from the _{L m-1} ' By repeating the process of selecting and multiplying Δ evaluations or less, it is possible to increase operations between elements having zero or a small integer as a coefficient. Therefore, by using expression evaluation in the form of Expression 5, the expression evaluation calculation unit 100 includes an expression evaluation selection unit 110, an expression evaluation multiplication unit 120, an original multiplication unit 130, an operation control unit 140, and an unselected multiplication unit 150. Furthermore, calculation cost can be reduced.

Next, H ₀ '← h ₀ × h ₁ , H ₁ ' ← h ₂ × h ₃ using an expression evaluation of the form of Expression 4
L ”← H ₀ '× H ₁ '
f ← f × L ”
Compared with the method of repeatedly updating f as shown in FIG. FIG. 13 shows an example (Algorithm 6 ′) of a multiplication algorithm in the case of using the expression evaluation in the form of Expression 4 which is the prior art. FIG. 14 shows an example (Algorithm 7 ′) of the element multiplication algorithm obtained in FIG. From the original equation shown in step 6 of FIG. 11, it can be seen that there is one coefficient having a value of zero and one coefficient having a small integer “1”. From the original expression shown in Step 7 of FIG. 13, when the expression evaluation in the form of Expression 4 as the prior art is used, the result of multiplication between the expression evaluations is one coefficient having a value of zero. It can be seen that there is no coefficient of small integer “1”. When the expression evaluation in the form of Expression 4 is used, the calculation of H ₀ ′ × H ₁ ′ is the algorithm shown in FIG. In the algorithm shown in FIG. 13, there are three multiplications between the coefficients in Step 1, so the multiplication between elements on F (p ² ) is three. In the algorithm shown in FIG. 14, there is a multiplication of coefficients 5 times in step 1, 2 times in steps 3, 5, 7, and 9 and 1 time in steps 11 and 13, so F (p ² ) The multiplication between the above elements is 15 times. Accordingly, when four expression evaluations of the form of Expression 4 are multiplied by an arbitrary element f on F (p ¹² ) by the multiplication method shown in FIGS. 13 and 14, the elements on F (p ² ) Multiplication is performed 39 times (3 × 2 + 15 + 18). Therefore, even if the expression evaluation calculation unit 100 does not include the expression evaluation selection unit 110, the expression evaluation multiplication unit 120, the original multiplication unit 130, the calculation control unit 140, and the unselected multiplication unit 150, the calculation is performed by the expression evaluation in the form of Expression 4. Rather than devising a method, expressing the expression evaluation in the form of Expression 5 is more effective in reducing the calculation cost.

[Modification]
Furthermore, as described above, the expression evaluation is as shown in Expression 6.
L _j = α _j y _jP + β _j x _jp w + γ _j vw
In the case of the expression evaluation ^{_{L j '= d j v N}} (A j y jP' + w + B j x jP 'vw)
However, A _j = s _jA (α _j / β _j ), B _j = s _jB (γ _j / β _j )
x _jP '= 1 / (s _jB · x _jP ), y _jP ' = y _jP / (s _jA · x _jP )
If s _jA and s _jB are modified like predetermined constants, the same effect can be obtained. Therefore, the processing flow of the input conversion and the expression evaluation calculation of the multi-pairing arithmetic device shown in FIG. 7 and the multi-pairing arithmetic device shown in FIG. 8 may be as follows. However, A _j and B _j are elements on F (p ² ).

Multi pairing computation device 60, m pieces original _P 0 of the group _{G 1 of,} ..., _{P m-1} and the original _Q 0 of the group _{G 2, ...,} multi-pairing e _(P 0 with _{Q m-1,} Q ₀ ) × e (P ₁ , Q ₁ ) ×... × e (P _m−1 , Q _m−1 ) is obtained. The multi-pairing calculation device 60 is characterized in that the recording unit 90 records the result of the pre-calculation, and includes the input conversion unit 65 and the expression evaluation processing means 70. The expression evaluation processing unit 70 includes an expression evaluation generation unit 80 and an expression evaluation calculation unit 100.

For j = 0,..., m−1, _let A _j = s _jA (α _j / β _j ) and B _j = s _jB (γ _j / β _j ). The recording unit 90 records a _j which is a value having a predetermined relationship with A _j and b _j which is a value having a predetermined relationship with B _j for j = 0,..., M−1. Yes. It is considered most efficient to set a _j = A _j and b _j = B _j . However, other values for _obtaining A _j and B _j without requiring a slow calculation such as multiplication or inverse operation may be recorded as a _j and b _j . Here, the “value having a predetermined relationship” means a value that allows A _j and B _j to be obtained without requiring a low-speed calculation.

