JP4630117B2 - Multi-pairing calculation method, pairing comparison method, apparatus using the same, and program - Google Patents

Description

  The present invention relates to an apparatus, a method, and a program using an operation on an elliptic curve, in particular, an operation for realizing a security technique.

Methods have been proposed to realize ID-base encryption using elliptic curve pairing and short signature digital signature. Elliptic curve pairing includes Tate pairing and Weil pairing.
Let the ellipse defined on the finite field GF (p) be E / GF (p). The GF (p) rational point on the ellipse E / GF (p) is P (x _P , y _P ), and the GF (p ^k ) rational point on the ellipse E / GF (p) is Q (x _Q , y _Q ). And In Tate pairing and Weil pairing, a rational function operation is used to obtain a result obtained by substituting (P, Q) into a rational function f _p satisfying (f _p ) = m (P) −m (O). . This rational function operation is called an operation that evaluates a divisor rational expression. In addition, most of the processing time is spent on the original power and multiplication of GF (p ^k ). The following description will focus on Tate pairing that facilitates high-speed computation.
An outline of encryption and signature by Tate pairing is shown in FIG. In Tate pairing, P and Q are input, and an element f on a finite field GF (p ^k ) is output by an operation that evaluates a divisor rational expression such as Miller's algorithm or modified Duursma-Lee algorithm. By multiplying f to the power of (p ^k −1) / m by a power operation, it is mapped to the element e on the finite field GF (p ^k ) and output. Here, p is a prime number or a power of a prime number, m is a prime number and the order of P, Q, and e, k is the smallest integer that satisfies m | (p ^k −1), and m is a factor of (p−1). It is not a number, and the greatest common divisor of p and m is 1.

FIG. 2 shows a functional configuration example of a pairing arithmetic device 1000 using Tate pairing. In order to perform the processing shown in FIG. 1, a rational function arithmetic unit that converts and outputs inputs P and Q to elements f on a finite field GF (p ^k ) using the Miller algorithm or the modified Duursma-Lee algorithm 10 and a power arithmetic unit 20 that maps and outputs the input f to an element e on a finite field GF (p ^k ) by a power operation.
FIG. 3 shows an internal configuration example of a Miller arithmetic unit 30 using Miller's algorithm as a representative example of the rational function arithmetic unit 10 that occupies most of the computation amount in Tate pairing. An example of the processing flow is shown in FIG. The Miller arithmetic device 30 includes a control unit 100, an assignment unit 200, an elliptical point generation unit 400, an ellipse addition unit 500, an input / output unit 600, a GF (p ^k ) multiplication unit 700, a GF (p ^k ) inverse element unit 850, And a recording unit 190. The control unit 100 controls other components in order to execute processing according to the processing flow shown below. The recording unit 190 may be a non-volatile memory such as a hard disk or a volatile memory that temporarily records only during a series of calculations. Moreover, you may combine.

When m, P, and Q are input to the input / output unit 600, m, P, and Q are recorded in the recording unit 190 (S700). Next, the assigning unit 200 substitutes P for T and 1 for F, and records the result in the recording unit 190 (S710). The point on the ellipse 400 generates a point S (∈E / GF (p ^k )) on the ellipse defined on the finite field GF (p ^k ) that satisfies the conditions S ≠ P and S ≠ Q. The data is recorded in the recording unit 190 (S720). S may be determined in advance or may be randomly generated as long as it satisfies the conditions. The ellipse addition unit 500 reads Q and S from the recording unit 190, calculates Q ′ (= Q + S), and records it in the recording unit 190 (S730). In the assigning unit 200, an integer obtained by rounding up the decimal point of log (m) -1 is substituted into n and recorded in the recording unit 190 (S740). The control unit 100 reads n from the recording unit 190 and checks whether n <0. If yes, the process proceeds to step S910, and if no, the process proceeds to step S760 (S750). In the case of Yes, the input / output unit 600 reads and outputs F from the recording unit 190 (S910), and the calculation by the Miller algorithm ends. In the case of No, the ellipse addition unit 500 reads T from the recording unit 190, calculates 2T, and records it in the recording unit 190 (S760). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, and 2T from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and 2T, l ₂ (x, y) Assuming = 0 as a straight line connecting 2T and O, l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190 (S770). . However, l ₁ (Q ′) is a value obtained by substituting the x and y coordinates of Q ′ into l ₁ (x, y). If S is selected from elements of a finite field GF (p) (in this case, the elements of the remaining k−1 finite fields GF (p) are 0), l ₁ (S), l ₂ ( The calculation of S) can be omitted, and l ₁ (S) and l ₂ (S) can be omitted in the subsequent steps. Next, the assigning unit 200 reads 2T from the recording unit 190, assigns a value of 2T to T, and records T in the recording unit 190 (S780). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S790). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８１０）。制御部１００は、記録部１９０からｍとｎを読み取り、ｍのｎ番目のビットが１かを確認し、Ｙｅｓの場合にはステップＳ８３０へ進み、Ｎｏの場合にはステップＳ９００へ進む（Ｓ８２０）。Ｙｅｓの場合、楕円加算部５００で、記録部１９０からＴ、Ｐを読み取り、Ｔ＋Ｐを計算し、記録部１９０に記録する（Ｓ８３０）。ＧＦ（ｐ^ｋ）乗算部７００は、Ｑ’、Ｓ、Ｔ、Ｐ，Ｔ＋Ｐを記録部１９０から読み取り、ｌ_１（ｘ，ｙ）＝０をＴとＰとを結ぶ直線、ｌ_２（ｘ，ｙ）＝０をＴ＋ＰとＯとを結ぶ直線とし、ｌ_１（Ｑ’）、ｌ_２（Ｑ’）、ｌ_１（Ｓ）、ｌ_２（Ｓ）を計算して、記録部１９０に記録する（Ｓ８４０）。代入部２００は、記録部１９０からＴ＋Ｐを読み取り、ＴにＴ＋Ｐを代入し、Ｔを記録部１９０に記録する（Ｓ８５０）。ＧＦ（ｐ^ｋ）逆元部８５０は、記録部１９０からｌ_２（Ｑ’）、ｌ_１（Ｓ）を読み取り、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を計算し、記録部１９０に記録する（Ｓ８６０）。ＧＦ（ｐ^ｋ）乗算部７００は、記録部１９０からＦ、ｌ_１（Ｑ’）、ｌ_２（Ｓ）、ｌ_２（Ｑ’）^−１、ｌ_１（Ｓ）^−１を読み取り、

