JP4398904B2 - Random number sequence generation device, random number sequence generation method, arithmetic processing device, arithmetic processing method and program - Google Patents

Description

  The present invention relates to a random number sequence generation device and a random number sequence generation method for generating a random number sequence, an arithmetic processing device and an arithmetic processing method for performing operations such as exponentiation and scalar multiplication, and a program.

Many public key cryptosystems and digital signature schemes use operations such as exponentiation and scalar multiplication. The power-residue calculation is an operation such as y = x ^k mod n and is used for ElGamal encryption, RSA encryption, and the like. Scalar multiplication is an operation used in the elliptic curve cryptosystem and means power multiplication Y = kX on the elliptic curve.

  Since public key cryptography handles large data such as 1024 bits, redundant representation (binary representation, etc.) using signed integers such as NAF, binary method (Double-and-ADD method), window method, etc. Various methods for efficiently performing exponentiation and scalar multiplication by combining such techniques are known.

The binary algorithm is shown below.
[Binary method]
(Step 0) Input k, x, n
(Step 1) The integer k is expressed as a binary number as k = Σ (k _i · 2 ⁱ ) (k _i is obtained for each of i = 0 to l−1). Here, k _i εT, T = [0, 1].
(Step 2) y = 1
(Step 3) The following is repeated from i = 1 to 1 to 0.
(Step 3-1) y = y ² (mod n)
(Step 3-2) If k _i = 1, y = y · x (mod n)
(Step 4) Output (= x ^k mod n)
It has been found that, in an arithmetic algorithm that depends on the values of bits 0 and 1 such as the binary method, the amount of calculation decreases as the Hamming weight when the exponent is expressed in binary notation is small.

Regarding the binary representation as described above, the unsigned binary representation (T = [0, 1]) is uniquely determined, but the signed binary representation (T = [-1, 0, 1]) is unique. Has the property of not deciding. Incidentally, used in the following ^"- 1" denote the "-1".

For example, when k = 181 and T = [0, 1], 181 = 10110101 (unique). In contrast, T = [- 1, 0, ^1], then ^the 181 ⁼ 1 ^- 110 ^- 11 - 11 ^- 1 ⁼ 1 - 11 - 110101 = ... is (not unique).

  In this signed binary number representation, NAF representation is known as a method for minimizing the number of non-zero coefficients.

The NAF expression means a signed binary expression such that k _i × k _{i + 1} = 0 for all i ≧ 0, and is unique by applying a conversion algorithm to an arbitrary positive integer. Can be expressed in There are several possible methods for implementing the NAF conversion algorithm.

The basic NAF conversion algorithm is shown below.
[NAF conversion algorithm]
Input n
k ← n
S ← <＞
while k> 0
If k: odd u ← 2- (k mod 4)
else u ← 0
k ← k−u
Prepend to S
k ← k / 2
end while
Output S
For example, when the positive integer n = 181, signed binary representation ^S = 10 ^- 10 ^- 10101 is obtained.

  Furthermore, a signed binary algorithm that extends the binary method to a signed binary representation is known.

The signed binary algorithm is shown below. Note that x ⁻¹ below represents the inverse element of x in modulus n.
[Signed binary method]
(Step 0) Input k, x, n
(Step 1) The integer k is expressed as a binary number as k = Σ (k _i · 2 ⁱ ) (k _i is obtained for each of i = 0 to l−1). Here, k _i εT, T = [− 1, 0, 1].
(Step 2) y = 1
(Step 3) The following is repeated from i = 1 to 1 to 0.
(Step 3-1) y = y ² (mod n)
(Step 3-2) If k _i = 1, y = y · x (mod n)
(Step 3-3) If k _i = −1, y = y · x ⁻¹ (mod n)
(Step 4) Output (= x ^k mod n)
By using techniques such as these signed binary methods and NAF representation, power-residue and scalar multiplication can be performed efficiently. For example, referring to Non-Patent Documents 1 and 2, when NAF is used, the number of non-zero coefficients becomes about 1/3 of the whole (the number of zeros is about 2/3), and power-residue (or scalar multiplication) Regarding the amount of calculation, it is described that the efficiency can be improved by about 11% compared to the case where NAF is not used.

  On the other hand, in public key cryptosystems and digital signature systems, random numbers are often generated in a standard protocol, and power-residue calculation is performed using the generated random numbers as exponents. For example, ElGamal encryption, DH key sharing method, DSA signature, and the like.

In these standard protocols, the modular exponentiation process using random numbers and NAF expression is composed of the following three steps (k and d are integers of the same value).
(Step 1) A random number k is generated.
(Step 2) k NAF conversion d = NAF (k) is performed.
(Step 3) The modular exponentiation y = x ^d mod n is calculated.
CRYPTOGRAPHY Theory and Practice SECOND EDITION (pp.258-259), Author: Douglas Stinson, Publisher: Chapman & Hall / CRC, ISBN: 1-58488-206-9 Guide to Elliptic Curve Cryptography (pp.98-100), Author: Darrel Hankerson, Alfred J. Menezes, Scott Vanstone, Publisher: Springer Professional Computing Series, ISBN: 0-387-95273-X

  Regarding conversion to binary representation and generation of signed binary representation, it is meaningful to binary-convert specific values to reduce the number of non-zero coefficients, but random values such as random numbers When converting, there is no need to perform conversion processing, and there is a possibility that a random number sequence expressed in signed binary numbers can be generated more efficiently.

  In the NAF conversion algorithm, it is necessary to convert the least significant bit (LSB) to the most significant bit (MSB) for each digit, but the calculation is performed from the most significant bit (MSB) to the least significant bit (LSB). However, when used together with an arithmetic method such as exponentiation / scalar multiplication or scalar multiplication, duplication of conversion processing is caused, resulting in a disadvantage that the processing time becomes long.