The input conversion unit 65 _calculates x _jP '= 1 / (s _jB · x _jP ) and y _jP ' = y _jP / (s _jA · x _jP ) for j = 0,..., _M −1 (S65). ). The expression evaluation generation unit 80 reads a _j and b _j from the recording unit 90 for all of j = 0,..., M−1, and uses a _j and b _j .
L _j '= d _j v ^N (A _j y _jP ' + w + B _j x _jP 'vw)
An expression evaluation L _j ′ is generated as follows (S80). d _{0, ...,} but is _{d m-1 = 1, N} = 0 considered the most efficient ^{_{and, d 0 v N, ...,}} d m-1 v Formula rating was multiplied by ^{_{N L 0 ', L 1'}} , ... , L _m−1 ′ may be generated.

The expression evaluation calculation unit 100 receives f, L ₀ ′, L ₁ ′,..., L _m−1 ′, and outputs a calculation result of f × L ₀ ′ × ... × L _m−1 ′ (S100). . As for the expression evaluation operation unit 100, the expression evaluation operation unit 100 includes an expression evaluation selection unit 110, an expression evaluation multiplication unit 120, an original multiplication unit 130, an operation control unit 140, and an unselected multiplication unit 150, as in the second embodiment. The fact that there is a zero coefficient in the expression evaluation may be used. With this configuration, the same effect as in the second embodiment can be obtained.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 10 Pairing arithmetic unit 15, 65 Input conversion part 20, 70 Formula evaluation processing means 30, 80 Formula evaluation production | generation part 40, 100 Formula evaluation calculation part 50, 90 Recording part 60 Multi-pairing arithmetic unit 110 Formula evaluation selection part 120 Formula Evaluation multiplier 130 Original multiplier 140 Operation controller 150 Unselected multiplier

Claims (7)

A pairing arithmetic unit for obtaining a pairing e (P ₀ , Q ₀ ) between an element P ₀ of group G ₁ and an element Q ₀ of group G ₂ ,
p is a prime number or a power of a prime number, N is a predetermined integer of 0, 1, 2, k is a positive integer, F (p) and F (p ^k ) are finite fields, and P ₀ is a finite field F (P) The point of the elliptic curve on Q, Q ₀ is the point of the elliptic curve on the finite field F (p ¹² ) and is fixed, and T ₀₁ and T ₀₂ are the finite field F (p corresponding to Q ₀ ¹² ) The point of the elliptic curve above, T ₀₁ = (x ₀₁ , y ₀₁ ), T ₀₂ = (x ₀₂ , y ₀₂ ), P ₀ = (x _0P , y _0P ), e is the point P ₀ and the point Q A symbol indicating a pairing operation in which ₀ is input and an element on the finite field F (p ¹² ) is output, f is an element on the finite field F (p ¹² ), L ₀ is a straight line passing through the points T ₀₁ and T ₀₂ expression evaluation was evaluated by _{P 0 a, α 0, β 0, γ} 0, a 0, B 0 and F ^{(p 2)} on the _{original, s 0A} and _{s 0B} predetermined constant, d It was used as a small integer,
The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
And express it as
The expression evaluation L ₀ is
L ₀ = α ₀ y _0P + β ₀ x _0p w + γ ₀ vw
When
A ₀ = s _0A (α ₀ / β ₀ ), B ₀ = s _0B (γ ₀ / β ₀ ),
A recording unit recording a ₀ which is a value having a predetermined relationship with A ₀ and b ₀ which is a value having a predetermined relationship with B ₀ ;
x _0P '= 1 / (s _0B · x _0P ), y _0P ' = y _0P / (s _0A · x _0P );
It reads _{a 0} and _{b 0} from the recording unit, using _{a 0} and _{b 0,}
L ₀ '= d ₀ v ^N (A ₀ y _0P ' + w + B ₀ x _0P 'vw)
An expression evaluation generator that generates an expression evaluation L ₀ ′,
an expression evaluation operation unit that takes f, L ₀ ′ as input and outputs an operation result of f × L ₀ ′;
A pairing operation device comprising: A pairing arithmetic unit for obtaining a pairing e (P ₀ , Q ₀ ) between an element P ₀ of group G ₁ and an element Q ₀ of group G ₂ ,
p is a prime number or a power of a prime number, N is a predetermined integer of 0, 1, 2, k is a positive integer, F (p) and F (p ^k ) are finite fields, and P ₀ is a finite field F (P) The point of the elliptic curve on Q, Q ₀ is the point of the elliptic curve on the finite field F (p ¹² ) and is fixed, and T ₀₁ and T ₀₂ are the finite field F (p corresponding to Q ₀ ¹² ) The point of the elliptic curve above, T ₀₁ = (x ₀₁ , y ₀₁ ), T ₀₂ = (x ₀₂ , y ₀₂ ), P ₀ = (x _0P , y _0P ), e is the point P ₀ and the point Q A symbol indicating a pairing operation in which ₀ is input and an element on the finite field F (p ¹² ) is output, f is an element on the finite field F (p ¹² ), and when the point T ₀₁ and the point T ₀₂ are different, λ ₀ = (y ₀₂ −y ₀₁ ) / (x ₀₂ −x ₀₁ ), and when the point T ₀₁ and the point T ₀₂ are the same, λ ₀ = 3x ₀₁ ² / 2y ₀₁ , d ₀ Is a small integer,
The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
And express it as
(-1 / λ ₀₎ and _{a 0} is a value having a predetermined _{relationship, (- (λ 0 x 01} -y 01) / λ 0) and recording which records _{b 0} is a value having a predetermined relation And
x _0P '= 1 / x _0P , y _0P ' = y _0P / x _0P
It reads _{a 0} and _{b 0} from the recording unit, using _{a 0} and _{b 0,}
L ₀ ′ = d ₀ v ^N ((−1 / λ ₀ ) y _0P ′ + w + (− (λ ₀ x ₀₁ −y ₀₁ ) / λ ₀ ) x _0P ′ vw)
An expression evaluation generator that generates an expression evaluation L ₀ ′,
an expression evaluation operation unit that takes f, L ₀ ′ as input and outputs an operation result of f × L ₀ ′;
A pairing operation device comprising: the m original _P 0 of the group _{G 1 of,} ..., _{P m-1} and the original _Q 0 of the group _{G 2, ...,} multi-pairing _{e (P} 0, _{Q 0)} of _{Q m-1 × e (P} 1 , Q ₁ ) ×... × e (P _m−1 , Q _m−1 )
m is an integer of 2 or more, j is an integer of 0 to m−1, p is a prime number or a power of a prime number, N is an integer of 0, 1, 2, k is a positive integer, and F (p) F (p ^k ) is a finite field, P _j is an elliptic curve point on the finite field F (p), Q _j is an elliptic curve point on the finite field F (p ¹² ), a fixed point, T _j1 and _{T j2} finite F ^{(p 12)} corresponding to _{Q j} points of an elliptic curve _{on, T j1 = (x j1,} y j1), T j2 = (x j2, y j2), P j = ( x _jP , y _jP ), e is a symbol indicating a pairing operation for outputting an element on the finite field F (p ¹² ) with the points P _j and Q _j as inputs, and f is on the finite field F (p ¹² ) original, expression evaluation to a straight line was evaluated by _{P j} through _{L j} the point _{T j1} and the point _{T j2, α j, β j} , γ j, a j, B j and F ^{(p 2)} on the _{original, s jA} And s _{j B} is a predetermined constant, _dj is a small integer,
