JP4193176B2 - Elliptic curve integer multiple arithmetic device, and key generation device, encryption device, and decryption device that can use the device - Google Patents

Description

  The present invention relates to an elliptic curve cryptography technique, and more particularly to an elliptic curve integer multiple arithmetic apparatus that performs integer multiple calculations on points on an elliptic curve, and a key generation apparatus, encryption apparatus, and decryption apparatus that can use the apparatus.

  One method of public key cryptography is elliptic curve cryptography (or elliptic cryptography). The elliptic curve cipher is a promising cipher that was proposed by Koblitz and Miller independently around the same time around 1985 and is regarded as a next-generation public key cipher that replaces the RSA cipher. Compared with the RSA cipher, this elliptic curve cipher has a feature that the key size may be a fraction of that of the RSA cipher. However, the problem that the calculation is slower and slower than the secret key cryptography has not been solved. Therefore, methods for speeding up have been studied from various aspects.

Elliptic curve cryptography uses the fact that these points form a group when an appropriate addition is defined between points on an elliptic curve defined on a finite field. If one point P serving as a reference is defined on the elliptic curve and a point obtained by multiplying this by k is Q = kP, even if Q is given, it is difficult to obtain k from this point of view. This is called the difficulty of the discrete logarithm problem on an elliptic curve. Elliptic curve cryptography is a cryptography that uses this property, and to use elliptic curve cryptography, it is necessary to multiply points by k. The conventional k multiplication method is a binary method by a combination of doubling and addition (so-called “double-and-add”). This method requires log ₂ k times doubling and average (1/2) log ₂ k times addition. There is an m-adic system as an improved method of this. Where m is a power of two ^{2 r.} Further, there are a signed method using a combination of addition and subtraction, a moving window method, and the like (for example, see Non-Patent Document 1).
Ian F. Brake, Gadiel Cello, Nigel P. Smart, translated by Jiro Suzuki, “Elliptic Curve Cryptography”, first edition, Pearson Education, December 20, 2001

  Elliptic curve cryptography has the advantage that the key size may be smaller than RSA cryptography, which is the current mainstream of public key cryptography, but has the disadvantage of slow encryption and decryption processing. Generally, since a large number is used in public key cryptography, computation in a finite field always takes computation time and processing is slow. The problem of the amount of calculation is a serious problem that cannot be avoided when the cryptographic system is put into practical use, and in order to further improve the practicality of elliptic curve cryptography, further improvement in calculation speed is required.

  The present invention has been made in view of such a situation, and an object of the present invention is to provide an elliptic curve integer multiple arithmetic device capable of realizing high-speed elliptic curve cryptography, as well as a key generation device and encryption device that can use the device. An apparatus and a decoding apparatus are provided.

  One embodiment of the present invention relates to an elliptic curve integer multiple arithmetic apparatus. This apparatus performs an integer multiple operation kP of an arbitrary point P on an elliptic curve, and obtains an s-adic expansion unit for obtaining an s-adic expansion by a plurality of bases s for the integer k, and each of the plurality of bases s A cost evaluation unit that evaluates the calculation cost of the s-adic system that calculates the k-fold point Q of the point P by a combination of s multiplication and addition; A selection unit that selects one radix h, and an h-adic operation that calculates a k-fold point Q of the point P by a combination of h-multiplication and addition based on the h-adic expansion of the integer k by the selected radix h Part.

  Another aspect of the present invention relates to a key generation apparatus. The apparatus calculates an d-multiplier point Q of the base point G, an input unit that receives input of the base point G on the elliptic curve and its order n, a random number generator that generates a random number d that satisfies 0 <d <n, and And an integer multiple operation unit that generates the random number d as a secret key and the key generation unit that generates the d multiple point Q as a public key. As the integer multiplication unit, the elliptic curve integer multiplication unit of the above aspect is used.

  Yet another embodiment of the present invention relates to an encryption device. The apparatus includes an input unit that receives input of a base point G on an elliptic curve, its order n, public key Q, and plaintext M, a random number generation unit that generates a random number r satisfying 0 <r <n, and the base point The first cipher C1 = rG and the second cipher C2 = using an r multiple point rG of G, an integer multiple arithmetic unit for calculating the r multiple point rQ of the public key Q, and a calculation result by the integer multiple arithmetic unit and a ciphertext generation unit that calculates rQ + M and generates ciphertexts (C1, C2). As the integer multiplication unit, the elliptic curve integer multiplication unit of the above aspect is used.

  Yet another embodiment of the present invention relates to a decoding apparatus. This apparatus calculates a secret key d and an input unit that accepts input of ciphertext (C1, C2) including the first cipher C1 and the second cipher C2 using an elliptic curve, and a d-multiplier point dC1 of the first cipher C1. A plaintext that generates a decrypted plaintext M by subtracting the d-multiplied point dC1 of the first cipher C1 from the second cipher C2 using the integer multiple arithmetic unit that performs the calculation and the calculation result by the integer multiple arithmetic unit And a generation unit. As the integer multiplication unit, the elliptic curve integer multiplication unit of the above aspect is used.

  It should be noted that any combination of the above-described constituent elements and a representation of the present invention converted between a method, apparatus, server, system, computer program, recording medium, etc. are also effective as an aspect of the present invention.

  According to the present invention, it is possible to increase the speed of integer multiplication of an arbitrary point on an elliptic curve.

  Hereinafter, the present invention will be described based on preferred embodiments. First, the theory that is the basis of the embodiment will be described as a prerequisite technology, and then a specific embodiment will be described.

[Prerequisite technology]
[1] Overview The present invention relates to speeding up operations in point groups of elliptic curves on a finite field. The basic technology of the embodiment of the present invention is that a ternary system combining addition and triple multiplication is added to the conventional binary system combining point addition and doubling, and addition is generalized. And h multiplication (h> 2) combined with h multiplication and at least two s decimals (s ≧ 2) are selectively used together to reduce the amount of calculation and thereby ellipse Speed up curve cryptography.

[2] Elliptic curve This will be explained using the description in Chapter 6 of Kobritz, Translated by Hayashi Hayashi, “Algebraic Theory of Cryptography” (Springer Fairlark Tokyo, October 1999) as appropriate.
[2.1] The elliptic curve E on the elliptic curve equation body F is a curve given by an equation of the following form.
Y ² + a ₁ XY + a ₃ Y = X ³ + a ₂ X ² + a ₄ X + a ₆ , a _i ∈F (1)
E (F) represents a set of points (x, y) εF ² satisfying this equation and “infinity point” expressed as O. If K is an extension of F, E (K) represents a set of (x, y) εK ² and O satisfying equation (1). In order for curve (1) to be an elliptic curve, it must be smooth. This means that both no point 0 to become such E (F ^¯) both partial derivative of (F ^¯ represents the algebraic closure of F). In other words, two equations _{^{a 1 Y = 3X 2 + 2a}} 2 X + a 4, 2Y + a 1 X + a 3 = 0 (2)
Are not simultaneously satisfied by any (x, y) εE (F ^￣ ).

  The set E (F) forms an abelian group whose unit element is O. For any extension field K of F, the set E (K) forms an abelian group whose unit element is O.

The elliptic curve used for elliptic curve cryptography is defined on a finite field F _q (sometimes written as GF (q)). The equation of the elliptic curve is different depending on the difference of characteristic p of F _q, below, p = 2, p = 3, p> for the case of 3 of each to be handled separately.

[2.2] When characteristic p = 2 In the case of non-super singularity This is the case where the left side of the formula (1) is Y ² + a ₁ XY, and a ₁ = 1 can be set without loss of generality, and the equation of the elliptic curve E can be given as follows: .
Y ² + XY = X ³ + a ₂ X ² + a ₆ , a ₂ , a ₆ εF. (3)
2. Case of super singularity This is a case where the equation of the elliptic curve E can be given as follows.
Y ² + a ₃ Y = X ³ + a ₄ X + a ₆ , a ₃ , a ₄ , a ₆ εF. (4)

[2.3] Case of characteristic 3 An equation of an elliptic curve E on a field F of characteristic 3 is given as follows.
Y ² = X ³ + a ₂ X ² + a ₄ X + a ₆ , a ₂ , a ₄ , a ₆ εF. (5)

[2.4] Case of characteristic p ≠ 2, 3 If the characteristic curve of F is neither 2 nor 3, the elliptic curve E on the field F is given by the following equation without loss of generality.
Y ² = X ³ + aX + b, a, bεF, charF ≠ 2,3. (6)
However, the discriminant of X ³ + aX + b− (4a ³ + 27b ² ) ≠ 0.

[2.5] It has been mentioned earlier that the additive rule set E (F) forms an Abelian group whose unit element is O. The operations in this group are given by the following addition law. Here, the story proceeds as an elliptic curve on the real field R so that a geometric image can be easily generated.

Definition Let E be an elliptic curve on the real field given by equation (6), and let P and Q be two points on E. Define the negative and sum P + Q of P according to the following rules:
1) If P is an infinite point O, -P is defined as O. For any point Q, O + Q is defined as Q. That is, O serves as an additive unit element (“zero element”) of a group of points. In the following, it is assumed that neither P nor Q is an infinite point.
2) Negative -P is a point where the x coordinate is the same as P and the y coordinate is the opposite sign. That is,-(x, y) = (x, -y). If (x, y) is on the curve, it is clear from equation (6) that (x, -y) is also on the curve. If Q = −P, define P + Q as the infinity point O.
3) If P and Q have different x-coordinates, the straight line l = PQ (a straight line connecting two points P and Q) intersects the curve at exactly another point R (if the straight line l is P in the curve) If it touches, R = P or Q touches if R = Q, but not otherwise). At this time, P + Q is defined as -R, that is, a mirror image (with respect to the x-axis) of the third intersection.
4) The last possibility is P = Q. At this time, the straight line 1 is defined as tangent to the curve at P, and R is defined as 2P = −R, where R is the only other intersection of the curve and the curve. (If the tangent is P and has a “double tangent”, in other words, if P is the inflection point, take R as P.)

The above rule set can be briefly summarized as follows:
The sum of the three points where the straight line intersects the curve is zero.

If the straight line passes through the infinity point O, this relationship has the form P + P ^~ + O = O (where P and P ^~ are symmetric points), i.e. P ^~ = -P. Otherwise, it has the form P + Q + R = O. However, P, Q and R are the three points of rule 3) or 4).

(X ₁ , y ₁ ), (x ₂ , y ₂ ), and (x ₃ , y ₃ ) represent the coordinates of P, Q, and P + Q, respectively. I want to express x ₃ and _{y 3} at _{x 1, y 1, x 2} , y 2. In the case of rules 3) and 4) in the definition of P + Q above, the equation of the straight line l is y = λx + ν.
When P ≠ Q (addition formula)
x ₃ = λ ² − (x ₁ + x ₂ )
y ₃ = λ (x ₁ −x ₃ ) −y ₁
λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ) (7)
In the case of P = Q (double point formula)
Same as P ≠ Q except that λ is the value of the derivative dy / dx at P. The equation for the coordinates of the double point of P is as follows.
x ₃ = λ ² -2x ₁
y ₃ = λ (x ₁ −x ₃ ) −y ₁
λ = (3x ₁ ² + a) / (2y ₁ ) (8)

  The notation nP represents adding P itself n times if n is positive, and adding -P itself | n | times if n is negative.

[2.6] Calculation amount of addition Consider the calculation cost of P + Q = (x ₃ , y ₃ ). Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of multiplication and inverse operation are represented by M and I, respectively. Note that the cost of squaring is represented by S, but in many cases, the cost of squaring and multiplication can be considered to be almost the same, so here an equation with S≈M is also shown.

When P ≠ Q Calculation of λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ):
The cost I of the inverse operation for the calculation of (x ₂ −x ₁ ) ^−1.
Multiplication cost M for the calculation of multiplying y ₂ −y ₁ by this.
2. Calculation of x ₃ = λ ² − (x ₁ + x ₂ ):
cost S ≒ M of squaring to λ ² of the calculation.
3. Calculation of y ₃ = λ (x ₁ −x ₃ ) −y ₁ :
Multiplication cost M for the calculation of λ multiplied by x ₁ −x ₃ .
Total cost t _A = 1I + 2M + S≈1I + 3M. The subscript _A of t _A is intended to be an addition.

When P = Q Calculation of λ = (3x ₁ ² + a) / (2y ₁ ):
The cost I of the inverse operation for the calculation of (2y ₁ ) ^−1.
The cost of squaring S≈M for the calculation of x ₁ ² .
Multiplication cost M for the calculation of (2y ₁ ) ⁻¹ multiplied by this.
2. Calculation of x ₃ = λ ² −2x ₁ :
cost S ≒ M of squaring to λ ² of the calculation.
3. Calculation of y ₃ = λ (x ₁ −x ₃ ) −y ₁ :
Multiplication cost M for the calculation of λ multiplied by x ₁ −x ₃ .
The total cost t _D = 1I + 2M + 2S≈1I + 4M. Subscript D of The _{t D} is the intention of Doubling (2 multiplication).

In summary summary, the computational cost of P + Q in F _q are as follows. However, the characteristic of F _q is p> 3, and the affine coordinate system is used for the calculation.
In the case of general addition, the calculation amount t _A = 1I + 2M + S≈. 1I + 3M
In the case of doubling, the calculation amount t _D = 1I + 2M + 2S = t _A + 1S≈t _A + 1M

[3] Triple point formula Our method uses point triples. Therefore, we would like to express the coordinates of the triple point 3P = (x _t , y _t ) with the coordinates of P = (x ₁ , y ₁ ).
[3.1] Derivation of triple point formula First, double point P _d = 2P = 2 (x ₁ , y ₁ ) = (x _d , y _d ) is obtained.
x _d = λ ² −2x ₁
y _d = λ (x ₁ −x _d ) −y ₁
λ = (3x ₁ ² + a) / (2y ₁ ) (9)

Then determine the triple point as 3P = _P + P _d. The coordinates of P triple point 3P = (x _t , y _t ) are given by In Expression (7), x ₁ , y ₁ , x ₂ , y ₂ , x ₃ , y ₃ , and λ are replaced with x ₁ , y ₁ , x _d , y _d , x _t , y _t , and μ, respectively. Still further, the substituted first equation of the formula (9) x _d on the right side of the equation of x _t.
x _t = μ ² − (x ₁ + x _d )
= Μ ² −λ ² + x ₁
y _t = μ (x ₁ −x _t ) −y ₁
μ = (y _d −y ₁ ) / (x _d −x ₁ ) (10)
= {Λ (x ₁ −x _d ) −y ₁ −y ₁ } / (λ ² −2x ₁ −x ₁ )
= {Λ (x ₁ −λ ² + 2x ₁ ) −2y ₁ } / (λ ² −3x ₁ )
= -Λ-2y ₁ / (λ ² -3x ₁ ) (11)

Triple point formula: Summary x _t = μ ² −λ ² + x ₁
y _t = μ (x ₁ −x _t ) −y ₁
λ = (3 × ₁ ² + a) / (2y ₁ ), μ = −λ−2y ₁ / (λ ² −3x ₁ ) (12)

[3.2] Application example of binary system and ternary system [Example: Calculation of 100P]
100 = 1100100 ₍₂₎ = 10201 ₍₃₎
In case of binary system 1) 2P + P = 3P
0) 2 (3P) = 6P
0) 2 (6P) = 12P
1) 2 (12P) + P = 25P
0) 2 (25P) = 50P
0) 2 (50P) = 100P
In case of ternary system 0) 3P
2) 3 (3P) + 2P = 11P
0) 3 (11P) = 33P
1) 3 (33P) + P = 100P

[3.3] Calculation amount of triple calculation Consider the cost of triple calculation of point P, that is, calculation to obtain 3P. Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of multiplication and inverse operation are represented by M and I, respectively. In addition, although the cost of squaring is represented by S, here, an equation of S≈M is also shown.
1. Calculation of λ = (3x ₁ ² + a) / (2y ₁ ):
The cost I of the inverse operation for the calculation of (2y ₁ ) ^−1.
The cost of squaring S≈M for the calculation of x ₁ ² .
Multiplication cost M for the calculation of (2y ₁ ) ⁻¹ multiplied by this.
2. cost S ≒ M of squaring to λ ² of the calculation.
3. Calculation of μ = −λ−2y ₁ / (λ ² −3x ₁ ):
The cost I of the inverse element calculation for the calculation of (λ ² −3 × ₁ ) ^−1.
This costly M of multiplication to calculate multiplying the 2y _1.
4). μ ² of the calculation:
The cost of squaring S≈M.
5. calculation of y _t:
Multiplication cost M for the calculation of μ multiplied by x ₁ −x _t .
The total cost t _T = 2I + 3M + 3S≈2I + 6M = 2t _A. Subscript T here is _{t T} is the intention of Tripling (3 multiplication). Note the Request 3P by adding P from seeking 2P, computing the amount it is to be noted that _{t T '= t A + t} D = 2t A + 1S = t T + 1M. Therefore, the amount of calculation can be saved by using the triple formula.

[4] Computation amount of k multiplication: When characteristic p> 3 Compare the computation amount when using the doubling formula and when using the triple formula.

[4.1] Binary system and its calculation amount: When characteristic p> 3 Input: Point P and integer k
Output: Point Q = kP
algorithm:
1. k is expanded in binary. k = k _l−1 k _l−2 ... k ₁ k _{0 (2)} . However, l (el) is the number of bits of k and k _l−1 = 1.
2. The following is performed for j = 1−2,.
(2a) Q ← 2Q
(2b) If k _j = 1, Q ← Q + P

Binary computational complexity:
1. The cost of binary expansion is ignored.
2. Since (2a) is doubled, the amount of calculation is t _D = t _A + 1S.
2. Since (2b) is a general addition, the amount of calculation is t _A = 1I + 2M + 1S.

Meanwhile doubling the l-1 times, addition is because performing w-1 times, the amount of calculation t ₂ of kP by binary is as follows. However, w is a Hamming weight (that is, the number of non-zero digits) in the binary expansion of k.
t ₂ = (l−1) t _D + (w−1) t _A
= (L-1) (t _A + 1S) + (w-1) t _A
= (L + w-2) t _A + (l-1) S
= (L + w-2) I + (2l + 2w-4) M + (2l + w-3) S
≒ (l + w-2) I + (4l + 3w-7) M (13)
l is determined only by the number of bits of k, but w can be from w = 1 to w = 1. Therefore, (l−1) (t _A + S) ≦ t ₂ ≦ (l−1) (2t _A + S) (14)
t _A + S ≦ t ₂ / (l−1) ≦ 2t _A + S (15)
It is. Also the w = l / 2 as an average, if ^{_{l»1 t 2 ¯ = (l /}} 2) (3t A + 2S) (16)
If t _A = 1I + 2M + S and S≈M, then t ₂ ^＝= (l / 2) (3I + 11M) (17)
Here typically I = 3M if _t ² ¯ = _10lM, the I = 11M if _t ² ¯ = _22lM.

[4.2] Ternary system and its calculation amount: When characteristic p> 3 Input: Point P and integer k
Output: Point Q = kP
algorithm:
0. P _d = 2P is calculated and stored in advance.
1. Expand k in ternary. k = h _i-1 h _i-2 ... h ₁ h _{0 (3)} . However, i is the number of ternary digits of k, and h _i-1 > 0.
2. If h _i-1 = 1, Q ← P, and if h _i-1 = 2, Q ← _Pd and j = i−2,.
(2a) Q ← 3Q
(2b) If h _j = 1, Q ← Q + P
(2c) If h _j = 2 then Q ← Q + P _d

Ternary computational complexity:
0. The cost of the preliminary calculation of P _d = 2P is ignored.
1. The cost of ternary expansion is ignored.
2. Since (2a) is triple, the amount of calculation is t _T = 2I + 3M + 3S≈2t _A.
2. Since (2b) and (2c) are general additions, the amount of calculation is t _A = 1I + 2M + 1S.

Incidentally 3 multiplication is i-1 times, addition is because performing w-1 times, the amount of calculation t ₃ of kP by ternary method is as follows. However, w is a Hamming weight (that is, the number of non-zero digits) in the ternary expansion of k.
t ₃ = (i−1) t _T + (w−1) t _A
= (I-1) (2I + 3M + 3S) + (w-1) (1I + 2M + 1S)
= (2i + w-3) I + (3i + 2w-5) M + (3i + w-4) S
≒ (2i + w-3) (1I + 3M) ≒ (2i + w-3) t _A (18)
i is determined only by the number of ternary digits of k, but w can be from w = 1 to w = i. Therefore, using the approximation of t ₃ ≈ (2i + w−3) t _A ,
2 (i-1) t _A ≤t ₃ ≤3 (i-1) t _A (19)
2t _A ≦ t3 / (i−1) ≦ 3t _A (20)
It is. Also the w = 2i / 3 as an average, t ₃ ^¯ if _{i»1 = (8i / 3) t} A (21)
If t _A = 1I + 2M + S and S≈M, then t ₃ ^＝= (8i / 3) (1I + 3M) (22)
Here typically I = 3M if _t ³ ¯ = _16iM, the I = 11M if ^{_{t 3 ¯ = (112i / 3}} ) M.

[5] estimated amount of calculation t ₂ and t ₃ of k multiplication by binary and binary up speed this by selecting the ternary and ternary. Which of the two is smaller depends on the weights w ₂ and w ₃ when k is expanded, that is, the number of non-zero digits. Therefore, when k is given, this is first expanded in binary and ternary systems, and either binary or ternary system is selected according to the magnitude relationship between t ₂ and t ₃ to increase the speed. It is considered possible.

[5.1] compared the average value of the comparison the average value of the binary and ternary computational _{t 3} ^¯ and _{t 2} ^¯ ratio ^{_{t ¯ = t 3 ¯ / t}} 2 ¯ formula (22), (17 ) Is as follows.
^{_{t ¯ = t 3 ¯ / t}} 2 ¯ = 16i (1I + 3M) / {3l (3I + 11M)}
= 16i (d + 3) / {3l (3d + 11)} (23)
However, d = I / M is the ratio of the calculation time of inverse operation and multiplication. Therefore, the condition of d = I / M where t ^￣ <1 will be obtained. When c = 1 / i = log ₂ 3 = 1.585, d = I / M <(33c−48) / (16−9c) = 2.480 (24)
It is. That is, when I <2.480M, t ₃ ^￣ <t ₂ ^￣ .

Comparison t ₃ and the ratio _{t =} t 3 / _{t 2} of _{t 2} in the case of the general formula (13), is as follows: by (18). However, w ₂ ′ = w ₂ / l and w ₃ ′ = w ₃ / i are relative weights.
t = t ₃ / t ₂
= (2i + w ₃ -3) (d + 3) / {(l + w ₂ -2) d + 4l + 3w ₂ -7}
_{= {(2 + w 3 '} -3c / l) (d + 3) / c} / {(1 + w 2' -2 / l) d + 4 + 3w 2 '-7 / l} (25)
Usually, l is sufficiently large, so if the 1 / l term is omitted in the above equation, t = {(2 + w ₃ ′) (d + 3) / c} / {(1 + w ₂ ′) d + 4 + 3w ₂ ′} (26)
If the condition regarding w ₂ ′, w ₃ ′, and d where t <1 is obtained in Expression (26), the number k satisfying t ₃ <t ₂ can be obtained. However, d is a predetermined number. Using the approximation of equation (26)
_{w 3 '<cw 2' -} {(2-c) d + 6-4c} / (d + 3) (27)
It becomes.

Here, the above condition is obtained for a typical value of d.
For d = 3:
To satisfy t <1, w ₃ ′ <cw ₂ ′ + (7/6) c−2 = 1.585 w ₂ ′ −0.1509 (28)
Must. However, considering 0 <w ₂ ′ and w ₃ ′ ≦ 1, the condition for t <1 is the condition Ter
0.0952 <w ₂ ′ <0.7261 (29)
And Formula (28) is materialized. (30)

When d = 11:
To satisfy t <1, w ₃ ′ <cw ₂ ′ + (15/14) c−2 = 1.585 w ₂ ′ −0.3018 (31)
Must. Considering 0 <w ₂ ′, w ₃ ′ ≦ 1, the condition for t <1 is the condition Ter
0.190 <w ₂ ′ <0.8213 (32)
And Formula (31) is formed. (33)

[5.2] Proposed method-Selective binary / ternary system Input: Point P and integer k
Output: Point Q = kP
algorithm:
1. k is expanded in binary and ternary. The number of digits l and i, the weights w ₂ and w ₃ , and the relative weights w ₂ ′ and w ₃ ′ are obtained.
2. (2a) If the condition Ter is satisfied, a ternary calculation is performed.
(2b) If the condition Ter is not satisfied, the calculation by the binary system is performed.

[5.3] Examples of computational complexity in binary and ternary systems [Example 1: Calculation of 100P]
100 = 1100100 ₍₂₎ = 10201 ₍₃₎
In case of binary system, the column of doubling D and addition A is DADDDDADD.
t ₂ = 2t _A + 6t _D = 2 (1,2,1) +6 (1,2,2) = (8, 16, 14). However, the cost is represented by (I, M, S).
In the case of the ternary system, the column of triple T and addition A is TTATTA,
_{t 3 = 2t A + 4t T} = 2 (1,2,1) +4 (2,3,3) = a (10,16,14).
In this example, the ternary system has more inverse operations twice.

[Example 2: Calculation of 90P]
90 = 10111010 ₍₂₎ = 10100 ₍₃₎
In case of binary system, the column of doubling D and addition A is DDADADDAD.
t ₂ = 3t _A + 6t _D = 3 (1,2,1) +6 (1,2,2) = (9, 18, 15).
In the case of the ternary system, the column of triple T and addition A is TTATT.
t ₃ = 2t _A + 4t _T = (1,2,1) +3 (2,3,3) = (7, 11, 10).
In this example, when the square operation is regarded as multiplication, the ternary system has two inverse elements and 12 multiplications less. When the reduction rate of the calculation amount is expressed by δ = (t ₂ −t ₃ ) / t ₃ , δ = 30% when d = I / M = 3, and δ = 25% when d = I / M = 11. Become.

[6] Elliptic curve: in the case of characteristic 3 The equation of elliptic curve E on the field F of characteristic 3 is given as follows.
Y ² = X ³ + a ₂ X ² + a ₄ X + a ₆ , a ₂ , a ₄ , a ₆ εF. (34)

[6.1] Additive formula: In the case of characteristic 3, (x ₁ , y ₁ ), (x ₂ , y ₂ ), (x ₃ , y ₃ ) represent the coordinates of P, Q, and P + Q, respectively, as before. . I want to express x ₃ and _{y 3} at _{x 1, y 1, x 2} , y 2.
When P ≠ Q (addition formula)
x ₃ = λ ² −a ₂ − (x ₁ + x ₂ )
y ₃ = λ (x ₁ −x ₃ ) −y ₁
λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ) (35)

In the case of P = Q (double point formula)
Same as P ≠ Q except that λ is the value of the derivative dy / dx at P. The equation for the coordinates of the double point of P is as follows.
x ₃ = λ ² −a ₂ −2x ₁ = λ ² −a ₂ + x ₁
y ₃ = λ (x ₁ −x ₃ ) −y ₁
λ = (3 × ₁ ² + 2a ₂ x ₁ + a ₄ ) / (2y ₁ ) = (a ₂ x ₁ −a ₄ ) / y ₁ (36)
Note that (x ₃ , y ₃ ) in this case may be expressed as (x _d , y _d ) in order to clearly indicate that the coordinates are double points.

Triple point formula P = (x ₁ , y ₁ ), 2P = (x _d , y _d ), 3P = (x _t , y _t ), triple point 3P = (x _t , y _t ) = (x ₁ , y ₁ ) + (x _d , y _d ) is obtained. The 3P coordinates are given by
x _t = μ ² −λ ² + x ₁
y _t = μ (x ₁ −x _t ) −y ₁
λ = (a ₂ x ₁ −a ₄ ) / y ₁ , μ = −λ + y ₁ / (λ ² −a ₂ ) (37)

[6.2] Calculation amount of addition: in case of characteristic 3 Consider the calculation cost of P + Q = (x ₃ , y ₃ ). Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of squaring, multiplication, and inverse operation are represented by S, M, and I, respectively.
When P ≠ Q Calculation of λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ):
The cost I of the inverse operation for the calculation of (x ₂ −x ₁ ) ^−1.
Multiplication cost M for the calculation of multiplying y ₂ −y ₁ by this.
2. Calculation of x ₃ = λ ² −a ₂ − (x ₁ + x ₂ ):
cost S. of squaring to λ ² of the calculation
3. Calculation of y ₃ = λ (x ₁ −x ₃ ) −y ₁ :
Multiplication cost M for the calculation of λ multiplied by x ₁ −x ₃ .
Total cost t _A = 1I + 2M + 1S. The subscript _A of t _A is intended to be an addition.

When P = Q Calculation of λ = (a ₂ x ₁ −a ₄ ) / y ₁ :
Cost I of the inverse operation for the calculation of y ₁ ^−1.
Multiplication cost M for calculating a ₂ x ₁ -a ₄ .
Multiplication cost M for the calculation of multiplying this by y ₁ ⁻¹ .
2. Calculation of x ₃ = λ ² −a ₂ + x ₁ :
cost S. of squaring to λ ² of the calculation
3. Calculation of y ₃ = λ (x ₁ −x ₃ ) −y ₁ :
Multiplication cost M for the calculation of λ multiplied by x ₁ −x ₃ .
Total cost t _D = 1I + 3M + 1S. Subscript D of The _{t D} is the intention of Doubling (2 multiplication).

Summary In summary, the calculation cost of P + Q in the finite field _Fq of characteristic 3 is as follows. The affine coordinate system is used for the calculation.
In the case of general addition, the calculation amount t _A = 1I + 2M + 1S
In the case of doubling, the calculation amount t _D = 1I + 3M + 1S = t _A + 1M
Note that in the case of M≈S, the calculation amount is the same as in the case of characteristic> 3.

[6.3] Calculation amount of triple calculation Consider the cost of triple calculation of point P, that is, the calculation for obtaining 3P. Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of multiplication and inverse operation are represented by M and I, respectively. Note that the cost of squaring is represented by S, where S≈M.
1. Calculation of λ = (a ₂ x ₁ −a ₄ ) / y ₁ :
As before, the cost is 1I + 2M.
2. Calculation of μ = −λ + y1 / (λ ² −a ₂ ):
cost S. of squaring to λ ² of the calculation
The cost I of the inverse operation for the calculation of (λ ² −a ₂ ) ^−1.
Multiplication cost M for the calculation of multiplying this by y = 1.
3. calculation of x _t:
Cost S. of squaring the mu ² calculations
4). calculation of y _t:
Multiplication cost M for the calculation of μ multiplied by x ₁ −x _t .
Total cost t _T = 2I + 4M + 2S = 2t _A. Note that in the case of M≈S, the calculation amount is the same as in the case of characteristic> 3. Note If by adding P from seeking 2P seek 3-Way, calculated weight of _{t T '= t A + t} D = 2t A + M = t T + M, this relationship is the same as for the standard number of> 3 Note that there are.

[7] Computation amount of k multiplication: In case of characteristic 3, the computation amount when using the doubling formula is compared with that when using the doubling formula.

[7.1] Binary method and its calculation amount: In case of characteristic 3 Input: Point P and integer k
Output: Point Q = kP
algorithm:
1. k is expanded in binary. k = k _l−1 k _l−2 ... k ₁ k _{0 (2)} . However, l is the number of bits of k, and k _l−1 = 1.
2. With Q = 0, the following is performed for j = l−1,.
(2a) Q ← 2Q
(2b) If k _j = 1, Q ← Q + P

Binary computational complexity:
1. The cost of binary expansion is ignored.
2. Since (2a) is doubled, the amount of calculation is t _D = t _A + 1S.
2. Since (2b) is a general addition, the amount of calculation is t _A = 1I + 2M + 1S.

Meanwhile doubling the l-1 times, addition is because performing w-1 times, the amount of calculation t ₂ of kP by binary is as follows.
t ₂ = (l−1) t _D + (w−1) t _A
= (L-1) (t _A + 1M) + (w-1) t _A
= (L + w-2) t _A + (l-1) S
= (L + w-2) I + (3l + 2w-5) M + (l + w-2) S
≒ (l + w-2) I + (4l + 3w-7) M (38)
l is determined only by the number of bits of k, but w can be from w = 1 to w = 1. Therefore, (l−1) (t _A + M) ≦ t ₂ ≦ (l−1) (2t _A + M) (39)
t _A + M ≦ t ₂ / (l−1) ≦ 2t _A + M (40)
It is. Also the w = l / 2 as an average, if ^{_{l»1 t 2 ¯ = (l /}} 2) (3t A + 2M) (41)
If t _A = 1I + 2M + S and S≈M, then t ₂ ^＝= (l / 2) (3I + 11M) (42)
Here typically I = 3M if _t ² ¯ = _10lM, the I = 11M if _t ² ¯ = _22lM.

[7.2] ternary system and its calculation amount: in the case of characteristic 3 Input: point P and integer k
Output: Point Q = kP
algorithm:
0. P _d = 2P is calculated and stored in advance.
1. Expand k in ternary. k = h _i-1 h _i-2 ... h ₁ h _{0 (3)} . However, i is the number of ternary digits of k, and h _i-1 > 0.
2. The following is performed for j = i−1,.
(2a) Q ← 3Q
(2b) If i _j = 1, Q ← Q + P
(2c) If i _j = 2 then Q ← Q + P _d

Ternary computational complexity:
0. The cost of the preliminary calculation of P _d = 2P is ignored.
1. The cost of ternary expansion is ignored.
2. Since (2a) is triple, the amount of calculation is t _T = 2I + 4M + 2S = 2t _A.
2. Since (2b) and (2c) are general additions, the amount of calculation is t _A = 1I + 2M + 1S.

Incidentally 3 multiplication is i-1 times, addition is because performing w-1 times, the amount of calculation t ₃ of kP by ternary method is as follows.
t ₃ = (i−1) t _T + (w−1) t _{A
= (I-1) 2t A} + (w-1) t A = (2i + w-3) t A
= (2i + w-3) (1I + 2M + 1S) (43)
i is determined only by the number of ternary digits of k, but w can be from w = 1 to w = i.
2 (i-1) t _A ≤t ₃ ≤3 (i-1) t _A (44)
2tA ≦ t ₃ / (i−1) ≦ 3t _A (45)
It is. Also the w = 2i / 3 as an average, t ₃ ^¯ if _{i»1 = (8i / 3) t} A (46)
If t _A = 1I + 2M + S and S≈M, then t ₃ ^￣ = (8i / 3) (1I + 3M) (47)
Here typically I = 3M if _t ³ ¯ = _16iM, the I = 11M if ^{_{t 3 ¯ = (112i / 3}} ) M.

[7.3] estimated amount of calculation t ₂ and t ₃ of k multiplication by binary and binary up speed this by selecting the ternary and ternary. Which of the two is smaller depends on the weights w ₂ and w ₃ when k is expanded, that is, the number of non-zero digits. Therefore, when k is given, this is first expanded in binary and ternary systems, and either binary or ternary system is selected according to the magnitude relationship between t ₂ and t ₃ to increase the speed. It is considered possible.

[7.4] Comparison of binary and ternary calculation amount Comparison of average values (results are the same as in characteristic 3)
Mean value _{t 3} ^¯ and _{t 2} ^¯ ratio ^{_{t ¯ = t 3 ¯ / t}} 2 ¯ formula (42), is as follows: by (47).
^{_{t ¯ = t 3 ¯ / t}} 2 ¯ = 16i (1I + 3M) / {3l (3I + 11M)}
= 16i (d + 3) / {3l (3d + 11)} (48)
Therefore, when the condition of d = I / M where t ^￣ <1 is obtained and c = 1 / i = log ₂ 3 = 1.585 is used, d = I / M <(33c−48) / (16−9c) = 2.480 (49)
It is. That is, when I <2.480M, t ₃ ^￣ <t ₂ ^￣ .

Comparison in the general case (result is the same as characteristic 3)
The ratio t = t ₃ / t ₂ between t ₃ and t ₂ is as follows according to equations (38) and (43). However, w ₂ ′ = w ₂ / l and w ₃ ′ = w ₃ / i are relative weights.
t = t ₃ / t ₂
= (2i + w ₃ -3) (d + 3) / {(l + w ₂ -2) d + 4l + 3w ₂ -7}
_{= {(2 + w 3 '} -3c / l) (d + 3) / c} / {(1 + w 2' -2 / l) d + 4 + 3w 2 '-7 / l} (50)
Usually, l is sufficiently large, so if the 1 / l term is omitted in the above equation, t = {(2 + w ₃ ′) (d + 3) / c} / {(1 + w ₂ ′) d + 4 + 3w ₂ ′} (51)
If the condition regarding w ₂ ′, w ₃ ′, and d where t <1 is obtained in Expression (51), the number k satisfying t ₃ <t ₂ can be obtained. However, d is a predetermined number. Using the approximation of equation (51),
_{w 3 '<cw 2' -} {(2-c) d + 6-4c} / (d + 3) (52)
It becomes.

Here, the above condition is obtained for a typical value of d.
For d = 3:
To satisfy t <1, w ₃ ′ <cw ₂ ′ + (7/6) c−2 = 1.585 w ₂ ′ −0.1509 (53)
Must. However, considering 0 <w ₂ ′ and w ₃ ′ ≦ 1, the condition for t <1 is the condition Ter
0.0952 <w ₂ ′ <0.7261 (54)
And Formula (53) is materialized. (55)

When d = 11:
To satisfy t <1, w ₃ ′ <cw ₂ ′ + (15/14) c−2 = 1.585 w ₂ ′ −0.3018 (56)
Must. Considering 0 <w ₂ ′, w ₃ ′ ≦ 1, the condition for t <1 is 0.190 <w ₂ ′ <0.8213 (57)
And Formula (56) is formed. (58)

[7.5] Proposed method-Selective binary / ternary system Input: Point P and integer k
Output: Point Q = kP
algorithm:
1. k is expanded in binary and ternary. The number of digits l and i, the weights w ₂ and w ₃ , and the relative weights w ₂ ′ and w ₃ ′ are obtained.
2. (2a) If the condition Ter is satisfied, a ternary calculation is performed.
(2b) If the condition Ter is not satisfied, the calculation by the binary system is performed.

[8] Elliptic curve: case of characteristic 2 and non-super singularity An equation of non-super singular elliptic curve E on field F of characteristic 2 is given as follows.
Y ² + XY = X ³ + a ₂ X ² + a ₆ , a ₂ , a ₆ εF. (59)

[8.1] Non-super singular case: (x ₁ , y ₁ ), (x ₂ , y ₂ ), (x ₃ , y ₃ ) represent the coordinates of P, Q, and P + Q, respectively, as before the addition formula . I want to express x ₃ and _{y 3} at _{x 1, y 1, x 2} , y 2.
When P ≠ Q (addition formula)
x ₃ = λ ² + λ + x ₁ + x ₂ + a ₂
y ₃ = λ (x ₁ + x ₃ ) + x ₃ + y ₁
λ = (y ₁ + y ₂ ) / (x ₁ + x ₂ ) (60)

In the case of P = Q (double point formula)
Same as P ≠ Q except that λ is the value of the derivative dy / dx at P. The equation for the coordinates of the double point of P is as follows.
x ₃ = x ₁ ² + a ₆ / x ₁ ²
y ₃ = x ₁ ² + λx ₃ + x ₃
λ = x ₁ + y ₁ / x ₁ (61)
Note that (x ₃ , y ₃ ) in this case may be expressed as (x _d , y _d ) in order to clearly indicate that the coordinates are double points.

Triple point formula P = (x ₁ , y ₁ ), 2P = (x _d , y _d ), 3P = (x _t , y _t ), triple point 3P = (x _t , y _t ) = (x ₁ , y ₁ ) + (x _d , y _d ) is obtained. The 3P coordinates are given by
x _t = μ ² + μ + x ₁ + x ₁ ² + a ₆ / x ₁ ² + a ₂
y _t = μ (x ₁ + x _t ) + x _t + y ₁
λ = x ₁ + y ₁ / x ₁ , μ = λ + (x ₁ ² + a ₆ ) / (x ₁ + x ₁ ² + a ₆ ) (62)

[8.2] In the case of non-super singularity: The amount of calculation of addition Consider the cost of calculation of P + Q = (x ₃ , y ₃ ). Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of squaring, multiplication, and inverse operation are represented by S, M, and I, respectively.
When P ≠ Q Calculation of λ = (y ₁ + y ₂ ) / (x ₁ + x ₂ ):
The cost I of the inverse operation for the calculation of (x ₁ + x ₂ ) ^−1.
Multiplication cost M for the calculation of multiplying this by y ₁ + y ₂ .
2. Calculation of x ₃ = λ ² + λ + x ₁ + x ₂ + a ₂ :
cost S. of squaring to λ ² of the calculation
3. Calculation of y ₃ = λ (x ₁ + x ₃ ) + x ₃ + y ₁ :
cost of multiplication to calculate multiplying the λ to _x 1 + _{x 3} M.
Total cost t _A = 1I + 2M + 1S. The subscript _A of t _A is intended to be an addition.

When P = Q Calculation of λ = x ₁ + y ₁ / x ₁ :
Cost I of the inverse operation for the calculation of x ₁ ^−1.
Multiplication cost M for calculating y ₁ / x ₁ .
2. ^{_{x 3 = x 1 2 + a}} 6 / x 1 2 of the calculation:
The cost of squaring S in the calculation of x ₁ ² .
The cost S of squaring for the calculation of (x ₁ ⁻¹ ) ² .
This on the cost of the multiplication in the calculation to apply a ₆ M.
3. Calculation of y ₃ = x ₁ ² + λx ₃ + x ₃ :
cost of multiplication to calculate multiplying the λ to x ₃ M.
Total cost t _D = 1I + 3M + 1S = t _A + M. Subscript D of The _{t D} is the intention of Doubling (2 multiplication).

Summary In summary, the calculation cost of P + Q in the non-super singular elliptic curve defined on the finite field F _q of characteristic 2 is as follows. The affine coordinate system is used for the calculation.
In the case of general addition, the calculation amount t _A = 1I + 2M + 1S
In the case of doubling, the calculation amount t _D = 1I + 3M + 1S = t _A + 1M

[8.3] Calculation amount of triple calculation: non-super-singular case Consider the cost of triple calculation of point P, that is, the calculation for obtaining 3P. Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of multiplication and inverse operation are represented by M and I, respectively. Note that the cost of squaring is represented by S, where S≈M.
1. Calculation of λ:
As before, the cost is 1I + 1M.
2. Calculation of μ:
Cost is total 1I + 2M + 2S.
3. calculation of x _t:
Cost S. of squaring the mu ² calculations
4). calculation of y _t:
Multiplication cost M for the calculation of μ multiplied by x ₁ + x _t .
Total cost t _T = 2I + 4M + 3S = 2t _A + 1S. Note the Request 3P by adding P from seeking 2P, note that complexity is _{t T '= t A + t} D = 2t A + 1M + 1S = t T + M.

[9] Elliptic curve: Case of characteristic 2 and super singularity An equation of a super singular elliptic curve E on a field F of characteristic 2 is given as follows.
Y ² + a ₃ Y = X ³ + a ₄ X + a ₆ , a ₃ , a ₄ , a ₆ εF. (63)

[9.1] In the case of super singularity: (x ₁ , y ₁ ), (x ₂ , y ₂ ), and (x ₃ , y ₃ ) represent the coordinates of P, Q, and P + Q, respectively, as before the addition formula. I want to express x ₃ and _{y 3} at _{x 1, y 1, x 2} , y 2.
When P ≠ Q (addition formula)
x ₃ = λ ² + x ₁ + x ₂
y ₃ = λ (x ₁ + x ₃ ) + y ₁ + a ₃
λ = (y ₁ + y ₂ ) / (x ₁ + x ₂ ) (64)

In the case of P = Q (double point formula)
Same as P ≠ Q except that λ is the value of the derivative dy / dx at P. The equation for the coordinates of the double point of P is as follows.
x ₃ = (x ₁ ⁴ + a ₄ ² ) / a ₃ ² = λ ²
y ₃ = λ (x ₁ + x ₃ ) + y ₁ + a ₃
λ = (x ₁ ² + a ₄ ) / a ₃ (65)
Note that (x ₃ , y ₃ ) in this case may be expressed as (x _d , y _d ) in order to clearly indicate that the coordinates are double points.

Triple point formula P = (x ₁ , y ₁ ), 2P = (x _d , y _d ), 3P = (x _t , y _t ), triple point 3P = (x _t , y _t ) = (x ₁ , y ₁ ) + (x _d , y _d ) is obtained. The 3P coordinates are given by
x _t = μ ² + λ ² + x ₁
y _t = μ (x ₁ + x _t ) + y ₁ + a ₃
λ = (x ₁ ² + a ₄ ) / a ₃ , μ = λ + a ₃ / (x ₁ + λ ² ) (66)

[9.2] Ultra-singular case: Addition calculation amount Consider the calculation cost of P + Q = (x ₃ , y ₃ ). Here, addition, subtraction, and multiplication of small constants are ignored. In the following, the costs of squaring, multiplication, and inverse operation are represented by S, M, and I, respectively.
When P ≠ Q Calculation of λ = (y ₁ + y ₂ ) / (x ₁ + x ₂ ):
The cost I of the inverse operation for the calculation of (x ₁ + x ₂ ) ^−1.
Multiplication cost M for the calculation of multiplying this by y ₁ + y ₂ .
2. Calculation of x ₃ = λ ² + x ₁ + x ₂ :
cost S. of squaring to λ ² of the calculation
3. Calculation of y ₃ = λ (x ₁ + x ₃ ) + y ₁ + a ₃ :
Multiplication cost M for the calculation of λ multiplied by x ₁ + x ₃ .
Total cost t _A = 1I + 2M + 1S. The subscript _A of t _A is intended to be an addition.

When P = Q Calculation of λ = (x ₁ ² + a ₄ ) / a ₃ :
The cost of squaring S in the calculation of x ₁ ² .
Multiplication cost M for the calculation of x ₁ ² + a ₄ multiplied by a ₃ ⁻¹ .
2. Calculation of x ₃ = λ ² :
cost S. of squaring to λ ² of the calculation
3. Calculation of y ₃ = λ (x ₁ + x ₃ ) + y ₁ + a ₃ :
Multiplication cost M of multiplication in the calculation of λ (x ₁ + x ₃ ).
Total cost total t _D = 2M + 2S.

Summary In summary, the calculation cost of P + Q in the super singular elliptic curve defined on the finite field F _q of characteristic 2 is as follows. The affine coordinate system is used for the calculation.
In the case of general addition, the calculation amount t _A = 1I + 2M + 1S
In case of doubling, the calculation amount t _D = 2M + 2S

[9.3] Complexity of triple calculation: Super singularity Consider the cost of triple calculation of point P, that is, calculation to obtain 3P.
1. Calculation of λ = (x ₁ ² + a ₄ ) / a ₃ :
As mentioned above, the cost is 1M + 1S.
2. Calculation of μ = λ + a ₃ / (x ₁ + λ ² ):
cost S. of squaring to λ ² of the calculation
The cost I of the inverse operation for the calculation of (x ₁ + λ ² ) ^−1.
This on the cost of the multiplication in the calculation to apply a ³ M.
3. Calculation of x _t = μ ² + λ ² + x ₁ :
Cost S. of squaring the mu ² calculations
4). Calculation of y _t = μ (x ₁ + x _t ) + y ₁ + a ₃ :
Multiplication cost M for the calculation of μ multiplied by x ₁ + x _t .
Total cost t _T = 1I + 3M + 3S. Note the Request 3P by adding P from seeking 2P, computing the amount it is to be noted that _{t T '= t A + t} D = 1I + 4M + 3S = t T + M.

[Concrete example]
Embodiment 1
FIG. 1 is a configuration diagram of an elliptic curve integer multiple arithmetic apparatus 100 according to the first embodiment. These configurations can be realized in terms of hardware by a CPU, memory, or other LSI of an arbitrary computer, and in terms of software, it is realized by a program having a cryptographic processing function loaded in the memory. So, functional blocks that are realized by their cooperation are drawn. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof. The same applies to the configurations of a key generation device 200, an encryption device 300, and a decryption device 400, which will be described later.

  The input / output unit 10 receives parameters such as a characteristic defining a elliptic curve and a coefficient of a function, the coordinates of a point P on the elliptic curve, and an input of an integer k that gives a multiple of integer multiplication. The parameter that defines the input elliptic curve is stored as an elliptic curve parameter 18, and the coordinates of the point P and the integer k are stored as input data 12 in a storage unit such as a main storage device or an external storage device. In addition to the input data 12, the storage unit stores elliptic curve information 15, s-adic expansion data 14 and preliminary calculation data 24, which are intermediate data, and k multiplication result data 26, which is final data.

  In addition to the elliptic curve parameter 18, the elliptic curve information 15 includes cost evaluation formula data 16, addition formula data 20, and s-fold point formula data 22. The cost evaluation formula data 16, the addition formula data 20, and the s-fold point formula data 22 are p = 3 when p = 2 and non-super singular, p = 2 and super singular, depending on the characteristic p of the elliptic curve. In the case of p> 3, it is mathematical data prepared in advance in the case of p> 3, and can be calculated by giving an elliptic curve coefficient specifically as the elliptic curve parameter 18.

  The s-adic expansion unit 28 obtains an s-adic expansion using a plurality of bases s for the integer k of the input data 12 and stores the s-adic expansion data 14 for each base s.

  The cost evaluation unit 30 refers to the s-adic expansion data 14, obtains the number of digits in the s-adic expansion, the number of non-zero digits in the s-adic expansion, and divides the number of non-zero digits by the number of digits. The relative weight of each s-adic expansion is calculated. Further, the cost evaluation unit 30 refers to the cost evaluation formula data 16 in which the amount of calculation in the s-adic system is expressed as a function of relative weight, and performs k multiplication by the s-adic based on the relative weight of each s-adic expansion. To calculate the calculation cost.

  The selection unit 32 selects the smallest calculation cost among the calculation costs of each s-adic number obtained by the cost evaluation unit 30, outputs the radix h in that case, and the preliminary calculation unit 34 and the h-adic calculation Part 35 is given.

  The cost evaluation performed by the cost evaluation unit 30 and the selection unit 32 and the selection of the optimal h-ary system are [4] and [5] in the base technologies when the characteristic p> 3 of the elliptic curve, and the characteristic p = 3. Is based on the description of [7] of the base technology, and when the characteristic p = 2, it is based on the descriptions of [8] and [9] of the base technology. However, in the base technology, as an example, a case where s = 2, 3 is used as a plurality of radixes s is described, but other than s = 2, 3 may be used as the radix s. Two or more bases s may be used.

  The preliminary calculation unit 34 calculates in advance an integer multiple of (h−1) times or less for the point P included in the input data 12 and stores it as preliminary calculation data 24. If h = 3, 2P is obtained and stored. If h = 4, 2P and 3P are obtained and stored. However, if h = 2, preliminary calculation is unnecessary.

  The h-adic arithmetic unit 35 acquires h-adic expansion data for the radix h selected by the selection unit 32 from the s-adic expansion data 14 for the plurality of stored radixes s. Further, the h-adic calculation unit 35 reads out the elliptic curve parameter 18 and addition formula data 20 for obtaining the addition of points on the elliptic curve. Furthermore, the h-adic arithmetic unit 35 acquires h-fold point official data for the radix h selected by the selection unit 32 from the stored s-fold point official data 22 for the plurality of radixes s stored.

  The h-adic arithmetic unit 35 calculates the k-fold multiplication of the point P of the input data 12 by the h-adic system based on the h-adic expansion data, the elliptic curve parameter 18, the addition formula data 20, and the h-fold point official data. The obtained k-fold point kP is stored as the k-fold result data 26.

  The h-adic system performed by the h-adic arithmetic unit 35 is a combination of the multiplication of the point P by h and the addition of an integer multiple less than (h-1) times the point P calculated in advance, and k times the point P. It is a calculation. The h multiplication of the point P is performed by the h multiplication calculation unit 36, and the addition of the integer multiples not more than (h−1) times the point P is performed by the addition calculation unit 38 using the preliminary calculation data 24. The addition result by the addition calculation unit 38 is given as an input of the h multiplication calculation unit 36 and further multiplied by h. The h-ary arithmetic operations performed by the h-multiplying arithmetic unit 36 and the addition arithmetic unit 38 are the algorithms described in the base technologies [4.1] and [7.1] in the binary system, and the ternary system. Is based on the algorithm described in the base technology [4.2] and [7.2], and the detailed operation will be described later using a flowchart.

  The k-fold point Q = kP of the point P finally obtained as the k multiplication result data 26 is output from the input / output unit 10.

  FIG. 2 is a flowchart for explaining an integer multiple calculation procedure by the elliptic curve integer multiple arithmetic apparatus 100 having the above configuration. Here, as an example, a case will be described in which a binary or ternary method is selected and integer multiplication is performed.

  The input / output unit 10 receives input of a point P on the elliptic curve and an integer k (S10). The s-adic expansion unit 28 calculates a binary expansion and a ternary expansion of the integer k (S12).

The cost evaluation unit 30 calculates the relative weight w ₂ ′ obtained by dividing the number w ₂ of non-zero digits in the binary expansion of the integer k by the number of digits l of the binary expansion, and the number of non-zero digits in the ternary expansion of the integer k. It calculates the relative weights _{w 3} 'obtained by dividing the w ₃ in digits i ternary expansion (S14).

The selection unit 32 checks whether or not the condition Ter related to the relative weight w ₂ ′ of binary expansion and the relative weight w ₃ ′ of ternary expansion described in [5.1] of the base technology is satisfied (S16). If the condition Ter is satisfied (Y in S16), the preliminary calculation unit 34 and the h base arithmetic unit 35 calculate the k-fold point kP of the point P by the ternary system (S18). If the condition Ter is not satisfied (N in S16), the h-adic arithmetic unit 35 calculates the k-fold point kP of the point P by the binary system (S20). The input / output unit 10 outputs the k-fold point Q = kP thus obtained (S22).

  FIG. 3 is a flowchart for explaining the detailed procedure of the k multiplication by the ternary system in step S18.

The preliminary calculation unit 34 calculates and stores the double point P _d = 2P of the point P in advance (S30). The h base arithmetic unit 35 acquires the ternary expansion k = h _i-1 h _i-2 ... h ₁ h _{0 (3)} of the integer k (S32). Here, i is the number of ternary digits of k, and the most significant digit h _i−1 is not zero. As an initial value of Q, if h _i-1 = 1, P is substituted for Q, and if h _i-1 = 2, P _d is substituted for Q (S34).

Next, the h base arithmetic unit 35 sets the subscript j to i-2 (S36). The h multiplication calculation unit 36 obtains the triple point 3Q with respect to the current Q by the triple calculation formula, and substitutes 3Q for Q (S38). The addition operation unit 38 obtains a value Q + P obtained by adding P to the current Q if h _j = 1, and substitutes the added value for Q. If h _j = 2, P _d is added to the current Q. The obtained value Q + _{Pd is} obtained, and the added value is substituted for Q (S40). Here, when h _j = 0, the addition operation unit 38 does not perform addition.

  The h base arithmetic unit 35 substitutes j−1 for the subscript j, that is, decrements the subscript j by 1 (S42). If j <0 (Y in S44), Q at that time is k times P, and the procedure of k multiplication is terminated and the process returns. If j <0 is not satisfied (N in S44), the process returns to step S38, and the multiplication operation by the h multiplication operation unit 36 and the addition by the addition operation unit 38 are repeated.

  FIG. 4 is a flowchart for explaining the detailed procedure of the k multiplication in the binary system in step S20.

The h base arithmetic unit 35 acquires binary expansion k = k _l−1 k _l−2 ... k ₁ k _{0 (2)} of the integer k (S50). Here, l is the number of binary digits of k, and the most significant digit h _l−1 is 1. As an initial value of Q, P is substituted for Q (S52).

Next, the h base arithmetic unit 35 sets the subscript j to l-2 (S54). The h multiplication calculation unit 36 obtains the double point 2Q with respect to the current Q by the doubling formula, and substitutes 2Q for Q (S56). If h _j = 1, the addition operation unit 38 obtains a value Q + P obtained by adding P to the current Q, and substitutes the added value for Q (S58). Here, when h _j = 0, the addition operation unit 38 does not perform addition.

  The h base arithmetic unit 35 substitutes j−1 for the subscript j, that is, decrements the subscript j by 1 (S60). If j <0 (Y in S62), Q at that time is a point k times P, and the procedure of k multiplication is terminated and the process returns. If j <0 is not satisfied (N in S62), the process returns to step S56, and the doubling operation by the h multiplication operation unit 36 and the addition by the addition operation unit 38 are repeated.

  As described above, according to the elliptic curve integer multiplication unit 100 of the embodiment, when obtaining the k-fold point Q of an arbitrary point P on the elliptic curve, the s-adic expansion of the integer k is performed for a plurality of bases s. Then, the calculation cost of the s-adic system is evaluated, and k-fold operation is performed by the h-adic system having the lowest calculation cost. Thereby, calculation time can be shortened compared with the integer multiplication which uses only a binary system.

  In general, when h> 3, it can be said that the calculation amount of h multiplication is not larger than the calculation amount of the combination of (h−1) multiplication and addition. This is because the h-fold point formula is obtained by rearranging the formula from the relationship of hP = (h−1) P + P, so that the amount of calculation may be reduced as a result of formula transformation, and even in the worst case, h This is because the multiplication can be calculated by substituting the combination of (h-1) multiplication and addition. Therefore, the amount of calculation can be further reduced by using not only doubling but also h doubling. Of course, when the number of non-zero digits is large when the number of non-zero digits is expanded, the number of times that the h multiplication can be used is reduced. Therefore, the h-ary number does not always have a smaller calculation amount than the binary number. Therefore, in the embodiment, by obtaining the s-adic expansion by several radixes s, evaluating the calculation amount by the number of non-zero digits, and selecting the one having a small calculation amount from a plurality of s-adic numbers, The optimal h-adic system is selected to increase the speed.

Embodiment 2
FIG. 5 is a configuration diagram of the key generation apparatus 200 according to the second embodiment. The key generation apparatus 200 generates a secret key / public key pair using the elliptic curve integer multiple arithmetic apparatus 100 of the first embodiment.

  The key generation device 200 receives input of the elliptic curve data 42, outputs the generated key data 44, a random number generation unit 46 that generates random numbers, and performs integer multiplication of points on the elliptic curve. An elliptic curve integer multiple calculation unit 48 to perform and a key generation unit 50 to generate key data 44 are included. As the elliptic curve integer multiplication unit 48, the elliptic curve integer multiplication unit 100 of the first embodiment is used.

  FIG. 6 is a flowchart for explaining a key generation procedure by the key generation apparatus 200. The operation of each component in FIG. 5 will be described with reference to FIG.

  The input / output unit 40 receives the input of the elliptic curve parameter, the base point G on the elliptic curve, and its order n (S200). These data are stored in the storage unit as elliptic curve data 42. The random number generation unit 46 refers to the order n included in the elliptic curve data 42, generates a random number d that satisfies 0 <d <n, and supplies the random number d to the elliptic curve integer multiple calculation unit 48 (S210).

  The elliptic curve integer multiple calculation unit 48 reads the coordinates of the base point G included in the elliptic curve data 42, and calculates the d-multiple point Q = dG of the base point G (S220). When calculating the d-fold point, the elliptic curve integer multiple calculation unit 48 selects the h-adic system with the least amount of calculation as described in the first embodiment, and performs the d-multiple operation using the h-adic system.

  The key generation unit 50 generates key data (d, Q) using the random number d generated by the random number generation unit 46 as a secret key and the d multiple point Q calculated by the elliptic curve integer multiple calculation unit 48 as a public key, The key data 44 is stored in the storage unit (S230). The input / output unit 40 outputs the generated key data 44.

  According to the key generation device 200 of the present embodiment, when generating a pair of a secret key and a public key by elliptic curve cryptography, the key generation can be speeded up by using the h-adic system with the least amount of calculation.

Embodiment 3
FIG. 7 is a configuration diagram of the encryption apparatus 300 according to the third embodiment. The encryption device 300 encrypts plaintext using the elliptic curve integer multiple arithmetic device 100 of the first embodiment.

  The encryption device 300 receives input of elliptic curve data 62, public key data 64, and plaintext data 66, and outputs an input / output unit 60 that outputs the generated ciphertext data 68; a random number generation unit 70 that generates random numbers; An elliptic curve integer multiplication unit 72 that performs integer multiplication of points on the elliptic curve, and a ciphertext generation unit 74 that encrypts plaintext data 66 and generates ciphertext data 68 are included. As the elliptic curve integer multiplication unit 72, the elliptic curve integer multiplication unit 100 of the first embodiment is used.

  FIG. 8 is a flowchart for explaining an encryption procedure by the encryption apparatus 300. The operation of each component in FIG. 7 will be described with reference to FIG.

  The input / output unit 60 receives the input of the elliptic curve parameter, the base point G on the elliptic curve, and its order n (S300). These data are stored in the storage unit as elliptic curve data 42. The input / output unit 60 further receives an input of the public key Q and plaintext M (S310). These data are stored as public key data 64 and plain text data 66, respectively. The random number generation unit 70 refers to the order n included in the elliptic curve data 42, generates a random number r that satisfies 0 <r <n, and provides the generated random number r to the elliptic curve integer multiple calculation unit 72 (S320).

  The elliptic curve integer multiple calculation unit 72 reads the coordinates of the base point G included in the elliptic curve data 62, calculates the r-fold point rG of the base point G, and further reads the public key Q included in the public key data 64. Then, the r-fold point rQ of the public key Q is calculated (S330). When calculating the r-fold point, the elliptic curve integer multiple calculation unit 48 selects the h-adic system with the least amount of calculation and performs the r-multiple operation by the h-adic system as described in the first embodiment. The elliptic curve integer multiple calculation unit 72 gives the calculated two r-fold points rG and rQ to the ciphertext generation unit 74.

  The ciphertext generation unit 74 reads the plaintext M included in the plaintext data 66, calculates the first cipher C1 = rG and the second cipher C2 = rQ + M, and generates ciphertext (C1, C2) (S340). The generated ciphertext (C1, C2) is stored as ciphertext data 68 and output by the input / output unit 60.

  According to the encryption apparatus 300 of the present embodiment, when encrypting plaintext using elliptic curve cryptography, it is possible to increase the speed of the encryption process by using the h-adic system with the least amount of calculation.

Embodiment 4
FIG. 9 is a configuration diagram of the decoding apparatus 400 according to the fourth embodiment. The decryption device 400 decrypts the ciphertext using the elliptic curve integer multiple computation device 100 of the first embodiment.

  The decryption device 400 receives input of the elliptic curve data 82, the secret key data 84, and the ciphertext data 86, and performs an integer multiple operation of the points on the elliptic curve with the input / output unit 80 that outputs the generated plaintext data 88. An elliptic curve integer multiple calculation unit 90 and a plaintext generation unit 92 that decrypts the ciphertext data 86 and generates plaintext data 88 are included. As the elliptic curve integer multiple arithmetic unit 90, the elliptic curve integer multiple arithmetic apparatus 100 of the first embodiment is used.