Is recorded in the recording unit 190 as a value of F (S810). The control unit 100 reads m and n from the recording unit 190 and checks whether the n-th bit of m is 1. If Yes, the process proceeds to step S830, and if No, the process proceeds to step S900 (S820). . In the case of Yes, the ellipse addition unit 500 reads T and P from the recording unit 190, calculates T + P, and records it in the recording unit 190 (S830). The GF (p ^k ) multiplication unit 700 reads Q ′, S, T, P, T + P from the recording unit 190, and l ₁ (x, y) = 0 is a straight line connecting T and P, l ₂ (x, y) = 0 is a straight line connecting T + P and O, and l ₁ (Q ′), l ₂ (Q ′), l ₁ (S), and l ₂ (S) are calculated and recorded in the recording unit 190. (S840). The assigning unit 200 reads T + P from the recording unit 190, substitutes T + P for T, and records T in the recording unit 190 (S850). The GF (p ^k ) inverse element unit 850 reads l ₂ (Q ′) and l ₁ (S) from the recording unit 190 and calculates l ₂ (Q ′) ⁻¹ and l ₁ (S) ⁻¹ . Recording is performed in the recording unit 190 (S860). The GF (p ^k ) multiplication unit 700 reads F, l ₁ (Q ′), l ₂ (S), l ₂ (Q ′) ⁻¹ , l ₁ (S) ⁻¹ from the recording unit 190,

を計算し、Ｆの値として記録部１９０に記録する（Ｓ８９０）。ステップＳ８２０でＮｏと判断した場合とステップＳ８９０が終了した場合、代入部２００は、記録部１９０からｎを読み取り、ｎ−１をｎに代入し、ｎを記録部１９０に記録する（Ｓ９００）。次にステップＳ７５０に戻り、ステップＳ７５０の判断がＹｅｓとなるまで処理が繰り返される。

Is recorded in the recording unit 190 as the value of F (S890). When it is determined No in step S820 and when step S890 is completed, the assignment unit 200 reads n from the recording unit 190, substitutes n−1 for n, and records n in the recording unit 190 (S900). Next, the process returns to step S750, and the process is repeated until the determination in step S750 becomes Yes.

In Miller's algorithm, steps S810 and S880 are processes with a large amount of calculation. Hereinafter, the step of substituting the result calculated using the value of F into F as in steps S810 and S880 will be referred to as “F update calculation”.
FIG. 5 shows an internal configuration example of a modified Dursma-Lee arithmetic device 40 using a modified Dursma-Lee algorithm as another typical example of the rational function arithmetic device 10. An example of the processing flow is shown in FIG. The modified Duursma-Lee arithmetic device 40 includes a control unit 110, an assignment unit 210, a GF (p) multiplication unit 310, a GF (p ^k ) multiplication unit 410, a GF (p ^k ) power operation unit 510, an input / output unit 610, and The recording unit 710 is configured. The control unit 110 controls other components in order to execute processing according to the processing flow shown below. The recording unit 710 may be a nonvolatile memory such as a hard disk or a volatile memory that temporarily records only during a series of calculations. Moreover, you may combine.

In the modified Duursma-Lee, z is a positive integer whose greatest common divisor with 6 is 1, p is 3 ^z , and an equation representing the elliptic curve E is y ² = x ³ + aX + b, where b is ± 1. Also, σ is an element on the finite field GF (p ⁶ ) and the root of the quadratic irreducible polynomial f (x) on the finite field GF (p). ρ is an element on the finite field GF (p ⁶ ) and the root of the cubic irreducible polynomial g (x) on the finite field GF (p). σ and ρ are values that satisfy the above conditions, and are recorded in the recording unit 710 in advance.
When z, P (x _P , y _P ), and Q (x _Q , y _Q ) are input to the input / output unit 610, z, P, and Q are recorded in the recording unit 710 (S920). Next, the assigning unit 210 substitutes z−1 for n, 1 for F, and zb for d, and records the result in the recording unit 710. Further, the GF ^{(p k)} power calculation unit 510 reads the _{x Q} and _{y Q} from the recording unit _710, calculates the _x ^{Q 3} and _y ^{Q 3,} the _x ^{Q 3} to _{x Q} in cash join the club 210, _{y Q} And y _Q ³ is substituted for and recorded in the recording unit 710 (S930). In GF (p) multiplication unit 310, reads out _{x P} and _{y P} from the recording unit 710, x _P ⁹ and y _P ⁹ is calculated, the x _P ⁹ in x _P in cash join the club 210, y _P ⁹ to y _P And is recorded in the recording unit 710 (S940). Next, the control unit 110 reads x _P , y _P , x _Q , y _Q , d, σ from the recording unit 710, and records μ = x _P + x _Q + d and γ = σ y _P y _Q −μ ^2. (S950). The GF (p ^k ) multiplication unit 410 reads F, γ, μ, and ρ from the recording unit 710, calculates F ³ (γ−μρ−ρ ² ), and substitutes F into F ³ (γ−μρ). -Ρ ² ) is substituted and recorded in the recording unit 710 (S960). Next, the assigning unit 210 substitutes -y _Q for y _Q and db for d, and records the result in the recording unit 710 (S970). Further, n-1 is substituted for n by the assigning unit 210 and recorded in the recording unit 710 (S980). If n> 0, the process returns to step S940, and if not, the process proceeds to step S1000 (S990). In step S1000, F recorded in the recording unit 710 is output (S1000).