  The present invention has been made in consideration of the above circumstances. A random number sequence generation apparatus and a random number sequence generation method capable of generating a random number sequence represented by a signed binary number more efficiently, and more efficiently, a signed 2 Provided are an arithmetic processing device, an arithmetic processing method, and a program capable of generating a random number sequence expressed in decimal and using the random number sequence as a power exponent to perform operations such as power-residue and scalar multiplication For the purpose.

The present invention is only allowed to take 1 for the most significant bit, and for bits other than the most significant bit, if the higher order bit is 0, it is allowed to take either -1 or 0 or 1. A random number sequence generation device that generates a random number sequence that satisfies a condition that only accepts 0 when the upper bit is −1 or 1, and generates a ternary random number that takes −1, 0, or 1 Ternary random number generating means, and using the whole or a part of the random numbers sequentially generated by the ternary random number generating means based on the above conditions in the order of generation, the highest order random number sequence to be generated Random number sequence generation means for generating a random number sequence satisfying the condition by determining the value of each bit so as to satisfy the condition one bit at a time from the bit toward the least significant bit. Features .
In the present invention, it is only allowed to take 1 for the most significant bit, and for bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1 or 0 or 1. A random number sequence generation unit that generates a random number sequence that satisfies a condition that only allows 0 when the higher-order bit is −1 or 1, and a calculation unit that performs an operation using the random number sequence as a power exponent. The random number sequence generation unit includes: a ternary random number generation unit that generates a ternary random number that takes -1, 0, or 1; and the ternary random number generation based on the condition Using the whole or part of the random numbers sequentially generated by the means in the order of generation, satisfying the condition one bit at a time in order from the most significant bit to the least significant bit of a random number sequence having an arbitrary bit length to be generated to each bit value A random number sequence generating unit that generates a random number sequence that satisfies the condition by determining, and the arithmetic unit, in parallel with the generation of the random number sequence by the random number sequence generating unit, The random number sequence generated by the sequence generation means includes means for performing a specific repetitive process while sequentially using one or a plurality of bits from the most significant bit toward the least significant bit. .

The present invention relating to the apparatus is also established as an invention relating to a method, and the present invention relating to a method is also established as an invention relating to an apparatus.
Further, the present invention relating to an apparatus or a method has a function for causing a computer to execute a procedure corresponding to the invention (or for causing a computer to function as a means corresponding to the invention, or for a computer to have a function corresponding to the invention. It can also be realized as a program (for realizing the program), and can also be realized as a computer-readable recording medium on which the program is recorded.

  According to the present invention, it is possible to generate a random number sequence expressed in a signed binary number more efficiently. In addition, according to the present invention, a random number sequence expressed in a signed binary number is generated more efficiently, and operations such as exponentiation and scalar multiplication are performed using the random number sequence as a power exponent. be able to.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 shows a configuration example of a NAF random number sequence generation apparatus according to the first embodiment of the present invention.

  As shown in FIG. 1, the NAF random number sequence generation device 100 includes a control unit 101, a random number sequence generation unit 102, a storage unit 103, and an output unit 104.

  The NAF random number sequence generation device 100 is incorporated in a cryptographic module such as an IC chip, for example. When an arbitrary positive integer value l is input during encryption, decryption, key generation, or signature generation, the NAF rule 1-bit random number sequence (signed binary representation) is generated and output.

  The random number generation unit 102 has a function of generating a random number including three values [-1, 0, 1].

  The control unit 101 has a function of controlling the random number sequence generated by the NAF random number sequence generation apparatus 100 so as to satisfy the NAF rule.

  The storage unit 103 has a function of storing a random number bit generated at least one previous time. A configuration in which u (u is a predetermined number) bits are stored in order from a newly generated one, or a configuration in which all generated bit strings are stored is also possible.

  The output unit 104 has a function of sequentially outputting the NAF random number bits accumulated in the storage unit 103 one bit at a time in the order of generation (in order from the most significant bit to the least significant bit). The NAF random number bits accumulated in the storage unit 103 are sequentially output in order of generation (in order from the most significant bit to the least significant bit) and s (s is a predetermined number) bits. A configuration is also possible in which all bits of the NAF random number sequence are output after generation of all bits of the NAF random number sequence is completed. Further, the number of random bits output by the output unit 104 at a time may be set or designated each time.

Here, the NAF rule can be expressed by, for example, the following two rules (conditions).
(A) In the random number series, only the most significant bit is allowed to be 1.
(B) In the random number sequence, non-zero bits are not allowed to be adjacent to each other (0 and 0 are adjacent, 0 and 1 are adjacent, and 0 and −1 are adjacent) Allowed, 1 and 1 are adjacent, 1 and -1 are adjacent, and -1 and -1 are not adjacent).

Further, in consideration of generating the random number sequence in order from the most significant bit to the least significant bit in the present embodiment, the NAF rule can also be expressed as follows, for example.
(A) In the random number sequence, the most significant bit is only allowed to take 1.
(B) In the random number sequence, bits other than the most significant bit are allowed to take −1, 0, or 1 when the upper bit of the bit is 0, and the upper bit of the bit is −1. Or in the case of 1, only 0 is allowed.

  FIG. 2 shows an example of a processing procedure that is executed in the NAF random number sequence generation device of the present embodiment to generate a random number sequence that satisfies the NAF rules in order from the most significant bit (MSB) to the least significant bit (LSB). Indicates.

