JP4752176B2 - Unidirectional function calculation method, apparatus and program - Google Patents

Description

The present invention relates to a one-way function calculating method and apparatus and program, particularly, based on computational complexity theory in public telecommunications networks, relates to a one-way function calculating method and apparatus and program for information security.

  In recent years, attention has been focused on information security technology with the development of public telephone communication networks. Information security technology can be configured based on various background technologies, such as those based on information theory and those based on computability theory, but the one based on computational complexity theory is considered the most practical in terms of efficiency. Currently, active research is being conducted. The present invention relates to information security technology based on this computational complexity theory.

For any function that can be computed in polynomial time, if any efficient algorithm can be used to compute its inverse with a negligible probability, the function is said to be unidirectional. Currently, the existence of a one-way function has not been proved, and is regarded as an unsolved problem in cryptography or computer science. Accordingly, a unidirectional function in a strict sense is not currently known, but RSA method, Rabin method, method based on discrete logarithm, etc. are well known as candidates for unidirectional function (for example, non-patent document). 1-4).
Oded Goldreich, “FOUNDATION OF CRYTOGRAPHY” publication CAMBRIDGE UNIVERSITY PRESS, ISBN0-521-79172-3 Ian F. Plaque, Gadiel Selossi, Nigel P. Smart, Jiro Suzuki = translation, "Elliptic curve cryptography", p. 112, Publishing Pearson Education, ISBN4-89471-431-0 Alfred. J. Menezes, "ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS" pp.61-81, published by KLUWER ACADEMIC PUBLISHERS, ISBN0-7923-9368-6 Knuth, `` The Art of Computer Programming '' VOLUME 2 Seminumerical Altorithms Third Edition, p.465, published by Addition Wesley, ISBN0-201-89684-2

  The one-way function plays a central role in configuring information security technology based on the computational complexity theory, and is considered to be indispensable for modern cryptographic authentication technology. Therefore, the invention of the new one-way function can be applied to any information security technology based on the computational complexity theory and can be considered as an important technical problem.

The present invention aims at providing a one-way function calculating method and apparatus and program capable of constituting a possible return one-way function on the difficulty of the elliptic DH determination problem.

  FIG. 1 is a diagram for explaining the principle of the present invention.

The present invention (Claim 1) is a one-way function calculation method for calculating a one-way function,
R ₁ ,..., R ₄ ∈ E [L] (where E [L] is a prime number, and LR = L of the points R on the elliptic curve E defined on the finite field) An area for storing O ( a set of R satisfying O (where O is an infinite point)) is secured (step 1).
In the eigenvalue calculating means, eigenvalues λ ₁ and λ ₂ ∈Z / LZ of the Frobenius map are obtained (step 2),
In the input means, R∈E [L] is input,
In the scalar multiplication setting means,

として予め求めておき（ステップ３）、
フロベニウス写像計算手段において、フロベニウス写像φにより、楕円曲線上の点φＲを計算し、計算結果Ｒ_１を一時記憶手段に格納しておき（ステップ４）、
楕円スカラー倍計算手段において、点Ｒのスカラー倍λ_２Ｒを計算し、計算結果Ｒ_２を一時記憶手段に格納しておき（ステップ５）、
楕円減算手段において、一時記憶手段から計算結果Ｒ_１と計算結果Ｒ_２を取得してＲ_１−Ｒ_２を計算し、計算結果Ｒ_３を一時記憶手段に格納しておき（ステップ６）、
楕円スカラー倍計算手段において、Ｒ_３のスカラー倍

(Step 3)
In the Frobenius map calculation means, the point φR on the elliptic curve is calculated from the Frobenius map φ, and the calculation result R ₁ is stored in the temporary storage means (step 4).
In the elliptic scalar multiplication calculation means, the scalar multiplication λ ₂ R of the point R is calculated, and the calculation result R ₂ is stored in the temporary storage means (step 5).
In the ellipse subtraction means, the calculation result R ₁ and the calculation result R ₂ are obtained from the temporary storage means, R ₁ -R ₂ is calculated, and the calculation result R ₃ is stored in the temporary storage means (step 6).
In the elliptic scalar multiplication calculation means, the scalar multiplication of R ₃

を計算して、計算結果Ｒ_４を一時記憶手段に格納し（ステップ７）、
最終的に、出力手段により、一時記憶手段からＲ_４を読み出して出力する（ステップ８）。

And the calculation result R ₄ is stored in the temporary storage means (step 7),
Finally, the output unit outputs the temporary storage means reads out the R ₄ (Step 8).

The present invention (Claim 2) is a unidirectional function calculation method for calculating a unidirectional function,
R ₁ ,..., R ₃ ∈ E [L] (where E [L] is a prime number, and LR = O (of the points R on the elliptic curve E defined on the finite field). However, an area for ensuring a set of R satisfying O) is satisfied,
In the eigenvalue calculation means, the eigenvalue λ ₂ ∈Z / LZ of the Frobenius map is obtained,
In the input means, R∈E [L] is input,
In the Frobenius map calculation means, the point φR on the elliptic curve is calculated from the Frobenius map φ, and the calculation result R ