JP4629972B2 - Vector computing device, divided value computing device, elliptic curve scalar multiplication device, elliptic cryptography computing device, vector computing method, program, and computer-readable recording medium recording the program - Google Patents

Description

  The present invention relates to a vector computing device, a divided value computing device, an elliptic curve scalar multiplication device, an elliptic cryptography computing device, or each method. In particular, the present invention relates to a method for performing elliptic cryptography calculation at high speed and a calculation device using the method.

In order to perform elliptical cryptographic computation at high speed, it is essential to increase the speed of scalar multiplication. Until now, various methods for speeding up scalar multiplication have been proposed. In recent research, the constant K is set to K = k ₁ + k ₂ φ (or k ₁ + k ₂ λ, where λ is φ on the point group using a special homomorphic map φ that is an auto-homogeneous map that can be calculated efficiently. (Scalar multiple given by) is expressed (divided), and there is a technique in which the calculation efficiency is improved (see Non-Patent Document 1).

  Moreover, the result of evaluating how much the division method in Non-Patent Document 1 increases the calculation efficiency is known (see Non-Patent Document 2).

  Further, a result of improving the division method in Non-Patent Document 1 so as to further increase the calculation efficiency is known (see Non-Patent Document 3). Hereinafter, the K division method described in Non-Patent Document 3 will be described.

The division of K starts by first obtaining vectors (bases) V ₁ and V ₂ that are not linearly dependent on the scalar K in the following procedure. The mapping f from the linear space of the two-dimensional integer coefficient to the one-dimensional linear space is f: (i, j) → i + λj (mod n) (where mod n means the remainder obtained by dividing i + λj by n) It is determined. If a two-dimensional subspace that becomes 0 at f is written as Ker f, it is assumed that the absolute value of the component becomes smaller (the number of bits decreases) in the bases V ₁ and V ₂ of Ker f. Is required. When using V ₁ and V ₂ to calculate a small vector u = (k ₁ , k ₂ ) such that f (u) = K, u becomes K = k ₁ + k ₂ φ (or k ₁ + k ₂ λ). It can be seen that k ₁ and k ₂ are given.

Since V ₁ and V ₂ are linearly independent, it can be seen that there exist rational numbers β ₁ and β _{2 such} that (K, 0) = β ₁ · V ₁ + β ₂ · V _2, and they can be easily calculated. b ₁ : = “an integer closest to β ₁ ”, b ₂ : = “an integer closest to β ₂ ”, u: = (K, 0) − (b ₁ · V ₁ + b ₂ · V ₂ ) Thus, “K division” is obtained.

A conventionally known search algorithm for the small bases V ₁ and V ₂ will be described.

Using the order n of the elliptic curve rational point group and the scalar λ defined by the elliptic curve special homomorphism as inputs, using the extended Euclidean algorithm in step S101, | r _{m + 1} |, | t _{m + 1} | <√n, s _{m + 1} Calculate V ₁ : = (r _{m + 1} , −t _{m + 1} ) such that n + t _{m + 1} • λ = r _{m + 1} , gcd (s _{m + 1} , t _{m + 1} ) = 1. Here, the notation such as rm _{+ 1} represents the variable r indexed as m + 1. The symbol “: =” means that left is defined as right.

Next, in step S102, it is checked whether the max norm of the vector (r _m , −t _m ) or (r _{m + 2} , −t _{m + 2} ) configured using the intermediate variable of the extended Euclidean algorithm is smaller than √n. If so, let the vector be V ₂ . If not, go to the next step. Here, for example, the max norm for the values i and j indicates the larger value of the absolute value | i | of the value i and the absolute value | j | of the value j.

In step S103, v ′ and w ′ that satisfy s _{m + 1} · v′−t _{m + 1} · w ′ = 1 are calculated using the extended Euclidean algorithm.

In step S104, I ₁₁ : = − v ′ / t _{m + 1} −√n / t _{m + 1} , I ₁₂ : = − v ′ / t _{m + 1} + √n / t _{m + 1,} and if t _{m + 1} > 0, I ₁ : = [I ₁₁ , I ₁₂ ] (closed interval), otherwise I ₁ : = [I ₁₂ , I ₁₁ ].

Next, in step S105, I ₂₁ : = (v ′ · λ−w ′ · n) / r _{m + 1} −√n / r _{m + 1} , I ₂₂ : = (v ′ · λ−w ′ · n) / r _{m + 1} + √n / r _{m + 1} , I ₂ : = [I ₂₁ , I ₂₂ ].

Next, in step S106, for all integers α∈I ₁ ２I ₂ , a vector (u, = w ′ · n−v ′ · λ + αr _{m + 1} , v: = v′−α · t _{m + 1)} v) consider, what max norm minimum therein as _{V 2,} and outputs the V 1, _{V 2.}
R. P. Gallant, J .; L. Lambert and S. A. Vanstone, “Faster point multiplication on electrical curves with effective endomorphisms”, Crypto 2001, Springer Verlag, (2001), 190-200. F. Sica, M.M. Ciet, J .; -J. Quisquater, “Analysis of the Gallant-Lambert-Vanstone method based on efficient endomorphisms: elliptic and hyperplastic curves”, SAC 200, p. D. Kim, S .; Lim, “Integration decomposition for fast scalar multiplication on elliptic curves”, SAC 2002, Springer Verlag, (2002), 13-20.

  Along with the practical application of advanced information communication technology in recent years, public key cryptography including elliptical cryptography has already been put into practical use, but on an IC card that has only a CPU with a small clock (Central Processing Unit) or cannot be installed. It is indispensable to use it in environments where computing resources are limited in order to perform cryptographic operations in Windows and ensure information security in the ubiquitous environment. In other words, an improvement in cryptographic computation calculation speed is eagerly desired.

However, the V ₁ and V ₂ search methods of the above prior art cannot always search for the shortest basis. Therefore, the best K division could not be given. That is, sufficiently small values of k ₁ and k ₂ could not be obtained. That is, the cryptographic computation calculation speed is slow, and in particular, it has not been possible to sufficiently cope with the cryptographic computation execution on the IC card and the ubiquitous environment.

An object of the present invention is to search for V ₁ and V ₂ that are shorter than the V ₁ and V ₂ search methods.

Another object of the present invention is to further reduce the values of k ₁ and k _{2 in} the division K = k ₁ + k ₂ φ (or k ₁ + k ₂ λ).

  Another object of the present invention is to perform a scalar multiplication operation at high speed, that is, to perform an elliptic encryption operation at high speed.

In the vector arithmetic unit according to the present invention, the scalar K used for multiplying a point on the elliptic curve by a scalar K is converted into a special homomorphic map φ, which is a self-homogeneous map, and divided values k ₁ and k ₂ . Using the scalar K = k ₁ + k ₂ φ, the mapping f from the linear space of the two-dimensional integer coefficient to the one-dimensional linear space is f: (i, j) → i + λj (mod n) (where mod n is , I + λj is a remainder obtained by dividing n by n), and a two-dimensional subspace where the mapping f is 0 is Ker f, which is the basis vector of Ker f and has the smallest absolute value of the basis vector component The vector V ₁ and the vector V ₂ are those except for those whose absolute value is zero, and the vector V ₁ and the vector V ₂ are used, and the small vector u = (k _1, when _{k 2)} to calculate the In vector arithmetic unit small vector u is computed and vector _{V 1} and vector _{V 2} to provide a _k 1, _{k 2} of _{K = k} 1 + k _{2 φ} of the scalar K,
The vector V ₁ calculator for calculating the vector V ₁ using the extended Euclidean algorithm,
A plurality of sets A _h having a plurality of integer values are calculated using the extended Euclidean algorithm, and a plurality of integer values α included in the plurality of sets A _h having a plurality of calculated integer values are used. and vector _{V 2} calculator for calculating a vector _{V 2,}
Characterized by comprising a vector output unit for outputting a vector V ₂ calculated by the vector V ₁ and the vector V ₂ calculation section calculated by the vector V ₁ arithmetic unit.

According to the present invention, in the conventional method, it is possible to obtain a further increase in speed compared to the elliptic curve cryptography method that still has room for improvement, and it can be used even in an environment where the calculation resources are limited. It is possible to search for V ₁ and V ₂ that can realize a cryptographic function that exhibits high performance.

  An elliptic cryptography arithmetic device described below includes an input unit for inputting a point and a scalar on a predetermined elliptic cryptography, a vector arithmetic device for computing a vector that is a source of the predetermined scalar division value arithmetic device and the division value arithmetic device, and A scalar multiplication unit that performs elliptic curve scalar multiplication using a predetermined scalar division value. Then, an operation is performed on the predetermined ellipse parameter and scalar input by the input unit, and an elliptic curve scalar multiplication is performed using the predetermined scalar division value.

Embodiment 1 FIG.
First, public key cryptography, discrete logarithm problem, and elliptic cryptography will be briefly described. In public key encryption communication, a set of a secret key x and a public key y is prepared for each user, and the secret key x is kept secret by each user. The public key y is disclosed to the public other than the user himself / herself. When user B wants to secretly send data to user A, user B encrypts the data using public key y corresponding to user A. This ciphertext can only be decrypted by the user A who knows the secret key x.

The discrete logarithm problem is a problem of obtaining m such that g ₁ = mg ₂ is satisfied for _two elements g ₁ and g ₂ of the algebraic group G (addition is defined). When the number of elements of the algebraic group G is large, it is known that solving many discrete logarithm problems becomes very difficult in terms of computational complexity. Public key cryptography can be designed using this fact.

Discrete logarithm type public key cryptography often the formula and g ₂ defining an algebraic group G as the public key encryption parameters, the public key g _1, the m and its private key.

The elliptic curve C on the finite field GF (q) (q is a power of a prime number p) is y ² + h (x) y = f (x) (h (x), f (x) is GF (q) The coefficients are at most first-order and third-order polynomials, and f (x) is an equation in which the highest-order coefficient is expressed as 1). An addition is defined for the rational point set of C to form a group. Public key cryptography using these groups is called elliptical cryptography.

That is, in the case of elliptic cryptography, the coefficient of the equation y ² + h (x) y = f (x) and the point (x ₀ , y ₀ ) above it become the elliptic cryptography parameters and are calculated according to the addition on the elliptic curve. (X ₁ , y ₁ ) ((x ₁ , y ₁ ) satisfies (x ₁ , y ₁ ) = K · (x ₀ , y ₀ )) is the public key, and scalar K is the private key Become.

Here, if the value of the scalar K is large, the calculation takes time. For example, in the case of elliptic encryption, K uses a binary value of 160 bits. Here, when the bit values of 160 bits are sequentially added to the elliptic encryption parameter, a considerable time is required. Therefore, by expressing (dividing) the scalar K as K = k ₁ + k ₂ φ (or k ₁ + k ₂ λ, where λ is a scalar multiple given by φ on the point group), the number of bits of k ₁ or k ₂ φ The amount of calculation will be sufficient. For example, if the point on the elliptic curve that is the elliptic encryption parameter is P, the scalar multiplication is KP = k ₁ · P + k ₂ · λP. Assuming that P + λP = S in advance, if the bit value at a predetermined position is k ₁ = 1 and k ₂ = 0, the calculation is performed using P, and if k ₁ = 0 and k ₂ = 1, λP is If k ₁ = 1 and k ₂ = 1, the calculation is performed using S. If k ₁ = 0 and k ₂ = 0, the calculation is not necessary. Therefore, for each position, the calculation is performed using P, λP, or S, and the calculation amount of the number of bits of k ₁ or k ₂ φ is sufficient. For example, assuming that the scalar K has the same number of bits as the order n of the elliptic curve rational point group, the number of bits of k ₁ and k ₂ φ becomes approximately close to √n. That is, the number of calculations is reduced accordingly, and the calculation speed can be increased.

First, a vector V used for obtaining divided values k ₁ and k ₂ for dividing the scalar K, which is used to multiply a point on the elliptic curve by a scalar K, using a special homomorphism map φ. A vector computing device that computes ₁ and the vector V ₂ will be described.

  FIG. 1 is a diagram illustrating a configuration of a vector arithmetic device according to the first embodiment.

In FIG. 1, the vector calculation device 400 includes an input unit 401, a vector V ₁ calculation unit 402, a vector V ₂ calculation unit 420, an output unit 411, a storage unit 412, and a control unit 413. Vector _{V 2} calculation section 420 has a calculation section 403,404,405,406,407,408,409,410.

Vector _{V 1} computing unit 402 computes a vector _{V 1} using the extended Euclidean algorithm.

The vector V ₂ computing unit 420 computes a plurality of integer sets A _h using the extended Euclidean algorithm and uses the plurality of integer values α included in the computed plurality of integer sets A _h to generate a vector V 2. ₂ is calculated.

  The storage unit 412 stores the value input by each unit, the calculated or calculated value, and the output value.

  The control unit 413 controls each unit. Here, in FIG. 1, the control unit 413 that controls the whole is provided, but a mechanism that controls itself may be provided for each unit.

The output unit 411 as a vector output unit outputs the vector _{V 2} calculated by the vector _{V 1} and the vector _{V 2} calculation unit 420 calculated by the vector _{V 1} arithmetic unit 402. The output unit 411 may output a vector input from each calculation unit or calculation unit, or may output a vector stored in the storage unit 412.

  FIG. 2 is a diagram showing a flowchart of the vector calculation method in the first embodiment.

  First, the input unit 401 inputs the order n of the elliptic curve rational point group, which is an integer, and the scalar λ defined by the elliptic curve special homomorphism map φ.

In step S201, as the vector V ₁ calculation step, the vector V ₁ calculation unit 402 uses the order n and scalar λ input by the input unit 401 to determine the formula defined by the extended Euclidean algorithm: s _i · n + t _{For i} · λ = r _i , i = 0, 1, 2, 3... m, m + 1, m + 2 are sequentially calculated, and the absolute value | r _i | <√n for the variable r _{i and} for the variable t _i An absolute value | r _{m + 1} | <√n, an absolute value | t _{m + 1} | <√n, s _{m + 1} · n + t _{m + 1} · λ = r _{m + 1} , where _{m + 1 is} the minimum index i that satisfies the absolute value | t _i | <√n. s _{m + 1} and _{t m + 1} greatest common divisor of _{gcd (s m + 1, t} m + 1) = 1 and becomes a variable _{s m + 1, t m +} 1, calculates a _{r m + 1.} Then, a vector V ₁ : = (r _{m + 1} , −t _{m + 1} ) is calculated using the calculated variables r _{m + 1} and t _{m + 1} . Here, when the extended Euclidean algorithm is used as an initial value and the variables s ₀ = 1, t ₀ = 0, r ₀ = n, s ₁ = 0, t ₁ = 1, r ₁ = λ, s _i · n + t _{i · λ = r i (i} = 0,1,2, ...) to become the column _{(s i, t i, r} i) (i = 0,1,2, ...) . However get a recurrence, they The minimum index i that satisfies | r _i |, | t _i | <√n in the column is defined as m + 1. The symbol “: =” indicates that the description on the left side of the symbol is defined by the description on the right side of the symbol. The same applies hereinafter.

In step S202, as part of the vector _{V 2} calculating step, calculating unit 403 sequentially calculated intermediate variable in accordance extended Euclid method by vector _{V 1} calculation section 402 _(r m, -t _m) or (r _It is checked whether the max norm of _{m + 2} , −t _{m + 2} ) is smaller than √n, and if so, the vector is set as vector V ₂ . If not, go to the next step. Here, for example, the max norm for the values i and j indicates the larger value of the absolute value | i | of the value i and the absolute value | j | of the value j.

In step S203, as part of the vector V ₂ operation step, variables v ', w' calculating unit 404 as an example of a calculating unit, which is calculated by the vector V ₁ arithmetic unit using the extended Euclidean algorithm Using the variables s _{m + 1} and t _{m + 1} , the variables v ′ and w ′ that satisfy s _{m + 1} · v′−t _{m + 1} · w ′ = 1 are calculated (calculated).

In step S204, as part of the vector _{V 2} calculating step, calculating section 405 is determined using the value r, s defined as a coefficient of the special homomorphism minimum polynomial φ satisfies ^{(X 2 + r · X +} s) Using the constant k *, values satisfying − (2k * −1) ≦ h ≦ 2k * −1 and h ≠ 0 are sequentially input to the integer value h. Here, k *: = “minimum integer value greater than or equal to √ (1+ | r | + s) value”. Thereafter, the following steps S205 to S208 are repeated from h = − (2k * −1) to 2k * −1.

In step S205, as part of the vector V ₂ operation step, the variable v ", w" calculator 406 as an example of the arithmetic unit as a parameter for determining the interval described below, is calculated by the calculation unit 404 The variables v "and w" obtained by multiplying the variables v 'and w' by the integer value h are calculated. That is, the calculation unit 406 calculates v “: = hv ′, w ″: = hw ′.

Next, in step S206, as a closed interval I ₁ calculation step that is a part of the vector V ₂ calculation step, the calculation unit 407 as an example of the closed interval I ₁ calculation unit includes a minimum polynomial ( Integer value h (h is − (2k * −1) ≦ h ≦ 2k * −1, h ≠ 0) using a constant k * determined using values r and s determined as coefficients of X ² + r · X + s). met) using only the number of the plurality of integers integer value h can be taken, and calculates a definite extreme values of the one between predetermined closed interval I ₁ of the search range of integer α described later. Here, the calculation unit 407 calculates both end values of the predetermined closed section I ₁ using the variables v “, w” calculated by the calculation unit 406. First, I ₁₁ : = − v “/ t _{m + 1} −k * · √n / t _{m + 1} , which is one end of the determination of the search range of the integer α, which will be described later, is calculated. I ₁₂ : = − v “/ t _{m + 1} + k * · √n / t _{m + 1} which is the other end of the first determination of the range is calculated. If t _{m + 1} > 0, the closed section I ₁ : = [I ₁₁ , I ₁₂ ] is set. Otherwise, the closed section I ₁ : = [I ₁₂ , I ₁₁ ] is set. Here, the closed interval, e.g., closed interval _{I 1: =} if [I _{12, I 11],} including the end values _{I 12, I 11,} between the end value _{I 12} to the end value _{I 11} Indicates the range.

Next, in step S207, the calculation unit 408 as an example of the closed interval I ₂ calculation unit is used as the closed interval I ₂ calculation step which is a part of the vector V ₂ calculation step, and the integer value h used by the calculation unit 407 is used. Is used to calculate the _two end values of the predetermined closed section I2 of the search range of the integer α, which will be described later, as many as the number of integer values that the integer value h can take. Here, the calculation unit 408 calculates the both end values of the predetermined closed section I ₂ using the variables v “, w” calculated by the variables v “, w” calculation unit. First, I ₂₁ : = (v “· λ−w” · n) / r _{m + 1} −√n / r _{m + 1} which is one end of the second determination of the integer α search range described later is calculated. Then, I ₂₂ : = (v “· λ−w” · n) / r _{m + 1} + √n / r _{m + 1} , which is the other end of the second determination of the integer α search range described later, is calculated. Then, the closed section I ₂ : = [I ₂₁ , I ₂₂ ].

Next, in step S208, as a set A _h calculation step which is a part of the vector V ₂ calculation step, the calculation unit 409 as an example of the set A _h calculation unit performs an operation by the calculation unit 407 using the integer value h. included together with a predetermined closed interval I ₂ determined by the predetermined closed interval I ₁ and the calculating unit 408 with a predetermined extreme values for the closed interval I ₂ calculated by determined by predetermined extreme values for the closed interval I _1, which is A set of integers A _h to be calculated is calculated. In other words, the set A _h : = “a set of integers included in I ₁ ∩I ₂ ”. Then, the process returns to S204. In S204, values are sequentially input to the integer value h, and a loop calculation is performed from S204 to S208. As a result, the number of integer values that can be taken by the integer value h is calculated. Set _Ah is calculated.

After completing the loop, at step S209, which is part of the vector V ₂ operation step vector (u, v) as the calculation process, the calculation unit 410 as an example of a vector (u, v) computing unit, the computing Using the plurality of integer values α included in the plurality of integer sets A _h calculated by the unit 409 (h satisfies − (2k * −1) ≦ h ≦ 2k * −1, h ≠ 0) A plurality of vectors (u, v) are calculated. Here, all the h (- (2k * -1) ≦ h ≦ 2k * -1, h ≠ 0), for integer _{α∈A h, u: = h ·} w'n-h · v'λ + αr A vector (u, v) with _{m + 1} , v: = hv′−α · t _{m + 1} is calculated.

Then, the max-norm calculation step which is part of the vector V ₂ calculating step, calculating section 410 is also an example of a max norm calculation unit, said vector (u, v) a plurality of vectors (u calculated by the calculating unit, v) the max norm calculated for, among max norm of the calculated plurality of vectors (u, v), max norm outputs smallest vector (u, v) as the vector _{V 2} to the output unit 411 . That is, the calculation unit 403 outputs V ₁ and the calculation unit 410 outputs V ₂ to the output unit 411.

The output unit 411 as a vector output unit outputs the vector V ₂ calculated by the vector V ₁ and the vector V ₂ calculation section calculated by the vector V ₁ arithmetic unit.

As described above, the number of integer values that can be taken by the integer value h is calculated, and by using a plurality of sets of integers A _h obtained as a result, the integer α that cannot be picked up by the prior art is obtained. The search range of can be expanded within a reasonable range, and the search range has expanded.
In the prior art, the shortest basis that could not be obtained can be searched.

Next, a divided value calculation device serving as a predetermined scalar divided value calculation device that performs “K division” using V ₁ and V ₂ will be described.

  FIG. 3 is a diagram illustrating a configuration of the divided value calculation apparatus according to the first embodiment.

  In FIG. 3, the divided value calculation device 500 includes an input unit 501, a divided value calculation unit 520, a divided value output unit 505, a storage unit 506, and a control unit 507. The division value calculation unit 520 includes calculation units 502, 503, and 504.

The input unit 501 as a vector input unit inputs the vector V ₁ and the vector V ₂ calculated by the vector calculation device 400.

The division value calculation unit 520 calculates the division values k ₁ and k _{2 of the} scalar K using the vector V ₁ and the vector V ₂ input by the input unit 501.

  The storage unit 506 stores a value input by each unit, a calculated or calculated value, and an output value.

  The control unit 507 controls each unit. Here, in FIG. 3, the control unit 507 for controlling the whole is provided, but a mechanism for controlling itself may be provided for each unit.

An output unit 505 serving as a divided value output unit outputs the divided values k ₁ and k _{2 of} the scalar K calculated by the divided value calculating unit 520. The output unit 505 may output the division value input from each calculation unit or calculation unit, or may output the division value stored in the storage unit 506.

  FIG. 4 is a diagram illustrating a flowchart of the division value calculation method according to the first embodiment.