Here, the bit length of the NAF random number sequence to be generated is l, the random number generated by the internal random number generation unit 102 is rε [-1, 0, 1], and the generated NAF random number sequence is d _{l− 1} ,..., D ₀ .

  When l is input to the NAF random number sequence generation device of the present embodiment, j = l is executed in the control unit 101 (step S21).

  Thereafter, loop processing is performed.

First, j = j-1 is executed (step S22). Initially, j = j−1 = l−1, which focuses on the most significant bit (d _l−1 ).

  Next, the random number generation unit 102 generates a random number rε [−1, 0, 1] (step S23). The generated random number rε [−1, 0, 1] is received by the control unit 101.

  Next, the control unit 101 checks whether or not the random number r satisfies the NAF rule (step S24). If satisfied, the process proceeds to step S25. If not, the random number r is discarded. And return to step S23. An algorithm for determining whether or not the NAF rule is satisfied will be described later.

If the NAF rule is satisfied, d _j = r is executed (step S25). If the most significant bit (d _l-1 ) is focused, d _l-1 = r is executed. d _j = r is stored in the storage unit 103 and output by the output unit 104.

  Here, it is checked whether or not j = 0 (step S26). If j ≠ 0, the process returns to step S22 (j = j-1 is executed to focus on the next lower bit). Thereafter, the same processing is repeated until j = 0 in step S26.

  If j = 0 in step S26, all l-bit NAF random number sequences have been determined, and this process ends.

  In the above procedure example, the operation of the random number generation unit 102 and the operation of step S23 may be synchronized (the random number generation unit 102 operates only at the execution timing of step S23). There is no need for synchronization, and the random number generation unit 102 may always generate random numbers independently of surrounding operations.

  Here, an algorithm for determining whether or not the above NAF rule is satisfied will be described.

  FIG. 3 shows an example of a procedure for determining whether or not the NAF rule is satisfied when the generated random number r is adopted as the bit of the random number series.

  First, it is determined whether j = 1-1 (that is, whether it is the most significant bit) (step S31). If j = 1−1 (the most significant bit), the process proceeds to step S32. If j ≠ l−1 (not the most significant bit), the process proceeds to step S33.

If j = l−1 in step S31, the random number r (obtained in step S23 of FIG. 2) is 1 because only the most significant bit d _l-1 is allowed according to the NAF rule. If r = 1, it is determined that “r satisfies the NAF rule”. If r ≠ 1, “r does not satisfy the NAF rule”. The determination result is as follows.

On the other hand, if j ≠ l−1 in step S31 (not the most significant bit), it is checked whether or not the immediately preceding (one higher) bit d _{j + 1} is 0 (step S33). When d _{j + 1} = 0, any value of [−1, 0, 1] is allowed as d _j = r according to the NAF rule (without checking the value of r ), “R satisfies the NAF rule” as a determination result. When d _{j + 1} ≠ 0, only d _j = 0 is allowed according to the NAF rule, so whether r = 0 is checked (step S34). If r = 0, “r Is a determination result that “NAF rule is satisfied”, and if r ≠ 0, it is a determination result that “r does not satisfy the NAF rule”.

  As described above, according to the present embodiment, it is possible to generate a NAF random number sequence that satisfies the NAF rule.

(Second Embodiment)
In the first embodiment, since there is a process of repeating the loop until a random number satisfying the NAF rule is generated, the time until an all-bit NAF random number sequence is determined is uncertain. In this embodiment, the time until the determination of all l-bit NAF random number sequences is made substantially constant.

  In the present embodiment, a description will be given centering on differences from the first embodiment.

  The configuration example of the NAF random number sequence generation device according to this embodiment is the same as that of the first embodiment (see FIG. 1).

  FIG. 4 shows an example of a processing procedure that is executed in the NAF random number sequence generation device according to the present embodiment and sequentially generates a random number sequence satisfying the NAF rules from the most significant bit (MSB) to the least significant bit (LSB). Indicates.

As in the first embodiment, the NAF random number sequence to be generated is l, the random number generated by the internal random number generator 102 is rε [-1, 0, 1], and the generated NAF random number Let the series be d _l−1 ,..., D ₀ .

When l is input to the NAF random number sequence generation device of the present embodiment, the control unit 101 first executes _j = ₁₋₁ and d _j = 1 (step S41), whereby the most significant bit is changed. It is determined. The most significant bit d _l−1 = 1 is stored in the storage unit 103 and output by the output unit 104.

  Thereafter, loop processing is performed.

  First, j = j-1 is executed (step S42), thereby focusing on the next lower bit.

Next, it is checked whether or not the previous (upper) bit d _{j + 1} (in the first loop, the most significant bit d _l−1 ) stored in the storage unit 103 is 0 (step S43), When d _{j + 1} ≠ 0, the process proceeds to step S44, and when d _{j + 1} = 0, the process proceeds to step S45.

If d _{j + 1} ≠ 0 in step S43 (that is, d _{j + 1} = 1 or −1), the next bit value is always 0 according to the NAF rule, so d _j = 0 is set. Execute (step S44), and proceed to step S47. d _j = 0 is stored in the storage unit 103 and output from the output unit 104.

On the other hand, if d _{j + 1} = 0 in step S43, the ternary value [−1, 0, 1] is a candidate as the next possible bit value from the NAF rule. rε [−1, 0, 1] is generated (step S45), then d _j = r is executed (step S46), and the process proceeds to step S47. d _j = r is stored in the storage unit 103 and output from the output unit 104.

  Here, it is checked whether or not j = 0 (step S47). If j ≠ 0, the process returns to step S42 (j = j-1 is executed to focus on the next lower bit). Thereafter, the same processing is repeated until j = 0 in step S47.

  If j = 0 in step S47, all the 1-bit NAF random number sequences have been determined, and this process ends.

  In the above processing procedure, the most significant bit of the NAF random number sequence to be generated is given 1 without performing random number generation or loop processing, and loop processing is performed for bits other than the most significant bit. Instead, for the most significant bit of the NAF random number sequence to be generated and its lowermost bit, 1 and 0 are given without performing random number generation and loop processing, respectively. A configuration in which loop processing is performed on bits other than the lower-order bits is also possible.

  As described above, according to the present embodiment, it is possible to generate a NAF random number sequence that satisfies the NAF rule.

  In performing operations such as exponentiation and scalar multiplication that use a random number sequence as a power exponent, conventionally, after all the generation of the random number sequence is completed, NAF conversion is performed on the random number sequence, and then However, according to the first and second embodiments, as shown in FIG. 5 (a), the NAF random number sequence must be taken. Since the generation device can directly generate a NAF random number sequence and supply it to an arithmetic device that performs operations such as exponentiation and scalar multiplication, the processing speed can be increased. In addition, instead of performing operations such as exponentiation and scalar multiplication after generating all NAF random number sequences as shown in FIG. 5A, a NAF random number sequence generating device as shown in FIG. 5B. The NAF random number sequence is generated in order from the most significant bit (MSB) to the least significant bit (LSB), and the generated random number bit is given to an arithmetic unit that performs operations such as exponentiation and scalar multiplication, In parallel with this, the arithmetic unit can perform operations such as exponentiation and scalar multiplication. In this case, the processing can be further speeded up.

  By the way, the NAF random number sequence generation device of the first embodiment or the second embodiment, and one bit or a predetermined plurality of bits are used in order from the most significant bit (MSB) to the least significant bit (LSB) of the numerical sequence. Thus, an arithmetic processing device can be configured in combination with a device that performs a predetermined calculation.

  Hereinafter, in the third and fourth embodiments, a case where a power-residue calculating device is used as an example of a device that performs the predetermined calculation will be described, and in the fifth embodiment, a case where a scalar multiplication device is used is described as an example. I will explain to you.

(Third embodiment)
FIG. 6 illustrates a configuration example of the arithmetic processing device 200 according to the third embodiment.

  The arithmetic processing unit 200 according to the present embodiment performs exponentiation remainder calculation as a calculation unit that performs a predetermined calculation on the NAF random number sequence generation unit 120 corresponding to the NAF random number sequence generation device according to the first embodiment. The unit 105 is added. The power-residue calculating unit 105 may be an existing one.

  In the present embodiment, a description will be given centering on differences from the first embodiment.

  FIG. 7 shows an example of a processing procedure of NAF random number sequence generation and power-residue calculation executed in the arithmetic processing apparatus of the present embodiment.

As in the first embodiment, the NAF random number sequence to be generated is l, the random number generated by the internal random number generator 102 is rε [-1, 0, 1], and the generated NAF random number Let the series be d _l−1 ,..., D ₀ . In the present embodiment, the decimal value of the generated NAF random number sequence d _l−1 ,..., D _{0 is} the exponent d in the power-residue calculation, the value to be raised is x, and the method of the remainder calculation is n And

In this procedure example, when a bit length l of a NAF random number sequence that becomes a power exponent, a power value x, and a modulus n (n: prime) are input, a power-residue result y = x ^d mod n is output. In this case, as in the first embodiment, a random number sequence satisfying the NAF rule is generated in order from the most significant bit (MSB) to the least significant bit (LSB). The signed binary method is executed.

  When l, x, and n are input to the arithmetic processing unit of this embodiment, j = 1 is executed in the control unit 101, and y = 1 is executed in the power-residue calculating unit 105 (step S51).

  Thereafter, loop processing is performed.

First, j = j-1 is executed (step S52). Initially, j = j−1 = l−1, which focuses on the most significant bit (d _l−1 ).

  Next, the random number generation unit 102 generates a random number rε [−1, 0, 1] (step S53).

  Next, the control unit 101 checks whether or not the random number r satisfies the NAF rule (step S54). If satisfied, the process proceeds to step S55. If not, the control unit 101 discards the random number r. And return to step S53.

If the NAF rule is satisfied, d _j = r is executed (step S55). If the most significant bit (d _l-1 ) is focused, d _l-1 = r is executed. d _j = r is given to the power-residue calculating unit 105.

The power-residue calculating unit 105 first performs a square remainder calculation of y = y ² mod n (step S56).

Next, it is checked whether or not the bit d _j (the most significant bit d _{l-1 in the} first loop) of the previously determined NAF random number sequence is 1 (step S57), and d _j = 1. The process proceeds to step S58, and if d _j = 1 is not satisfied, the process proceeds to step S59. In the case where d _j = 1 is not satisfied in step S57, it is checked whether or not the bit d _j is −1 (step S59). If d _j = −1, the process proceeds to step S60.

If d _j = 1 in the above branch, a multiplication remainder of y = y · x mod n is performed (step S58), and the process proceeds to step S61. When d _j = −1, a multiplication remainder of y = y · x ⁻¹ mod n is performed (step S60), and the process proceeds to step S61. Here, x ⁻¹ represents the inverse element of x in modulus n. If d _j = 1 is not satisfied and d _j = −1 is not satisfied (that is, d _j = 0), the process proceeds to step S61 without doing anything.

Well, 3 branched treated in accordance with the value of d _j in step S57, S59 is focused to step S61.

  Then, the control unit 101 checks whether j = 0 (step S61). If j ≠ 0, the process returns to step S52 (j = j-1 is executed and one lower bit is executed. Thereafter, the same processing is repeated until j = 0 in step S61.