The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
And express it as
The expression evaluation L _j is
L _j = α _j y _jP + β _j x _jp w + γ _j vw
When
For j = 0,..., m−1, A _j = s _jA (α _j / β _j ), B _j = s _jB (γ _j / β _j ),
for j = 0,..., m−1, a recording unit recording a _j which is a value having a predetermined relationship with A _j and b _j which is a value having a predetermined relationship with B _j ;
an input conversion unit that calculates x _jP '= 1 / (s _jB · x _jP ), y _jP ' = y _jP / (s _jA · x _jP ) for j = 0 _,.
For all of j = 0,..., m−1, a _j and b _j are read from the recording unit, and a _j and b _j are used.
L _j '= d _j v ^N (A _j y _jP ' + w + B _j x _jP 'vw)
An expression evaluation generator for generating an expression evaluation L _j ′,
_{f, L 0 ', L 1} ', ..., and expression evaluation calculation unit 'as _{input, f × L 0' L m} -1 outputs an operation result of _{× ... × L m-1 '} ,
A multi-pairing arithmetic device comprising: the m original _P 0 of the group _{G 1 of,} ..., _{P m-1} and the original _Q 0 of the group _{G 2, ...,} multi-pairing _{e (P} 0, _{Q 0)} of _{Q m-1 × e (P} 1 , Q ₁ ) ×... × e (P _m−1 , Q _m−1 )
m is an integer of 2 or more, j is an integer of 0 to m−1, p is a prime number or a power of a prime number, N is an integer of 0, 1, 2, k is a positive integer, and F (p) F (p ^k ) is a finite field, P _j is an elliptic curve point on the finite field F (p), Q _j is an elliptic curve point on the finite field F (p ¹² ), a fixed point, T _j1 and _{T j2} finite F ^{(p 12)} corresponding to _{Q j} points of an elliptic curve _{on, T j1 = (x j1,} y j1), T j2 = (x j2, y j2), P j = ( x _jP , y _jP ), e is a symbol indicating a pairing operation for outputting an element on the finite field F (p ¹² ) with the points P _j and Q _j as inputs, and f is on the finite field F (p ¹² ) Originally, when the point T _j1 and the point T _j2 are different, λ _j = (y _j2 −y _j1 ) / (x _j2 −x _j1 ), and when the point T _j1 and the point T _j2 are the same, λ _j = 3x _j1 ² / 2y _j1 , d _j is a small integer,
The elements on F (p ¹² ) are the coefficients c ₀ , c ₁ , c ₂ , c ₃ , c ₄ , c ₅ are the elements on F (p ² ), v ³ = ξ, w ² = v, ξ is a square non-residue and a cubic non-residue,
c ₀ + c ₁ v + c ₂ v ² + c ₃ w + c ₄ vw + c ₅ v ² w
And express it as
For j = 0,..., m−1, a _j which is a value having a predetermined relationship with (−1 / λ _j ), and a predetermined relationship with (− (λ _j x _j1 −y _j1 ) / λ _j ) A recording unit that records b _j which is a value having
an input conversion unit for calculating x _jP '= 1 / x _jP , y _jP ' = y _jP / x _jP for j = 0 _,.
For all of j = 0,..., m−1, a _j and b _j are read from the recording unit, and a _j and b _j are used.
^{_{L j '= d j v N}} ((-1 / λ j) y jP' + w + (- (λ j x j1 -y j1) / λ j) x jP 'vw)
An expression evaluation generator for generating an expression evaluation L _j ′,
_{f, L 0 ', L 1} ', ..., and expression evaluation calculation unit 'as _{input, f × L 0' L m} -1 outputs an operation result of _{× ... × L m-1 '} ,
A multi-pairing arithmetic device comprising: The multi-pairing arithmetic device according to claim 3 or 4,
The expression evaluation calculation unit is
An expression evaluation selection unit that selects four of unselected expression evaluations L ₀ ′, L ₁ ′,..., L _m−1 ′ and sets them as h ₀ , h ₁ , h ₂ , h ₃ ;
An expression evaluation multiplier for calculating L ″ ← h ₀ × h ₁ × h ₂ × h ₃ ;
an original multiplier that calculates f ← f × L ″ and updates f;
L ₀ ′, L ₁ ′,..., L _m−1 ′, until the number of expression evaluations not selected by the expression evaluation selection section is less than 4, the expression evaluation selection section and the expression evaluation multiplication And an arithmetic control unit that repeats the processing of the original multiplication unit,
In L ₀ ′, L ₁ ′,..., L _m−1 ′, when there is an expression evaluation not selected by the expression evaluation selection unit, f is multiplied by all the expression evaluations not selected, An unselected multiplier for updating f in the multiplication result;
A multi-pairing arithmetic device characterized in that f is output as an arithmetic result. The multi-pairing arithmetic device according to claim 5,
The expression evaluation multiplication unit
L ₀ '← h ₀ × h ₁ , L ₁ ' ← h ₂ × h ₃
Calculate
L ”← L ₀ '× L ₁ '
A multi-pairing arithmetic device characterized by calculating L ″ as follows.   A program for causing a computer to function as the arithmetic device of any one of the pairing arithmetic device according to claim 1 or 2, and the multi-pairing arithmetic device according to any one of claims 3 to 6.

Images