In the modified Duursma-Lee algorithm, step S960 is an F update calculation, and the amount of calculation is large.
For speeding up the Miller algorithm, there are proposals such as Patent Document 1, and for the modified Duursma-Lee algorithm, Non-Patent Document 1 is proposed. However, these proposals aim to speed up a single pairing operation. Therefore, when a product obtained by multiplying a plurality of pairing computation results (referred to as “multi-pairing”) is obtained, each pairing computation must be performed and then multiplied by the result of each pairing computation. Therefore, the conventional method has the following configuration and procedure. FIG. 7 shows a functional configuration example of a conventional multi-Tate pairing arithmetic device 2000. A processing flow is shown in FIG. The multi-Tate pairing calculation device 2000 includes a rational function calculation device 10, a power calculation device 20, and a multiplication device 25 that perform operations such as Miller's algorithm and modified Duursma-Lee algorithm. To be subjected to a multi-pairing, the set of the point Q _i on the elliptic curve over a plurality of finite field GF points on an elliptic curve over (p) P _i and finite _{^{GF (p k) (P i}} , Q _i ) is input to the multi-Tate pairing arithmetic unit (S1010). Here, i = 1,..., I (I is an integer of 2 or more). First, 1 is substituted for i (S1020). The rational function computing device 10 performs computation for each individual input pair (P _i , Q _i ) (S 1030), powers the computation result with the power computing device 20, and performs individual pairing e (P _i , Q _i). ) Is obtained (S1040). This process is performed I times (S1050, S1060), and the multiplication unit 25 calculates Πe (P _i , Q _i ) (S1070), thereby obtaining a multi-pairing result.
JP 2004-177673 A P. Barreto, H. Kim, B. Lynn and M. Scott, “Efficient Algorithm for Pairing-Based Cryptosystems,” Advances in Cryptology-Crypto 2002, LNCS 2442, Springer-Verlag, pp.354-368 (2002).

  Reduce the amount of computation of elliptic curve multi-pairing, and speed up the multi-pairing method and the pairing comparison method.

The present invention inputs a set (P _i , Q _i ) of a point P _i on an elliptic curve on a plurality of finite fields GF (p) and a point Q _i on an elliptic curve on a finite field GF (p ^k ). And a multi-pairing calculation method for outputting a product Πe (P _i , Q _i ) of an element e (P _i , Q _i ) on a finite field GF (p ^k ). Here, p is a prime number or a power of a prime number, k is an even number, I is an integer of 2 or more, and i is an integer from 1 to I. Assuming that F _i is the result of substituting the set of inputs (P _i , Q _i ) into the rational function f _p satisfying (f _p ) = m (P) −m (O), in the present invention, each F _i rather than seek to determine the direct? f _i in operation to evaluate the divisor rational expressions. At this time, a common calculation for i = 1,..., I can be performed at a time. Further, in multi-Tate pairing, a power operation is performed on ΠF _i to obtain a multi-pairing result.

Furthermore, another invention determines whether two elements e (P ₁ , Q ₁ ) and e (P ₂ , Q ₂ ) on the finite field GF (p ^k ) as a result of pairing are equal. The present invention relates to a pairing comparison method. In the present invention, a multi-pairing operation that takes (P ₁ , Q ₁ ) and (P ₂ , −Q ₂ ) as inputs and outputs a product e (P ₁ , Q ₁ ) · e (P ₂ , −Q ₂ ) And compare the result of the multi-pairing operation with 1 to confirm that e (P ₁ , Q ₁ ) and e (P ₂ , Q ₂ ) are equal.

According to the present invention, when multiplying the pairing calculation results on a plurality of elliptic curves, calculations that are common calculations and have a large calculation amount can be performed collectively. Also, in the case of multi-Tate pairing, it is not possible to multiply after individually calculating a power, but to multiply and multiply the power. Therefore, the number of power calculations that require a large amount of computation compared to multiplication can be reduced, and the amount of computation can be greatly reduced.
When comparing the pairing results, the above-mentioned multi-pairing calculation method is used, and by comparing the multi-pairing calculation result with the reciprocal of one pairing result with 1, two pairing results It can be confirmed that they are equal. Therefore, even when comparing the pairing results used for authentication or the like, the amount of calculation can be greatly reduced.