If j = 0 in step S61, the output y (= x ^d mod n) to be obtained has been obtained, and this process ends.

As described above, according to the present embodiment, it is possible to obtain an output y = x ^d mod n of a power-residue operation using a NAF random number sequence as a power exponent. Further, as shown in FIG. 5B, the processing speed can be increased.

(Fourth embodiment)
The configuration example of the arithmetic processing apparatus according to the fourth embodiment is the same as that of the third embodiment (see FIG. 6). However, in the third embodiment, a power-residue calculation unit that performs power-residue calculation as a calculation unit that performs a predetermined calculation on the NAF random number sequence generation unit 120 corresponding to the NAF random number sequence generation device of the first embodiment. In the fourth embodiment, the exponentiation remainder calculation is performed as a calculation unit that performs a predetermined calculation on the NAF random number sequence generation unit 120 corresponding to the NAF random number sequence generation device of the second embodiment. The power-residue calculating unit 105 is added (in this embodiment, the power-residue calculating unit 105 may be an existing one).

  In the present embodiment, a description will be given focusing on differences from the second and third embodiments.

  FIG. 8 shows an example of the processing procedure of NAF random number sequence generation and power-residue calculation executed in the arithmetic processing apparatus of the present embodiment.

As in the second embodiment, the NAF random number sequence to be generated is l, the random number generated by the internal random number generator 102 is rε [-1, 0, 1], and the generated NAF random number Let the series be d _l−1 ,..., D ₀ . Similarly to the third embodiment, the decimal value of the generated NAF random number sequence d _l−1 ,..., D _{0 is} the exponent d in the power-residue calculation, the power value is x, and the remainder calculation Let n be the modulus.

This example procedure is similar to the third embodiment. When a bit length l of a NAF random number sequence that becomes a power exponent, a power value x, and a modulus n are input, a power-residue result y = x ^d mod In this case, as in the second embodiment, a random number sequence satisfying the NAF rule is generated in order from the most significant bit (MSB) to the least significant bit (LSB). At the same time, the signed binary method is executed.

When l, x, and n are input to the arithmetic processing unit of the present embodiment, j = 1-1 and d _j = 1 are executed in the control unit 101 (step S71), whereby the most significant bit d _l-1 is determined to be 1.

Further, since the most significant bit d _l−1 is 1, the power-residue calculating unit 105 executes y = (1 ² · x) mod n = x mod n (step S71).

  Thereafter, loop processing is performed.

  First, j = j−1 is executed in the control unit 101 (step S72), thereby focusing on the next lower bit.

Next, it is checked whether or not the previous (upper) bit d _{j + 1} (in the first loop, the most significant bit d _l-1 ) stored in the storage unit 103 is 0 (step S73), When d _{j + 1} ≠ 0, the process proceeds to step S74, and when d _{j + 1} = 0, the process proceeds to step S75.

If d _{j + 1} ≠ 0 in step S73 (that is, d _{j + 1} = 1 or −1), the next bit value is always 0 according to the NAF rule, so d _j = 0 is set. Execute (Step S74). Subsequently, the power-residue calculating unit 105 executes a square-residue calculation y = y ² mod n (step S78), and proceeds to step S83.

On the other hand, if d _{j + 1} = 0 in step S73, since the three possible values of [−1, 0, 1] from the NAF rule are candidates, the random number generator 102 generates a random number. rε [−1, 0, 1] is generated (step S75), and the control unit 101 executes d _j = r (step S76), thereby determining the value of d _j . Next, the power-residue calculating unit 105 executes a square-residue calculation of y = y ² mod n (step S77), and proceeds to step S79.

Then, the modular exponentiation operation unit 105 (in the first loop, the lower bits d _l-2 one of the most significant bit) the d _j of NAF random number sequence previously determined is checked whether 1 (Step S79) If d _j = 1, the process proceeds to step S81. If d _j = 1 is not satisfied, the process proceeds to step S80. In the case where d _j = 1 is not satisfied in step S79, it is checked whether or not the most significant bit d _j of the previously determined NAF random number sequence is −1 (step S80). If d _j = −1, Proceed to step S82.

If d _j = 1 in the above branch, a multiplication remainder of y = y · x mod n is performed (step S81), and the process proceeds to step S83. If d _j = −1, a multiplication remainder of y = y · x ⁻¹ mod n is performed (step S82), and the process proceeds to step S83. Here, x ⁻¹ represents the inverse element of x in modulus n. If d _j = 1 and d _j = −1 are not satisfied (that is, d _l−1 = 0), the process proceeds to step S83 without doing anything.

Now, the processes branched according to the values of d _{j + 1} and d _j in steps S73, S79, and S80 converge to step S83.

  Then, the control unit 101 checks whether j = 0 (step S83). If j ≠ 0, the process returns to step S72 (j = j-1 is executed and one lower bit is executed. Thereafter, the same processing is repeated until j = 0 in step S83.

If j = 0 in step S83, the output y (= x ^d mod n) to be obtained has been obtained, and this process ends.

  In the above processing procedure, the most significant bit of the NAF random number sequence to be generated is given 1 without performing random number generation or loop processing, and correspondingly, y = x mod n is executed. However, the loop processing is applied to the bits other than the most significant bit. Instead, the generation of the random number and the loop processing are performed for the most significant bit of the NAF random number sequence to be generated and the next lower bit. Instead, 1 and 0 are given, respectively, and y = x mod n is executed corresponding to the most significant bit 1 so that the loop processing is performed on the bits other than the most significant bit and the bit lower than the most significant bit. A simple configuration is also possible.