The division of K starts by first obtaining vectors V ₁ and V ₂ that are not linearly dependent on the scalar K, by the following procedure. Using the order n of an elliptic curve rational point group that is an integer and the scalar λ defined by the elliptic curve special homomorphism map φ, the mapping φ from the linear space of the two-dimensional integer coefficient to the one-dimensional linear space is φ : (I, j) → i + λj (mod n) (where mod n means a remainder obtained by dividing i + λj by the order n of an elliptic curve rational point group which is an integer). If a two-dimensional subspace in which φ is 0 is written as Ker φ, in order to obtain a sufficiently small “K division”, the components of Ker φ bases V ₁ and V ₂ are as small as possible. It is necessary to take Using v ₁ and V ₂ and calculating a small vector u = (k ₁ , k ₂ ) such that φ (u) = K with u = (i, j), u becomes K = k ₁ + k _It can be seen that k ₁ and k ₂ which are 2φ (or k ₁ + k ₂ λ) are given.

First, the input unit 501 inputs a scalar K that is an integer and a vector V ₁ and a vector V ₂ that are bases.

In step S301, since V ₁ and V ₂ are linearly independent, it can be seen that there are rational numbers β ₁ and β _{2 such} that (K, 0) = β ₁ · V ₁ + β ₂ · V ₂ . Rational numbers β ₁ and β ₂ are calculated.

In step S302, the calculation unit 503 calculates b ₁ : = “an integer closest to β ₁ ” and b ₂ : = “an integer closest to β ₂ ”.

In step S <b> 303, the calculation unit 504 calculates u: = (K, 0) − (b ₁ · V ₁ + b ₂ · V ₂ ). That is, if vector V ₁ = (r _{m + 1} , −t _{m + 1} ) and vector V ₂ = (u, v), u = (k ₁ , k ₂ ) = (K, 0) − (b ₁ · V ₁ + b ₂ · V ₂ ) = ((β ₁ −b ₁ ) r _{m + 1} + (β ₂ −b ₂ ) u, − (β ₁ −b ₁ ) t _{m + 1} + (β ₂ −b ₂ ) v) Thus, as “K division”, k ₁ = (β ₁ −b ₁ ) r _{m + 1} + (β ₂ −b ₂ ) u, k ₂ = − (β ₁ −b ₁ ) t _{m + 1} + (β ₂ −b ₂ ) Obtain v.

Then, the output unit 505 outputs “K division” u = (k ₁ , k ₂ ).

As described above, the best division of K can be obtained by using the shortest basis obtained by the integer α in the search range that has been appropriately expanded by using a plurality of sets A _h of integers. That is, sufficiently small values of k ₁ and k ₂ can be obtained.

  Next, an elliptic cryptography calculation device will be described.

  FIG. 5 is a diagram illustrating a configuration of the elliptical cryptographic operation apparatus according to the first embodiment.

  In FIG. 5, an elliptic cryptographic operation device 600 (an example of an elliptic curve scalar multiplication device) includes a parameter input unit 610, a divided value input unit 620, a scalar multiplication operation unit 630, a scalar multiplication output unit 640, a storage unit 650, A control unit 660, a vector calculation device 400, and a division value calculation device 500 are provided. Vector computing device 400 and divided value computing device 500 may be configured as separate devices.

  The parameter input unit 610 inputs a scalar K and a point on the elliptic curve as parameters.

The divided value input unit 620 inputs the divided values k ₁ and k _{2 of the} scalar K that is the secret key calculated by the divided value calculation device 500.

The scalar multiplication unit 630 uses the division values k ₁ and k ₂ input by the division value input unit 620 to perform a scalar K multiplication operation on the parameters input by the parameter input unit 610.

  The storage unit 650 stores values input by the above-described units, calculated or calculated values, and output values. The storage unit 650 may also serve as the storage unit 412 of the vector calculation device 400 and the storage unit 506 of the divided value calculation device 500.

  The control unit 660 controls each unit. Here, in FIG. 5, the control unit 660 for controlling the whole is provided, but a mechanism for controlling itself may be provided for each unit. The control unit 660 may also serve as the control unit 413 of the vector calculation device 400 and the control unit 507 of the divided value calculation device 500.

  The scalar multiplication output unit 640 outputs the result calculated by the scalar multiplication unit 630 as a public key. The scalar multiplication output unit 640 may output a result input from each calculation unit or calculation unit, or may output a result stored in the storage unit 650.

As described above, by using the best K division, that is, by using sufficiently small values of k ₁ and k ₂ , scalar multiplication can be performed at high speed, that is, elliptic cryptography can be performed at high speed.

  As described above, the first embodiment has described the method of performing the elliptic cryptographic operation and calculating the constant multiple using the special homomorphic mapping.

Embodiment 2. FIG.
What has been described as “to part” in the description of the first embodiment can be configured by a part or all of a computer-operable program. These programs can be created in C language, for example. Alternatively, HTML, SGML, or XML may be used. Alternatively, the screen display may be performed using JAVA (registered trademark).

  Further, what has been described as “˜unit” in the description of the first embodiment may be realized by firmware stored in the ROM 39 described below. Alternatively, it may be implemented by software, hardware, or a combination of software, hardware, and firmware.

  The program for implementing the first embodiment also includes other recordings such as a magnetic disk device, FD (Flexible Disk), optical disk, CD (compact disk), MD (mini disk), DVD (Digital Versatile Disk), etc. A recording apparatus using a medium may be used.

  In the second embodiment, what is described as “to part” in the description of the first embodiment is a vector arithmetic device, a divided value arithmetic device, or an elliptic cryptographic operation, depending on a part or all of a computer-operable program. A case where the apparatus is configured will be described.

  FIG. 6 is a diagram illustrating an appearance of the elliptical cryptographic operation apparatus according to the second embodiment.

  In FIG. 6, a CRT (Cathode Ray Tube) display device 41, a keyboard (K / B) 42, a mouse 43, a compact disk device (CDD) 86, a printer device 87, and a scanner device 88 are connected to a personal computer (PC) 33. Connected with.