Embodiments of the present invention will be described below. In addition, in order to avoid duplication of description, the same number is attached | subjected to the component which has the same function, and duplication description is abbreviate | omitted.
[First Embodiment]
FIG. 9 shows a functional configuration example of the multi-Tate pairing arithmetic device of the present invention. The processing flow is shown in FIG. The multi-Tate pairing calculation device 3000 includes a rational calculation device 50 and a power calculation device 20. Rational arithmetic unit 50, by using a Miller algorithm and modifications Duursma-Lee algorithm, a device for converting a plurality of input pairs (P _{i, Q i)} to? F _i. However, i = 1, ..., I (I is an integer greater than or equal to 2), P _i is a point on the elliptic curve on the finite field GF (p), Q _i is on the elliptic curve on the finite field GF (p ^k ) On the other hand, F _i is an element on a finite field GF (p ^k ) in which P _i and Q _i are transformed using the Miller algorithm, the modified Duursma-Lee algorithm, or the like. In the prior art, the rational arithmetic unit 10 outputs individual F _i , the power arithmetic unit 20 performs a power operation to obtain individual pairing results e (P _i , Q _i ), and then the multiplication unit 25 performs multiplication. To determine the multi-pairing Πe (P _i , Q _i ) (see FIGS. 7 and 8). On the other hand, in the present _invention, P i, when _{Q i} is input (S10), without requiring a separate _{F i} rational arithmetic unit 50, and outputs the ΠF _i (S20), ΠF _i in exponentiation device 20 Is multiplied by ((p ^k −1) / m) to obtain multi-pairing Πe (P _i , Q _i ).

The first feature of the present invention is a rational arithmetic unit 50 that performs an operation for evaluating a divisor rational expression, which will be described later. In the rational arithmetic unit 50, the calculation amount is reduced by obtaining ΠF _i without obtaining individual F _i . This method is not limited to Tate pairing, and can be used when multi-pairing is performed using another algorithm such as Weil pairing. The second feature is a Tate pairing unique characteristics, instead of exponentiation of individually F _i, is to power calculated for? F _i. In other words, in the case of Miller's algorithm, F _i is not multiplied after being raised to ((p ^k −1) / m), but is multiplied after each F _i ((p ^k −1) / m) I am riding. In the case of algorithm modifications Duursma-Lee, instead of multiplying after the F _i-th power (p 3 ^-1), after multiplying each F _i is squared (p 3 ^-1) . As a result, the power calculation with a large amount of calculation can be reduced from I times to once.

Details of the rational function computing device 50 and step S20 as the first feature will be described below.
FIG. 11 shows a functional configuration example of a Miller arithmetic device 60 using Miller's algorithm as the rational function arithmetic device 50 algorithm. The processing flow is shown in FIG. The Miller arithmetic device 60 includes a control unit 101, an assignment unit 200, an ellipse upper point generation unit 400, an ellipse addition unit 500, an input / output unit 601, a GF (p ^k ) multiplication unit 700, a GF (p ^k ) inverse element unit 850, And a recording unit 191. The control unit, the input / output unit, and the recording unit are different from the conventional Miller arithmetic device 30 shown in FIG. This is because the processing flow, input data, and data to be recorded are different.

_M input and output unit _601, P i, when _{Q i} is input, _m, P i, the _{Q i} is recorded in the recording unit 191 (S100). The point on the ellipse 400 generates a point S (∈E / GF (p ^k )) on the ellipse defined on the finite field GF (p ^k ) that satisfies the conditions S ≠ P and S ≠ Q. And recording in the recording unit 191 (S110). S may be determined in advance or may be randomly generated as long as it satisfies the conditions. Next, the assigning unit 200 assigns 1 to i and 1 to F, and records the result in the recording unit 191 (S120). Further, in generations join the club 200, substituting _{P i} to _{T i,} is recorded in the recording unit 191 (S130). The ellipse addition unit 500 reads Q _i and S from the recording unit 191, calculates Q _i ′ (= Q _i + S), and records it in the recording unit 191 (S 140). Steps 130 and 140 are repeated for i = 1,..., I (S150, S160). In the assigning unit 200, an integer obtained by rounding up the decimal point of log (m) -1 is substituted into n and recorded in the recording unit 191 (S170). The control unit 101 reads n from the recording unit 191 and checks whether n <0. If yes, the process proceeds to step S370, and if no, the process proceeds to step S190 (S180). In the case of Yes, the input / output unit 601 reads and outputs F from the recording unit 191 (S370), and the calculation by the Miller algorithm ends. In the case of No, the assigning unit 200 assigns 1 to i and records it in the recording unit 191 (S190). Elliptic curve addition unit 500 reads the _{T i} from the recording unit 191, calculates the 2T _i, is recorded in the recording unit 191 (S200). The GF (p ^k ) multiplication unit 700 reads Q _i ′, S, T _i , and 2T _i from the recording unit 191, and sets l _1i (x, y) = 0 to a straight line connecting T _i and 2T _i , l _2i (X, y) = 0 is calculated as a straight line connecting 2T _i and O, l _1i (Q _i ′), l _2i (Q _i ′), l _1i (S), l _2i (S) is calculated and recorded This is recorded in the part 191 (S210). However, l _1i (Q _i ′) is a value obtained by substituting the x and y coordinates of Q _i ′ into l _1i (x, y). If S is selected from elements of a finite field GF (p) (in this case, the elements of the remaining k−1 finite fields GF (p) are 0), l _1i (S), l _2i ( The calculation of S) can be omitted, and l _1i (S) and l _2i (S) can be omitted in the subsequent steps. Then, generations join the club 200 reads the 2T _i from the recording unit 191 substitutes the value of 2T _i to _{T i,} to record _{T i} in the recording unit 191 (S220). In GF ^{(p k)} inverse element portion 850, _l 2i from the recording unit 191 _{(Q i '),} reads _{l 1i (S), l 2i} (Q i') -1, calculate l 1i ^{(S) -1} Then, it is recorded in the recording unit 191 (S230). The processes from step S200 to S230 are repeated until i = 1,..., I (S240, S250). In the processing flow of FIG. 12, steps S200 to S230 are performed for each i value, and the next i processing is performed. However, after step S200 is repeated I times, the process may proceed while repeating each step I times so that step S210 is repeated I times. The GF (p ^k ) multiplier 700 reads F, l _1i (Q _i ′), l _2i (S), l _2i (Q _i ′) ⁻¹ , l _1i (S) ⁻¹ from the recording unit 191,