As described above, according to the present embodiment, it is possible to obtain an output y = x ^d mod n of a power-residue operation using a NAF random number sequence as a power exponent. Further, as shown in FIG. 5B, the processing speed can be increased.

  In the embodiments described so far, an example using the binary method has been described, but the present invention can be similarly implemented using a method such as the window method. In the window method or the like, the output from the NAF random number sequence generation device 100 (NAF random number sequence generation unit 120) can be similarly applied by processing each desired bit length.

(Fifth embodiment)
In the third and fourth embodiments, the power-residue calculation has been described as an example, but it is also possible to replace it by scalar multiplication of points on the elliptic curve used in the elliptic curve cryptosystem.

  In the fifth embodiment, an example in which the modular exponentiation in the third and fourth embodiments is replaced with scalar multiplication will be described.

  Here, the scalar multiplication will be briefly described.

  Scalar multiplication refers to a process of deriving d times the point P on the elliptic curve, and the point P multiplied by d is represented as dP. This d is called a scalar value.

A scalar multiplication algorithm using a signed binary number representation is as follows.
(Step 0) Input: d, P
(Step 1) The integer d is expressed as a binary number as d = Σ (d _i · 2 ⁱ ) (k _i is obtained for each of i = 0 to l−1). Here, it is assumed that k _i εT, Tε [−1, 0, 1].
(Step 2) Q ← P
(Step 3) The following is repeated from i = 1−2 to 0.
(Step 3-1) Q ← 2Q
(Step 3-2) If d _i = 1, Q ← Q + P
(Step 3-3) If d _i = −1, Q ← Q−P
(Step 4) Output Q (= dP)
FIG. 9 shows a configuration example of the arithmetic processing device 300 of this embodiment.

  In the present embodiment, the arithmetic processing device 300 has a configuration in which a calculation unit 106 that performs a predetermined calculation is added to the NAF random number sequence generation unit 120 corresponding to the NAF random number sequence generation device of the first embodiment. In the present embodiment, the calculation unit 106 is a scalar multiplication unit that performs scalar multiplication (the scalar multiplication unit may be an existing one).

  In the present embodiment, a description will be given focusing on differences from the first and third embodiments.

  FIG. 10 shows an example of the processing procedure of NAF random number sequence generation and scalar multiplication executed in the arithmetic processing apparatus of this embodiment.

As in the previous embodiments, the bit length of the NAF random number sequence to be generated is l, the random number generated by the internal random number generator 102 is r∈ [-1, 0, 1], and the generated NAF random number Let the series be d _l−1 ,..., D ₀ .

  In this procedure example, when a bit length l of a NAF random number sequence that becomes a scalar value and a point P to be scalar-multiplied are input, a scalar multiplication result Q = dP is output. As in the first and third embodiments, a random number sequence satisfying the NAF rule is generated in order from the most significant bit (MSB) to the least significant bit (LSB), and at the same time, scalar multiplication is executed. It is.

  When l and P are input to the arithmetic processing apparatus of this embodiment, j = 1 is executed in the control unit 101, and Q ← Ο is executed in the scalar multiplication unit 106 (step S91). Here, Ο represents an infinite point and is a unit element of an elliptic curve on a finite field (eg, P + (− P) = Ο, P + Ο = −P).

  Thereafter, loop processing is performed.

First, j = j-1 is executed (step S92). Initially, j = j−1 = l−1, which focuses on the most significant bit (d _l−1 ).

  Next, the random number generation unit 102 generates a random number rε [−1, 0, 1] (step S93).

  Next, the control unit 101 checks whether or not the random number r satisfies the NAF rule (step S94). If satisfied, the process proceeds to step S95. If not, the control unit 101 discards the random number r. And return to step S93.

If the NAF rule is satisfied, d _j = r is executed (step S95). If the most significant bit (d _l-1 ) is focused, d _l-1 = r is executed. d _j = r is given to the scalar multiplication unit 106.

  The scalar multiplication unit 106 first performs point doubling of Q ← 2Q (step S96).

Next, it is checked whether or not the bit d _j (the most significant bit d _{l−1 in the} first loop) of the previously determined NAF random number sequence is 1 (step S97), and d _j = 1. In step S98, if d _j = 1 is not satisfied, step S99 follows. In the case where d _j = 1 in step S97, it is checked whether or not the most significant bit d _j of the previously determined NAF random number sequence is −1 (step S99). If d _j = −1, Proceed to step S100.

If d _j = 1 in the above branch, point addition of Q ← Q + P is performed (step S98), and the process proceeds to step S101. If d _j = −1, the point subtraction of Q ← Q−P is performed (step S100), and the process proceeds to step S101. Here, -P represents the inverse element of P. When d _j = 1 is not satisfied and d _j = −1 is not satisfied (that is, when d _j = 0), the process proceeds to step S101 without doing anything.

Well, 3 branched treated in accordance with the value of d _j in step S97, S99 is focused to step S101.

  Then, the control unit 101 checks whether j = 0 (step S101). If j ≠ 0, the control unit 101 returns to step S92 (j = j-1 is executed and one lower bit is executed. Thereafter, the same processing is repeated until j = 0 in step S101.

  If j = 0 in step S101, the output Q (= dP) to be obtained has been obtained, and this process ends.

  As described above, according to the present embodiment, it is possible to obtain a scalar multiplication output Q = dP using a NAF random number sequence as a power exponent. Further, as shown in FIG. 5B, the processing speed can be increased.

  Here, the method of performing processing from the most significant bit in the scalar multiplication unit 106 has been shown. However, by utilizing the fact that the most significant bit is always 1, as in the scalar multiplication algorithm shown above, first, A method of performing processing from the bit next to the most significant bit with Q ← P is also conceivable.