  FIG. 7 is a hardware configuration diagram of the elliptical cryptographic operation apparatus according to the second embodiment.

In FIG. 7, a CPU (Central Processing) that executes a program.
(Unit) 37 is connected via ROM 38 to ROM (Read Only Memory) 39, RAM (Random Access Memory) 40, CRT display device 41, K / B 42, mouse 43, communication board 44, FDD (Flexible Disk Drive) 45, The magnetic disk device 46, the CDD 86, the printer device 87, and the scanner device 88 are connected. The communication board 44 is connected to the Internet 30.

In the vector calculation method according to this embodiment, a vector V ₁ and a vector V ₂ that are used to obtain the division values k ₁ and k _{2 of the} scalar K used for multiplying the points on the elliptic curve by the scalar K are obtained. In the vector calculation method to calculate,
A vector V ₁ calculation step for causing a CPU (Central Processing Unit) to calculate the vector V ₁ using the extended Euclidean algorithm;
The vector V ₁ storage step of storing a vector V ₁ which CPU has been allowed to calculation in the storage device by the vector V ₁ calculation step,
Using the extended Euclidean algorithm, the CPU calculates a plurality of integer sets A _h and calculates the vector V ₂ to the CPU using a plurality of integer values α included in the calculated plurality of integer sets A _h. and vector _{V 2} calculation step of,
And vector V ₂ storage step of storing a vector V ₂ which CPU has been allowed to calculation in the storage device by the vector V ₂ calculation step,
Calculated by the vector V ₁ calculation step, is calculated by the stored vector V ₁ and the vector V ₂ calculation process in the storage device, an output step of outputting to an output device and vector V ₂ stored in the storage device It is characterized by comprising.

  Here, the communication board 44 is not limited to the Internet 30 and may be connected to a LAN (Local Area Network) or a WAN (Wide Area Network) such as ISDN.

  The magnetic disk device 46 stores an operating system (OS) 47, a window system 48, a program group 49, and a file group 50. The program group 49 is executed by the CPU 37, the OS 47, and the window system 48.

  When all of what is described as “to part” in the description of the first embodiment is configured by a program, the program group 49 includes a program executed by what is described as “to part” in the description of the first embodiment. Is stored as software. In the file group, values input in the input unit, values calculated in the calculation units, and values calculated in the calculation units in the description of the first embodiment are stored. Alternatively, it is stored in the ROM 39 as firmware.

  In addition, when hardware described in the description of the first embodiment is implemented as hardware, for example, the K / B 42, the mouse 43, the communication board 44, the FDD 45, the CDD 86, and the scanner device 88 are included in each device. An example of the input unit. Further, the CRT display device 41, the K / B 42, the mouse 43, the communication board 44, the FDD 45, the CDD 86, and the printer device 87 are examples of the output unit of each device. The CPU 37 is an example of each calculation unit and each calculation unit of each device. As the output unit, an output device other than the CRT display device 41 may be used.

  Further, as described above, what has been described as “˜unit” in the description of the first embodiment may be implemented by a combination of software, hardware, and firmware.

As described above, in the above-described embodiment, an elliptic cryptography operation apparatus is an input unit that inputs an elliptic curve rational point group number n and a scalar multiple λ, a calculation unit that calculates a basis V ₁ , a candidate, The calculation means for calculating the set A _h of α, the calculation means for calculating the basis V ₂ , and the output means for outputting the calculation result are provided, so that the division K = k ₁ used in the above-mentioned conventional technique is provided. With + k ₂ φ (or k ₁ + k ₂ λ), the values of k ₁ and k ₂ can be made smaller. This makes it possible to perform a scalar multiplication operation at high speed, that is, to perform an elliptic encryption operation at high speed.

As described above, in the above-described embodiment, it is possible to obtain a further increase in speed with respect to the elliptic curve cryptography which still has room for improvement in the conventional method, and the calculation resources are limited. Even in the environment, it is possible to search for V ₁ and V ₂ that can realize a cryptographic function exhibiting sufficient practicality.

By using the best K division, that is, by using sufficiently small values of k ₁ and k ₂ , scalar multiplication can be performed at high speed, calculation time can be shortened, that is, elliptic cryptography can be performed at high speed. Therefore, it can be used in an environment where calculation resources such as memory or calculation time are limited in order to execute cryptographic operations on an IC card that only has or cannot be equipped with a CPU with a small clock and to ensure information security in a ubiquitous environment. It becomes possible.

1 is a diagram showing a configuration of a vector arithmetic device in Embodiment 1. FIG. FIG. 4 is a diagram showing a flowchart of a vector calculation method in the first embodiment. 3 is a diagram illustrating a configuration of a divided value calculation device according to Embodiment 1. FIG. 6 is a diagram illustrating a flowchart of a division value calculation method in Embodiment 1. FIG. 2 is a diagram showing a configuration of an elliptical cryptographic operation apparatus in Embodiment 1. FIG. It is a figure which shows the external appearance of the elliptical cryptographic operation apparatus in Embodiment 2. FIG. FIG. 6 is a hardware configuration diagram of an elliptical cryptographic operation apparatus according to Embodiment 2.

Explanation of symbols

30 Internet, 33 PC, 37 CPU, 38 bus, 39 ROM, 40
RAM, 41 CRT display device, 42 K / B, 43 mouse, 44 communication board, 45 FDD, 46 magnetic disk device, 47 OS, 48 window system, 49 program group, 50 file group, 86 CDD, 87 printer device, 88 scanner, 400 vector operation unit, 401 input unit, 402 vector _{V 1} arithmetic unit, 403,404,405,406,407,408,409,410 calculation unit, 411 output unit, 412 storage unit, 413 control unit, 420 Vector V ₂ calculation unit, 500 division value calculation unit, 501 input unit, 502, 503, 504 calculation unit, 505 output unit, 506 storage unit, 507 control unit, 520 division value calculation unit, 600 elliptic encryption calculation unit, 610 parameters Input unit, 620 division value input unit, 630 scalar multiplication unit, 64 0 scalar multiplication output unit, 650 storage unit, 660 control unit.