を計算し、Ｆの値として記録部１９１に記録する（Ｓ２６０）。なお、本ステップがＦの更新演算である。制御部１０１は、記録部１９１からｍとｎを読み取り、ｍのｎ番目のビットが１かを確認し、Ｙｅｓの場合にはステップＳ２８０へ進み、Ｎｏの場合にはステップＳ３６０へ進む（Ｓ２７０）。Ｙｅｓの場合、代入部２００は、ｉに１を代入し、記録部１９１に記録する（Ｓ２８０）。楕円加算部５００で、記録部１９１からＴ_ｉ、Ｐ_ｉを読み取り、Ｔ_ｉ＋Ｐ_ｉを計算し、記録部１９１に記録する（Ｓ２９０）。ＧＦ（ｐ^ｋ）乗算部７００は、Ｑ_ｉ’、Ｓ、Ｔ_ｉ、Ｐ_ｉ，Ｔ_ｉ＋Ｐ_ｉを記録部１９１から読み取り、ｌ_１ｉ（ｘ，ｙ）＝０をＴ_ｉとＰ_ｉとを結ぶ直線、ｌ_２ｉ（ｘ，ｙ）＝０をＴ_ｉ＋Ｐ_ｉとＯとを結ぶ直線とし、ｌ_１ｉ（Ｑ_ｉ’）、ｌ_２ｉ（Ｑ_ｉ’）、ｌ_１ｉ（Ｓ）、ｌ_２ｉ（Ｓ）を計算して、記録部１９１に記録する（Ｓ３００）。代入部２００は、記録部１９１からＴ_ｉ＋Ｐ_ｉを読み取り、Ｔ_ｉにＴ_ｉ＋Ｐ_ｉを代入し、Ｔ_ｉを記録部１９１に記録する（Ｓ３１０）。ＧＦ（ｐ^ｋ）逆元部８５０は、記録部１９１からｌ_２ｉ（Ｑ_ｉ’）、ｌ_１ｉ（Ｓ）を読み取り、ｌ_２ｉ（Ｑ_ｉ’）^−１、ｌ_１ｉ（Ｓ）^−１を計算し、記録部１９１に記録する（Ｓ３２０）。ステップＳ２９０からＳ３２０までの処理をｉ＝１，…，Ｉまで繰り返す（Ｓ３３０、Ｓ３４０）。なお、図１２の処理フローでは、各ｉの値に対して、ステップＳ２９０からＳ３２０を行い、次のｉの処理を行っている。しかし、ステップＳ２９０をＩ回繰り返した後、ステップＳ３００をＩ回繰り返すように、各ステップをＩ回繰り返しながら処理を進めてもよい。ＧＦ（ｐ^ｋ）乗算部７００は、記録部１９１からＦ、ｌ_１ｉ（Ｑ_ｉ’）、ｌ_２ｉ（Ｓ）、ｌ_２ｉ（Ｑ_ｉ’）^−１、ｌ_１ｉ（Ｓ）^−１を読み取り、

Is recorded in the recording unit 191 as the value of F (S260). This step is an F update calculation. The control unit 101 reads m and n from the recording unit 191 and confirms whether the n-th bit of m is 1. If Yes, the process proceeds to step S280, and if No, the process proceeds to step S360 (S270). . In the case of Yes, the assigning unit 200 assigns 1 to i and records it in the recording unit 191 (S280). The ellipse addition unit 500 reads T _i and P _i from the recording unit 191 to calculate T _i + P _i and records it in the recording unit 191 (S290). The GF (p ^k ) multiplication unit 700 reads Q _i ′, S, T _i , P _i , T _i + P _i from the recording unit 191, and sets l _1i (x, y) = 0 to T _i and P _i . A straight line connecting l _2i (x, y) = 0 is a straight line connecting T _i + P _i and O, and l _1i (Q _i ′), l _2i (Q _i ′), l _1i (S), l _2i ( S) is calculated and recorded in the recording unit 191 (S300). The cash join the club 200 reads a _T i + _{P i} from the recording unit 191 substitutes _T i + _{P i} to _{T i,} to record _{T i} in the recording unit 191 (S310). GF ^{(p k)} inverse unit 850, _l 2i from the recording unit 191 _{(Q i '),} reads _{l 1i (S), l 2i} (Q i') -1, calculate l 1i ^{(S) -1} Then, it is recorded in the recording unit 191 (S320). The processing from step S290 to S320 is repeated until i = 1,..., I (S330, S340). In the processing flow of FIG. 12, steps S290 to S320 are performed for each i value, and the next i processing is performed. However, after step S290 is repeated I times, the process may proceed while repeating each step I times so that step S300 is repeated I times. The GF (p ^k ) multiplier 700 reads F, l _1i (Q _i ′), l _2i (S), l _2i (Q _i ′) ⁻¹ , l _1i (S) ⁻¹ from the recording unit 191,

を計算し、Ｆの値として記録部１９１に記録する（Ｓ３５０）。なお、本ステップもＦの更新演算である。ステップＳ２７０でＮｏと判断した場合とステップＳ３５０が終了した場合、代入部２００は、記録部１９１からｎを読み取り、ｎ−１をｎに代入し、ｎを記録部１９１に記録する（Ｓ３６０）。次にステップＳ１８０に戻り、ステップＳ１８０の判断がＹｅｓとなるまで処理が繰り返される。なお、出力されたＦが、ΠＦ_ｉの値となっている。このように、Ｆの更新演算（ステップＳ２６０、Ｓ３５０）で、おのおののＦ_ｉを求めることなく、Ｆ（＝ΠＦ_ｉ）を求めることが特徴である。

Is recorded in the recording unit 191 as the value of F (S350). This step is also an F update calculation. When it is determined No in step S270 and when step S350 is completed, the assignment unit 200 reads n from the recording unit 191, substitutes n−1 for n, and records n in the recording unit 191 (S360). Next, it returns to step S180 and a process is repeated until judgment of step S180 becomes Yes. Incidentally, it outputted F has a value of? F _i. As described above, it is characteristic that F (= ΠF _i ) is obtained without obtaining each F _i in the update calculation of F (steps S260 and S350).

When the set of I inputs (P _i , Q _i ) is individually calculated by Miller's algorithm, the conventional configuration shown in FIG. 7 and FIG. S810 and S880) are performed nI times. On the other hand, according to the present invention, it is only necessary to perform the F update calculation (steps S260 and S350 in FIG. 12) having a large calculation amount n times. Therefore, the calculation amount can be greatly reduced.
[Modification]
In the first embodiment, the case where the Miller algorithm is used has been described. As a modified example, a case where the modified Dursma-Lee algorithm is used for the rational function arithmetic unit 50 will be described below.

A modified Duursma-Lee arithmetic unit 70 shown in FIG. 13 is used instead of the rational function arithmetic unit 50 shown in FIG. FIG. 14 shows a processing flow of the modified Duursma-Lee arithmetic device 70. The modified Duursma-Lee arithmetic device 70 includes a control unit 111, an assignment unit 210, a GF (p) multiplication unit 310, a GF (p ^k ) multiplication unit 410, a GF (p ^k ) power operation unit 510, an input / output unit 611, and The recording unit 711 is configured. The difference from the modified Duursma-Lee arithmetic device 40 shown in FIG. 5 is a control unit, an input / output unit, and a recording unit. This is because the processing procedure, input data, and recording data are different.
As in the prior art, z is a positive integer whose greatest common divisor with 6 is 1, p is 3 ^z , and an equation representing the elliptic curve E is y ² = x ³ + aX + b, where b is ± 1. Also, σ is an element on the finite field GF (p ⁶ ) and the root of the quadratic irreducible polynomial f (x) on the finite field GF (p). ρ is an element on the finite field GF (p ⁶ ) and the root of the cubic irreducible polynomial g (x) on the finite field GF (p). σ and ρ are values that satisfy the above conditions, and are recorded in the recording unit 711 in advance.

When z, P (x _Pi , y _Pi ), and Q (x _Qi , y _Qi ) are input to the input / output unit 611, z, P _i , and Q _i are recorded in the recording unit 710 (S400). However, i = 1, ..., I (I is an integer greater than or equal to 2). The assigning unit 210 substitutes z-1 for n, 1 for F, and zb for d, and records the result in the recording unit 711 (S410). Next, the assigning unit 210 assigns 1 to i and records it in the recording unit 711 (S420). The GF (p ^k ) power calculation unit 510 reads x _Qi and y _Qi from the recording unit 711, calculates x _Qi ³ and y _Qi ³ , and the substitution unit 210 _sets x _Qi ³ to x _Qi and y _Qi to y substituting _Qi ^3, recorded in the recording unit 711 (S430). Step S430 is repeated until i is 1, ..., I (S440, S450). The assigning unit 210 assigns 1 to i and records it in the recording unit 711 (S460). The GF (p) multiplication unit 310 reads x _Pi and y _Pi from the recording unit 710 and calculates x _Pi ⁹ and y _Pi ^{9. The} substitution unit 210 _sets x _Pi ⁹ to x _Pi and y _Pi ⁹ to y _Pi. And is recorded in the recording unit 711 (S470). The following control unit _{111, x Pi,} y Pi from the recording unit _{711, x Qi, y Qi,} d, reads _{σ, μ i = x Pi +} x Qi + d, and _{γ i = σy Pi y Qi -μ} i 2 Is recorded in the recording unit 711 (S480). Steps S470 and S480 are repeated until i = 1,..., I (S490, S500). In the processing flow of FIG. 14, Steps S470 and S480 are performed for each i value, and the next i processing is performed. However, after step S470 is repeated I times, step S480 may be repeated I times. The GF (p ^k ) multiplication unit 410 reads F, γ _i , μ _i , and ρ from the recording unit 711, calculates F ³ Π (γ _i −μ _i ρ−ρ ² ), and substitutes F into F. F ³ Π (γ _i −μ _i ρ−ρ ² ) is substituted and recorded in the recording unit 711 (S510). Step S510 is an F update calculation. Again, the assigning unit 210 assigns 1 to i and records it in the recording unit 711 (S520). In cash join the club 210, reads out the _{y Qi} from the recording unit 711 _{substitutes -y Qi} to _{y Qi,} is recorded in the recording unit 711 (S530). Step S530 is repeated until i = 1,..., I (S540, S550). Further, the assigning unit 210 reads d, b, and n from the recording unit 711, substitutes d−b for d, and n−1 for n, and records the result in the recording unit 711 (S560). If n> 0, the process returns to step S460, and if not, the process proceeds to step S580 (S570). In step S570, the input / output unit 611 outputs F recorded in the recording unit 711 (S580). Incidentally, it outputted F has a value of? F _i. Thus, F (= ΠF _i ) is obtained without obtaining each F _i in the update calculation of F (step S510).

When a set of I inputs (P _i , Q _i ) is individually calculated by Miller's algorithm, the conventional configuration shown in FIG. 7 and FIG. S960) is performed nI times. On the other hand, according to the present invention, it is only necessary to perform the F update calculation (step S510 in FIG. 14) having a large calculation amount n times. Therefore, the calculation amount can be greatly reduced.
[Second Embodiment]
In the first embodiment, the multi-pairing method and its device have been described. In this embodiment, a pairing comparison device is shown as an application example using the multi-pairing device shown in the first embodiment. FIG. 15 shows a configuration example of the pairing comparison apparatus, and FIG. 16 shows a processing flow thereof. The pairing comparison device 4000 includes a multi-Tate pairing calculation device 3000, an input generation device 3010, and a GF (p ^k ) comparison device 3020. The multi-Tate pairing arithmetic device 3000 is the multi-Tate pairing arithmetic device 3000 shown in FIG.

A processing flow in the case of comparing the two pairing results e (P ₁ , Q ₁ ) and e (P ₂ , Q ₂ ) is shown below. _{P 1, Q 1, P 2} , Q 2 of the pairing comparison device 4000 receives (S600), the input generator 3010 obtains the -Q _{2, multi-P 1, Q 1, P 2} , and -Q ₂ The data is input to the Tate pairing calculation device 3000 (S610). The multi-Tate pairing arithmetic unit 3000 calculates and outputs e (P ₁ , Q ₁ ) · e (P ₂ , −Q ₂ ) (S620). Here, from the characteristics of pairing, e (P ₂ , −Q ₂ ) is an inverse of e (P ₂ , Q ₂ ). Therefore, if e (P ₁ , Q ₁ ) · e (P ₂ , −Q ₂ ) is equal to 1, e (P ₁ , Q ₁ ) and e (P ₂ , Q ₂ ) are equal. Therefore, the GF (p ^k ) comparison device 3020 compares e (P ₁ , Q ₁ ) e (P ₂ , −Q ₂ ) output from the multi-Tate pairing calculation device 3000 with 1 (S630). The pairing comparison device 4000 outputs that e (P ₁ , Q ₁ ) and e (P ₂ , Q ₂ ) are equal if the results of step S630 are equal, and outputs that they are not equal if they are not equal. .

Thus, the multi-pairing method of the present invention can also be used as a method for checking whether two pairing results are equal. Therefore, the amount of calculation can be reduced by incorporating the pairing comparison device of the present embodiment in an authentication device that compares two pairings.
In the present embodiment, the pairing comparison device using the multi-Tate pairing arithmetic device has been described, but other algorithms such as Weil pairing may be used as long as the multi-pairing arithmetic device is used.

  Each device shown in the first embodiment and the second embodiment may read and execute a program recorded on a readable recording medium by a computer.

The figure which shows the outline | summary of the encryption and signature by Tate pairing. The figure which shows the function structural example of the pairing calculating device using Tate pairing. The figure which shows the internal structural example of the conventional Miller arithmetic unit. The figure which shows the processing flow of the conventional Miller arithmetic unit. The figure which shows the example of an internal structure of the conventional correction Duursma-Lee arithmetic unit. The figure which shows the processing flow of the conventional correction Duursma-Lee arithmetic unit. The figure which shows the function structural example of the conventional multi-Tate pairing calculating apparatus. The figure which shows the processing flow of the conventional multi-Tate pairing calculating apparatus. The figure which shows the function structural example of the multi-Tate pairing calculating apparatus of this invention. The figure which shows the processing flow of the multi-Tate pairing calculating apparatus of this invention. The figure which shows the internal structural example of the Miller arithmetic unit of this invention. The figure which shows the processing flow of the Miller arithmetic unit of this invention. The figure which shows the internal structural example of the correction Duursma-Lee arithmetic unit of this invention. The figure which shows the processing flow of the correction Duursma-Lee arithmetic unit of this invention. The figure which shows the structural example of the pairing comparison apparatus of this invention. The figure which shows the processing flow of the pairing comparison apparatus of this invention.

Claims (15)

p is a prime number or a power of a prime number, k is an even number, I is an integer of 2 or more, i is an integer from 1 to I, P _i is a point on an elliptic curve on a finite field GF (p), and Q _i is a finite field GF A point on the elliptic curve on (p ^k ), e (P _i , Q _i ) is an element on the finite field GF (p ^k ) of the pairing result of P _i and Q _i , and F _i is (f _p ) = When P _i and Q _i are substituted into a rational function f _p satisfying m (P) −m (O),
In a multi-pairing arithmetic device in which an input is a plurality of pairs (P _i , Q _i ) and an output is a product of pairing results e (P _i , Q _i ),
A multi-pairing computing device comprising a rational function computing unit that calculates ΠF _i by an operation that evaluates a divisor rational expression and obtains a final ΠF _i by iterative calculation. The multi-pairing arithmetic device according to claim 1,
A multi-pairing arithmetic device comprising: a power arithmetic unit that performs a power finite field operation on an output from the rational function arithmetic unit. The multi-pairing arithmetic device according to claim 2,
A multi-pairing arithmetic device comprising the rational function arithmetic unit, characterized in that processing according to Miller's algorithm is performed. The multi-pairing arithmetic device according to claim 2,
A multi-pairing arithmetic device comprising the rational function arithmetic unit, characterized in that processing according to a modified Duursma-Lee algorithm is performed. p is a prime number or a power of a prime number, k is an even number, i is an integer of 1 or 2, P _i is a point on an elliptic curve on a finite field GF (p), Q _i is an ellipse on a finite field GF (p ^k ) A point on the curve, e (P _i , Q _i ) is an element on the finite field GF (p ^k ) of the pairing result of P _i and Q _i , and F _i is (f _p ) = m (P) −m ( meet O) to rational function _{f p} when the result of substituting _{P i} and _{Q i,}
(P ₁ , Q ₁ ) and (P ₂ , Q ₂ ) are input, and pairing result e (P ₁ , Q ₁ ) and e
In the pairing comparison device that outputs a determination result as to whether (P ₂ , Q ₂ ) is equal,
(P ₁ , Q ₁ ) and (P ₂ , −Q ₂ ) are used as inputs and F is an operation that evaluates a divisor rational expression.
The ₁ · _{F 2} is calculated, has a rational function calculating unit for obtaining the final _F 1 · _{F 2} by repeated calculation, the product _{e (P 1, Q 1)} · e (P 2, -Q 2) the output A multi-pairing calculation unit to
A pairing comparison device comprising a GF (p ^k ) comparison unit that compares 1 with the output of the multi-pairing calculation unit. The pairing comparison device according to claim 5,
A pairing comparison apparatus comprising the multi-pairing calculation unit, characterized in that it has a power calculation unit that performs a power finite field calculation on the output from the rational function calculation unit. The pairing comparison device according to claim 6, wherein
A pairing comparison device comprising the multi-pairing calculation unit, wherein the rational function calculation unit performs processing according to Miller's algorithm. The pairing comparison device according to claim 6, wherein
A pairing comparison device comprising the multi-pairing calculation unit, wherein the rational function calculation unit performs processing according to a modified Duursma-Lee algorithm. p is a prime number or a power of a prime number, k is an even number, I is an integer of 2 or more, i is an integer from 1 to I, P _i is a point on an elliptic curve on a finite field GF (p), and Q _i is a finite field GF A point on the elliptic curve on (p ^k ), e (P _i , Q _i ) is an element on the finite field GF (p ^k ) of the pairing result of P _i and Q _i , and F _i is (f _p ) = When P _i and Q _i are substituted into a rational function f _p satisfying m (P) −m (O),
In a multi-pairing calculation method using a multi-pairing calculation device in which an input is a plurality of sets (P _i , Q _i ) and an output is a product of pairing results e (P _i , Q _i ) ,
A rational function calculation unit of the multi-pairing calculation device includes a rational function calculation process of calculating ΠF _i by an operation for evaluating a divisor rational expression and obtaining a final ΠF _i by repeated calculation. Pairing calculation method. p is a prime number or a power of a prime number, k is an even number, I is an integer of 2 or more, i is an integer from 1 to I, P _i is a point on an elliptic curve on a finite field GF (p), and Q _i is a finite field GF A point on the elliptic curve on (p ^k ), e (P _i , Q _i ) is an element on the finite field GF (p ^k ) of the pairing result of P _i and Q _i , and F _i is (f _p ) = When P _i and Q _i are substituted into a rational function f _p satisfying m (P) −m (O) ,
A plurality of _(P i, _{Q i)} as input a set of, _{e (P} i, _{Q i)} product Paii _(P i, _{Q i)} of the multi-pairing computation method for outputting,
In rational function calculation unit calculates a? F _i in operation to evaluate the divisor rational expression, iteration
A rational function operation process for obtaining the final? F _i by,
A multi-pairing calculation method comprising: a power finite field calculation process for performing a power finite field calculation in a power calculation unit with respect to an output from the rational function calculation process. The multi-pairing calculation method according to claim 10, wherein
A multi-pairing calculation method comprising the rational function calculation process for performing processing according to Miller's algorithm. The multi-pairing calculation method according to claim 10, wherein
A multi-pairing calculation method comprising the rational function calculation step of performing processing according to the modified Duursma-Lee algorithm. p is a prime number or a power of a prime number, k is an even number, i is an integer of 1 or 2, P _i is a point on an elliptic curve on a finite field GF (p), Q _i is an ellipse on a finite field GF (p ^k ) A point on the curve, e (P _i , Q _i ) is an element on the finite field GF (p ^k ) of the pairing result of P _i and Q _i , and F _i is (f _p ) = m (P) −m ( meet O) to rational function _{f p} when the result of substituting _{P i} and _{Q i,}
(P ₁ , Q ₁ ) and (P ₂ , Q ₂ ) are input, and pairing result e (P ₁ , Q ₁ ) and e
In the pairing comparison method for determining whether (P ₂ , Q ₂ ) is equal,
In the multi-pairing calculation unit, (P ₁ , Q ₁ ) and (P ₂ , −Q ₂ ) are input and divisor
F ₁ · F ₂ is calculated by an operation that evaluates a rational expression, and final F ₁ · F ₂ is obtained by repeated calculation, and the product e (P ₁ , Q ₁ ) · e (P ₂ , −Q ₂ ) Multi-pairing calculation process to output
A GF (p ^k ) comparison unit, comprising: a GF (p ^k ) comparison process for comparing the output of the multi-pairing calculation process with 1; The pairing comparison method according to claim 13, wherein
A pairing comparison method comprising: the multi-pairing calculation step of performing a power finite field calculation in a power calculation unit with respect to an output from the rational function calculation step.   A pairing program for realizing the apparatus according to claim 1 by a computer.

Images