  In the present embodiment, the NAF random number sequence generation device (corresponding to the NAF random number sequence generation unit 120) of the first embodiment is combined with a scalar multiplication unit that performs scalar multiplication as a calculation unit that performs a predetermined calculation. As in the fourth embodiment, a scalar multiplication unit is combined with the NAF random number sequence generation device (corresponding to the NAF random number sequence generation unit 120) according to the second embodiment. An arithmetic processing unit can also be implemented.

  In addition, in the NAF random number sequence generation device of the first or second embodiment, a device that performs a calculation other than the scalar multiplication and power-residue calculation unit as a calculation unit that performs a predetermined calculation (in the process of the calculation, a NAF random number It is also possible to implement an arithmetic processing device that combines a random number sequence generated by a sequence generation device with one bit or a predetermined plurality of bits in order from the most significant bit (MSB) to the least significant bit (LSB). is there.

(variation)
By the way, in the description so far, in the NAF random number sequence generation device 100 of this embodiment, the occurrence probability of the ternary value [-1, 0, 1] generated by the random number generation unit 102 is changed to a certain ratio. This makes it possible to change the characteristics of the generated NAF random number sequence.

  For example, when the previous (upper) bit value is 0 in step S45 in FIG. 4 and the like, the next possible bit value is [-1, 0, 1], which is a ternary value. A method is conceivable in which the generation probabilities of the ternary random number rε [−1, 0, 1], which is the output of the random number generation unit 102, are set to 1/4, 1/2, 1/4, and the like, respectively. If the occurrence probability of 0 is high, it is expected that the number of non-zero coefficients of the generated NAF random number sequence tends to decrease.

  In Step S23 of FIG. 2 and Step S45 of FIG. 4 and the like, various variations can be considered as a method of changing the generation probability of the output from the random number generation unit 102 to an arbitrary ratio. For example, output from the random number generation unit 102 If the two-bit sequence to be generated is 00 or 11, it is determined to be 0, if it is 01, 1 if it is 10, and -1 if it is 1, the occurrence probability of the ternary random number rε [−1, 0, 1] will be This can be realized by setting the ratio to 4, 1/2, 1/4.

Each of the above functions can be realized even if it is described as software and processed by a computer having an appropriate mechanism.
The present embodiment can also be implemented as a program for causing a computer to execute a predetermined procedure, causing a computer to function as a predetermined means, or causing a computer to realize a predetermined function. In addition, the present invention can be implemented as a computer-readable recording medium on which the program is recorded.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

The figure which shows the structural example of the NAF random number sequence generation apparatus which concerns on the 1st and 2nd embodiment of this invention. The flowchart which shows an example of the process sequence of the NAF random number sequence generation apparatus which concerns on the 1st Embodiment of this invention. A flowchart showing an example of a processing procedure for determining whether or not the NAF rule is satisfied The flowchart which shows an example of the process sequence of the NAF random number sequence generation apparatus which concerns on the 2nd Embodiment of this invention. The figure for demonstrating NAF random number series generation | occurrence | production and the calculation performed following or in parallel with this The figure which shows the structural example of the arithmetic processing apparatus which concerns on the 3rd and 4th embodiment of this invention. The flowchart which shows an example of the process sequence of the arithmetic processing unit which concerns on the 3rd Embodiment of this invention. The flowchart which shows an example of the process sequence of the arithmetic processing unit which concerns on the 4th Embodiment of this invention. The figure which shows the structural example of the arithmetic processing apparatus which concerns on the 5th Embodiment of this invention. The flowchart which shows an example of the process sequence of the arithmetic processing unit which concerns on the 5th Embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... NAF random number sequence generation apparatus, 102 ... Random number generation part, 101 ... Control part, 103 ... Memory | storage part, 104 ... Output part, 105 ... Operation part, 106 ... Scalar multiplication part, 120 ... NAF random number series generation part, 200 , 300 ... arithmetic processing unit

Claims (12)