Claims (9)

The scalar K using a point on the elliptic curve to a scalar multiplication by a scalar K, the scalar K = k 1 ₊ k ₂ with a special homomorphism φ division value k ₁ and k ₂ is an endomorphism mapping Let f be a mapping f from a linear space of a two-dimensional integer coefficient to a one-dimensional linear space f: (i, j) → i + λj (mod n) (where mod n is the remainder of dividing i + λj by n) And the two-dimensional subspace where the mapping f is 0 is Ker f, which is the basis vector of Ker f with the smallest absolute value of the component of the basis vector (however, the absolute value is zero) And vector V ₁ and vector V _2, and using vector V ₁ and vector V ₂ to calculate a small vector u = (k ₁ , k ₂ ) such that f (u) = K, Small vector u is K of the above scalar K In vector operation unit for calculating a vector _{V 1} and vector _{V 2} to provide a _k 1, _{k 2} of the _{k 1} + k ₂ φ,
The vector V ₁ calculator for calculating the vector V ₁ using the extended Euclidean algorithm,
A plurality of sets A _h having a plurality of integer values are calculated using the extended Euclidean algorithm, and a plurality of integer values α included in the plurality of sets A _h having a plurality of calculated integer values are used. and vector _{V 2} calculator for calculating a vector _{V 2,}
Vector operation unit, characterized in that a vector output unit for outputting a vector V ₂ calculated by the vector V ₁ and the vector V ₂ calculation section calculated by the vector V ₁ arithmetic unit. The vector V ₂ calculation unit is
When the above-mentioned special homomorphism φ satisfies φ ² + r · φ + s = 0, a constant k * determined using values r and s determined as coefficients of an expression of the minimum polynomial (X ² + r · X + s) that φ satisfies is used. By using an integer value h (h is − (2k * −1) ≦ h ≦ 2k * −1 and h ≠ 0 is satisfied), the predetermined closed interval I is equal to the number of integer values that the integer value h can take. a closed interval I ₁ calculator for calculating _one of the extreme values,
Using the integer value h used by the closed section I ₁ calculation section, the closed section I ₂ calculation section that calculates the _two end values of the predetermined closed section I _{2 by} the number of integer values that the integer value h can take. When,
The integer value h a predetermined calculated by the closed interval I ₁ arithmetic unit using the closed interval I ₁ given determined by the extreme values closing section I ₁ and the closing section I given calculated by the _second arithmetic unit the set a _h having a plurality of integer values contained together in a predetermined and closed interval I ₂ determined by the extreme values for the I ₂ closed interval calculated by the number of the plurality of integer values that can take the integer value h, the plurality A set A _h calculation unit for calculating a plurality of sets A _h having integer values;
A vector (u, v) for calculating a plurality of vectors (u, v) using the plurality of integer values α included in the plurality of sets A _h having a plurality of integer values calculated by the set A _h calculation unit. An arithmetic unit;
The max norm of a plurality of vectors (u, v) computed by the vector (u, v) computing unit is computed, and the max norm is the smallest among the max norms of the computed vectors (u, v). comprising vector (u, v) the vector arithmetic unit according to claim 1, characterized in that it has a max norm calculation unit for outputting to the output unit as a vector V _2. The vector arithmetic device further includes an input unit for inputting the order n of the rational point group of the elliptic curve and a scalar λ that is a scalar multiple given by the special homomorphic map φ on the rational point group,
The vector V ₁ calculation unit uses the position number n and scalar lambda input by the input unit, wherein extended Euclid method _{stipulated: s i · n + t i} · λ = absolute value for r _i | r _i |, | T _i | <√n where m + 1 is the minimum index i, | r _{m + 1} |, | t _{m + 1} | <√n, s _{m + 1} · n + t _{m + 1} · λ = r _{m + 1} , greatest common divisor gcd (s _{m + 1} , T _{m + 1} ) = 1 and the variables s _{m + 1} and t _{m + 1} are calculated,
The vector V ₂ calculation unit further includes:
Variables v ′ and w ′ for calculating variables v ′ and w ′ such that s _{m + 1} · v′−t _{m + 1} · w ′ = 1 using the variables s _{m + 1} and t _{m + 1} calculated by the vector V ₁ calculation unit. And
Variables v 'and w' calculated by the variables v 'and w' calculating units are multiplied by the integer value h to calculate variables v "and w".
The closed section I ₁ computing unit computes both end values of a predetermined closed section I ₁ using the variables v “, w” computed by the variables v “, w” computing unit,
The closed section I ₂ computation unit computes both end values of a predetermined closed section I ₂ using the variables v ", w" computed by the variables v ", w" computation unit. 3. The vector arithmetic device according to 2. And a vector input unit for inputting the claims 1 vector V ₁ calculated by the vector calculation apparatus according the vector V _2,
A divided value calculation unit that calculates the divided values k ₁ and k _{2 of the} scalar K using the vector V ₁ and the vector V ₂ input by the vector input unit;
A division value calculation device comprising: a division value output unit that outputs the division values k ₁ and k _{2 of} the scalar K calculated by the division value calculation unit. A parameter input unit for inputting a point on the elliptic curve as a parameter;
A division value input unit for inputting the divided value k ₁ and k ₂ of the scalar K calculated by dividing value calculation device according to claim 4,
By using the division value k ₁ and k ₂ input by the division value input unit, the scalar multiplication calculator for scalar K multiplication parameters input by the parameter input unit,
An elliptic curve scalar multiplication unit comprising: a scalar multiplication output unit that outputs a result calculated by the scalar multiplication unit. A parameter input unit for inputting a point on the elliptic curve as an elliptic encryption parameter;