  FIG. 10 is a flowchart for explaining a decoding procedure by the decoding device 400. The operation of each component in FIG. 9 will be described with reference to FIG.

  The input / output unit 80 receives input of elliptic curve parameters and stores them in the storage unit as elliptic curve data 82. The input / output unit 60 further receives an input of the secret key d and the ciphertext (C1, C2) (S400). These data are stored as secret key data 84 and ciphertext data 86, respectively.

  The elliptic curve integer multiple calculation unit 90 reads out the secret key d included in the secret key data 84 and the first cipher C1 included in the ciphertext data 86, and d times the first cipher C1 based on the elliptic curve data 82. A point dC1 is calculated (S410). When calculating the d-fold point, the elliptic curve integer multiple calculation unit 90 selects the h-adic system with the least amount of calculation as described in the first embodiment, and performs the d-multiple operation using the h-adic system. The elliptic curve integer multiple calculation unit 90 gives the calculated d-multiple point dC1 to the plaintext generation unit 92.

  The plaintext generation unit 92 reads the second cipher C2 included in the ciphertext data 86, and generates the plaintext M by calculating M = C2-dC1 (S420). The generated plaintext M is stored as plaintext data 88 and output by the input / output unit 80. Here, the second cipher C2 is encrypted by the operation of rQ + M by the encryption device 300, and the first cipher C1 is encrypted by the encryption device 300 as r multiple point rG of the base point G. Note that the public key Q is generated by the key generation device 200 as the d-fold point dG of the base point G. C2-dC1 = rQ + M-d (rG) = r (dG) + M-d Since (rG) = M, decryption of plaintext M is guaranteed.

  According to decryption apparatus 400 of the present embodiment, when decrypting a ciphertext using elliptic curve cryptography, it is possible to increase the speed of the decryption process by using the h-adic system with the least amount of calculation.

  The present invention has been described based on the embodiments. It is understood by those skilled in the art that these embodiments are exemplifications, and that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. By the way. Such modifications will be described below.

  In the above description, the method of selectively using the binary system and the ternary system based on the calculation cost has been described as an example, but other than the binary system and the ternary system may be used, and three or more s-adic may be used. An h-adic system with a small amount of calculation may be selected from the methods.

  In the above description, key generation, encryption, and decryption have been described as examples of use of the elliptic curve integer multiple arithmetic apparatus 100 of the first embodiment. However, in addition to this, it may be used for digital signature generation and signature verification. Good. Moreover, although ElGamal encryption using an elliptic curve has been described as an example, an encryption method using an elliptic curve is not particularly limited to this.

  In the above description, the affine coordinate system is used for the calculation, but other coordinate systems such as a projective coordinate system may be used. In particular, when the calculation cost of the inverse element calculation is higher than that of multiplication, it is efficient to perform the calculation using projective coordinates.

1 is a configuration diagram of an elliptic curve integer multiple arithmetic apparatus according to Embodiment 1. FIG. It is a flowchart explaining the integer multiple calculation procedure by the elliptic curve integer multiple calculation apparatus of FIG. It is a flowchart explaining the detailed procedure of the integer multiplication by the ternary system of FIG. It is a flowchart explaining the detailed procedure of the integer multiplication by the binary system of FIG. 6 is a configuration diagram of a key generation apparatus according to Embodiment 2. FIG. It is a flowchart explaining the key generation procedure by the key generation apparatus of FIG. FIG. 10 is a configuration diagram of an encryption device according to a third embodiment. It is a flowchart explaining the encryption procedure by the encryption apparatus of FIG. FIG. 10 is a configuration diagram of a decoding device according to a fourth embodiment. It is a flowchart explaining the decoding procedure by the decoding apparatus of FIG.

Explanation of symbols

  28 s-adic expansion unit, 30 cost evaluation unit, 32 selection unit, 34 preliminary calculation unit, 35 h base arithmetic operation unit, 36 h multiplication operation unit, 38 addition operation unit, 46, 70 random number generation unit, 48, 72, 90 elliptic curve integer multiplication unit, 50 key generation unit, 74 ciphertext generation unit, 92 plaintext generation unit, 100 elliptic curve integer multiplication unit, 200 key generation unit, 300 encryption unit, 400 decryption unit

Claims (8)

An elliptic curve integer multiple arithmetic apparatus that performs an integer multiple computation kP of an arbitrary point P on an elliptic curve,
An s-adic expansion unit for obtaining an s-adic expansion with a plurality of bases s for an integer k;
A cost evaluation unit that evaluates the calculation cost of the s-ary system for calculating the k times point Q of the point P by a combination of s multiplication and addition for each of the plurality of bases s;
A selection unit that selects one base h from the plurality of bases s based on the calculation cost;
An o-base arithmetic unit that calculates a k-fold point Q of the point P by a combination of h-multiplication and addition based on the h-adic expansion of the integer k by the selected radix h Curve integer multiplication unit. A preliminary calculation unit for calculating in advance an integer multiple of (h−1) times or less of the point P necessary for the calculation of the h-adic system in the h-adic calculation unit;
A storage unit that stores an integer multiple of (h-1) times or less calculated by the preliminary calculation unit;
2. The elliptic curve integer multiple calculation according to claim 1, wherein the h-adic calculation unit uses an integer multiple of (h−1) times or less stored in the storage unit when adding. apparatus.   3. The elliptic curve according to claim 1, wherein the cost evaluation unit compares the calculation costs of the respective s-adic systems based on an evaluation formula using the number of non-zero digits in the s-adic expansion. Integer multiplication unit.   The cost evaluation unit compares the calculation cost of each s-adic system based on an evaluation formula using a relative weight obtained by dividing the number of non-zero digits in the s-adic expansion by the number of s-adic digits. The elliptic curve integer multiple arithmetic apparatus according to claim 1 or 2.   The said cost evaluation part compares the calculation cost of each s base based on the evaluation type | formula using the estimated value of the ratio of the calculation cost of the inverse element calculation and multiplication in the said s base. The elliptic curve integer multiple arithmetic apparatus according to 3 or 4. An input unit for receiving an input of a base point G on the elliptic curve and its order n;
A random number generator for generating a random number d satisfying 0 <d <n;
An integer multiple calculation unit for calculating the d-fold point Q of the base point G;
A key generation unit that generates the random number d as a secret key and the d multiple Q as a public key,
The integer multiplication unit performs an integer multiplication kP of an arbitrary point P on the elliptic curve,
An s-adic expansion unit for obtaining an s-adic expansion with a plurality of bases s for an integer k;
A cost evaluation unit that evaluates the calculation cost of the s-ary system for calculating the k times point Q of the point P by a combination of s multiplication and addition for each of the plurality of bases s;
A selection unit that selects one base h from the plurality of bases s based on the calculation cost;
A key unit including an h-adic arithmetic unit that calculates a k-fold point Q of the point P by a combination of h-multiplication and addition based on the h-adic expansion of the integer k by the selected radix h Generator. An input unit for receiving input of a base point G on the elliptic curve and its order n, public key Q, and plaintext M;
A random number generator for generating a random number r satisfying 0 <r <n;
An r multiple point rG of the base point G, an integer multiple arithmetic unit for calculating an r multiple point rQ of the public key Q,
A ciphertext generation unit that calculates a first cipher C1 = rG and a second cipher C2 = rQ + M using a calculation result by the integer multiple operation unit, and generates a ciphertext (C1, C2);
The integer multiplication unit performs an integer multiplication kP of an arbitrary point P on the elliptic curve,
An s-adic expansion unit for obtaining an s-adic expansion with a plurality of bases s for an integer k;
A cost evaluation unit that evaluates the calculation cost of the s-ary system for calculating the k times point Q of the point P by a combination of s multiplication and addition for each of the plurality of bases s;
A selection unit that selects one base h from the plurality of bases s based on the calculation cost;
And a h-ary arithmetic unit that calculates a k-fold point Q of the point P by a combination of h multiplication and addition based on the h-adic expansion of the integer k by the selected radix h. Device. For the base point G on the elliptic curve, its order n, the public key Q, and the plaintext M, a random number r satisfying 0 <r <n is determined, and the r multiple point rG of the base point G and the public key Q The r-fold point rQ is calculated, and the ciphertext (C1, C2) generated by calculating the first cipher C1 = rG and the second cipher C2 = rQ + M using the calculation result, and the input of the secret key d An input unit that accepts
An integer multiple calculation unit for calculating the d-fold point dC1 of the first cipher C1,
A plaintext generation unit that generates a decrypted plaintext M by subtracting a d-multiplier point dC1 of the first cipher C1 from the second cipher C2 using a calculation result by the integer multiplication unit;
The integer multiplication unit performs an integer multiplication kP of an arbitrary point P on the elliptic curve,
An s-adic expansion unit for obtaining an s-adic expansion with a plurality of bases s for an integer k;
A cost evaluation unit that evaluates the calculation cost of the s-ary system for calculating the k times point Q of the point P by a combination of s multiplication and addition for each of the plurality of bases s;
A selection unit that selects one base h from the plurality of bases s based on the calculation cost;
And a h-ary arithmetic unit that calculates a k-fold point Q of the point P by a combination of h multiplication and addition based on the h-adic expansion of the integer k by the selected radix h. apparatus.

Images