For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is A random number sequence generation device that generates a random number sequence satisfying a condition that only allows 0 in the case of -1 or 1;
Ternary random number generating means for generating a ternary random number taking -1, 0 or 1;
Based on the above conditions, all or part of the random numbers sequentially generated by the ternary random number generation means are used in the order of generation, and from the most significant bit to the least significant bit of a random number sequence having an arbitrary bit length to be generated. And a random number sequence generating means for generating a random number sequence that satisfies the condition by determining the value of each bit so that the condition is satisfied bit by bit in order. . The random number sequence generation means includes:
If the random number generated by the ternary random number generation means is concatenated as the least significant bit of the random number sequence generated so far, does the random number sequence obtained thereby satisfy the condition? The random number having the arbitrary bit length is obtained by repeatedly performing the process of concatenating the random number as the least significant bit at the time of the random number sequence generated so far. The random number sequence generation device according to claim 1, wherein the sequence is generated. The random number sequence generation means includes:
The most significant bit of the random number sequence having the arbitrary bit length to be generated is given 1 without using the random number generated by the ternary random number generating means, and the most significant bit of the random number sequence having the arbitrary bit length to be generated For each bit other than the upper bit, when the upper bit of the bit is −1 or 1 in order from the bit lower than the highest bit to the lowest bit, the ternary random number generation unit generates the bit. Without using a random number to be used, when 0 is given as the bit, and when the upper bit of the bit is 0, the random number generated by the ternary random number generation means is used as the value of the bit, The random number sequence generation apparatus according to claim 1, wherein the random number sequence having an arbitrary bit length is generated. The random number sequence generation means includes:
The most significant bit of the random number sequence having the arbitrary bit length to be generated is given 1 without using the random number generated by the ternary random number generating means, and the most significant bit of the random number sequence having the arbitrary bit length to be generated For the lower bit of the upper bit, 0 is given without using the random number generated by the ternary random number generation means, and the most significant bit and the most significant bit of the random number sequence of the arbitrary bit length to be generated For each bit other than the one lower-order bit, when the higher-order bit of the bit is −1 or 1 in order from the lower-most bit to the lowest-order bit, the ternary random number generation is performed. The random number generated by the ternary random number generation means when 0 is given as the bit without using the random number generated by the means and the upper bit of the bit is 0 By using as the value of the bit, the random number sequence generating device of claim 1, wherein generating a random number sequence of the arbitrary bit length.   5. The ratio of the occurrence probability of −1, the probability of occurrence of 0, and the probability of occurrence of 1 when the ternary random number generation means generates the random number is set as a specific ratio. The random number sequence generation device according to claim 1.   2. The main means for sequentially outputting the random number sequence generated by the random number sequence generation means one bit or a plurality of bits sequentially from the most significant bit to the least significant bit. 6. The random number sequence generation device according to any one of 5 above. For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is A random number sequence generation method in a random number sequence generation apparatus for generating a random number sequence that satisfies a condition that only allows 0 in the case of -1 or 1;
A ternary random number generation step in which the ternary random number generation means included in the random number sequence generation device generates a ternary random number taking -1 , 0 or 1;
The random number sequence generating device comprises random number sequence generating means, based on said conditions, using all or part of the random number more sequentially generated in the ternary number generating means to the generation order in the ternary random number generation steps However, by determining the value of each bit so as to satisfy the condition one bit at a time in order from the most significant bit to the least significant bit of the random number sequence having an arbitrary bit length to be generated, the condition is satisfied. A random number sequence generation method comprising: a random number sequence generation step of generating a random number sequence. For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is in the case of -1 or 1 a program for causing a computer to function as a random number sequence generating device for generating satisfies random number sequence it is only allowed to take 0,
- a ternary random number generating means for generating a ternary random taking 1,0 or 1,
Based on the previous SL conditions, while sequentially using all or part of the generated random numbers to the generated order, least significant bit from the most significant bits of any bit length random number sequence to be generated by the previous SL ternary number generating means A program that causes a computer to function as random number sequence generation means for generating a random number sequence that satisfies the above condition by determining the value of each bit so as to satisfy the above condition one bit at a time. For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is Arithmetic processing device comprising: a random number sequence generation unit that generates a random number sequence that satisfies conditions that are only allowed to take 0 in the case of -1 or 1; and an operation unit that performs an operation using the random number sequence as a power exponent Because
The random number sequence generation unit includes:
Ternary random number generating means for generating a ternary random number taking -1, 0 or 1;
Based on the above conditions, all or part of the random numbers sequentially generated by the ternary random number generation means are used in the order of generation, and from the most significant bit to the least significant bit of a random number sequence having an arbitrary bit length to be generated. Random number sequence generation means for generating a random number sequence satisfying the above condition by determining the value of each bit so as to satisfy the above condition one bit at a time .
The arithmetic unit, in parallel with the generation of the random number sequence by the random number sequence generation unit, the random number sequence generated by the random number sequence generation unit, one or more bits from the most significant bit toward the least significant bit An arithmetic processing apparatus comprising means for performing a specific repetitive process while sequentially using each one.   The arithmetic processing apparatus according to claim 9, wherein the calculation is a power-residue calculation or a scalar multiplication of elliptic curve cryptography. For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is Starring with the random number sequence generating unit in the case of -1 or 1 that generates a satisfying random number sequence is only allowed to take 0, a row intends calculating unit a calculation to use as an index to the random number sequence An arithmetic processing method in an arithmetic processing device,
A ternary random number generation step in which the ternary random number generation means included in the random number sequence generation unit generates a ternary random number taking -1 , 0, or 1;
The random number sequence generating unit comprises a random number sequence generating means, based on said conditions, using all or part of the random number more sequentially generated in the ternary number generating means to the generation order in the ternary random number generation steps However, by determining the value of each bit so as to satisfy the condition one bit at a time in order from the most significant bit to the least significant bit of the random number sequence having an arbitrary bit length to be generated, the condition is satisfied. A random number sequence generation step for generating a random number sequence;
The calculation unit, the random number sequence generating step in parallel with the said random number sequence according to the random number sequence generating unit generates the flop, the random number sequence generation step wherein a random number sequence further generated in the random number sequence generating means in the flop And a step of performing a specific repetitive process while sequentially using one or a plurality of bits from the most significant bit toward the least significant bit. For the most significant bit, only 1 is allowed. For bits other than the most significant bit, if the upper bit is 0, it is allowed to take either -1, 0, or 1, and the upper bit is in the case of -1 or 1 generates an satisfies random number sequence is only allowed to take 0, generated for causing a computer to function operations to be used as index to the random number sequence as a row cormorants arithmetic processor a of the program,
- a ternary random number generating means for generating a ternary random taking 1,0 or 1,
Based on the previous SL conditions, while sequentially using all or part of the generated random numbers to the generated order, least significant bit from the most significant bits of any bit length random number sequence to be generated by the previous SL ternary number generating means a random number sequence generation means by it is determined where the value of each bit so as to satisfy the condition bit by bit sequentially to generate the satisfying random sequence toward,
In parallel with the generation of the previous SL-random number sequence generating means according to said random number sequence, using the previous SL random number sequence generation the random number sequence generated by the means, in order from the most significant bit by one or more bits toward the least significant bit On the other hand, a program that causes a computer to function as arithmetic means for performing a specific repetitive process.

Images