A division value input unit for inputting the claims 4 division value k ₁ scalar K as a secret key which is calculated by dividing value calculation device according and k _2,
By using the division value k ₁ and k ₂ input by the division value input unit, the scalar multiplication calculator for scalar K multiplication parameters input by the parameter input unit,
An elliptic cryptography operation device comprising: a scalar multiplication output unit that outputs a result calculated by the scalar multiplication unit as a public key. The above-mentioned scalar K used for multiplying a point on the elliptic curve by a scalar K is a scalar K = k ₁ + k using a special homomorphism map φ, which is a self-homogeneous map, and divided values k ₁ and k _2. and ₂ phi, the mapping f from a linear space of a two-dimensional integer coefficients into one-dimensional linear space f: (i, j) → i + λj (mod n) ( where, mod n, the remainder of dividing i + lambda] j at n And the two-dimensional subspace where the mapping f is 0 is Ker f, which is the basis vector of Ker f and has the smallest absolute value of the component of the basis vector (however, the absolute value is zero) And vector V ₁ and vector V _2, and using vector V ₁ and vector V ₂ to calculate a small vector u = (k ₁ , k ₂ ) such that f (u) = K , The small vector u is the scalar K In _{= k 1 + k 2 k 1} , vector calculation method for calculating the vectors _{V 1} and vector _{V 2} that gives _{k 2} of phi,
A vector V ₁ calculation step for causing a CPU (Central Processing Unit) to calculate the vector V ₁ using the extended Euclidean algorithm;
The vector V ₁ storage step of storing a vector V ₁ which CPU has been allowed to calculation in the storage device by the vector V ₁ calculation step,
Using the extended Euclidean algorithm, CPU to by computing a plurality of sets A _h having a plurality of integer values, a plurality of integer values α included in the plurality of sets A _h having a plurality of integer values that are allowed to operation and vector _{V 2} calculation step of calculating a vector _{V 2} to the CPU using,
And vector V ₂ storage step of storing a vector V ₂ which CPU has been allowed to calculation in the storage device by the vector V ₂ calculation step,
Calculated by the vector V ₁ calculation step, is calculated by the stored vector V ₁ and the vector V ₂ calculation process in the storage device, an output step of outputting to an output device and vector V ₂ stored in the storage device And a vector calculation method. The scalar K using a point on the elliptic curve to a scalar multiplication by a scalar K, the scalar K = k 1 ₊ k ₂ with a special homomorphism φ division value k ₁ and k ₂ is an endomorphism mapping Let f be a mapping f from a linear space of a two-dimensional integer coefficient to a one-dimensional linear space f: (i, j) → i + λj (mod n) (where mod n is the remainder of dividing i + λj by n) And the two-dimensional subspace where the mapping f is 0 is Ker f, which is the basis vector of Ker f with the smallest absolute value of the component of the basis vector (however, the absolute value is zero) And vector V ₁ and vector V _2, and using vector V ₁ and vector V ₂ to calculate a small vector u = (k ₁ , k ₂ ) such that f (u) = K, Small vector u is K of the above scalar K A program for executing by computing the vector _{V 1} and the vector _{V 2} to a computer to provide a _k 1, _{k 2} of the _{k 1} + k ₂ φ,
The vector V ₁ calculation process of calculating the vector V ₁ using the extended Euclidean algorithm,
The vector V ₁ storage process of storing the vector V ₁ calculated by the vector V ₁ processing in the storage device,
A plurality of sets A _h having a plurality of integer values are calculated using the extended Euclidean algorithm, and a plurality of integer values α included in the plurality of sets A _h having a plurality of calculated integer values are used. and vector _{V 2} arithmetic processing for calculating the vector _{V 2,}
And vector V ₂ storage process of storing the vector V ₂ calculated by the vector V ₂ processing in the storage device,
Calculated by the vector V ₁ processing, it is calculated by the storage device to the stored vector V ₁ and the vector V ₂ arithmetic processing, output processing of outputting to an output device and vector V ₂ stored in the storage device A program characterized by causing a computer to execute. The scalar K using a point on the elliptic curve to a scalar multiplication by a scalar K, the scalar K = k 1 ₊ k ₂ with a special homomorphism φ division value k ₁ and k ₂ is an endomorphism mapping Let f be a mapping f from a linear space of a two-dimensional integer coefficient to a one-dimensional linear space f: (i, j) → i + λj (mod n) (where mod n is the remainder of dividing i + λj by n) And the two-dimensional subspace where the mapping f is 0 is Ker f, which is the basis vector of Ker f with the smallest absolute value of the component of the basis vector (however, the absolute value is zero) And vector V ₁ and vector V _2, and using vector V ₁ and vector V ₂ to calculate a small vector u = (k ₁ , k ₂ ) such that f (u) = K, Small vector u is K of the above scalar K In k 1 ₊ k ₂ φ of k _1, k ₂ computer-readable recording medium recording a program for executing that operation on the vector V ₁ and the vector V ₂ to a computer which gives,
The vector V ₁ calculation process of calculating the vector V ₁ using the extended Euclidean algorithm,
The vector V ₁ storage process of storing the vector V ₁ calculated by the vector V ₁ processing in the storage device,
Using the extended Euclidean algorithm, a plurality of sets A _h having a plurality of integer values are calculated, and a plurality of integer values α included in the plurality of sets A _h having a plurality of calculated integer values are used. and vector _{V 2} arithmetic processing for calculating the vector _{V 2,}
And vector V ₂ storage process of storing the vector V ₂ calculated by the vector V ₂ processing in the storage device,
Calculated by the vector V ₁ processing, it is calculated by the storage device to the stored vector V ₁ and the vector V ₂ arithmetic processing, output processing of outputting to an output device and vector V ₂ stored in the storage device And a computer-readable recording medium on which a program is recorded.

Images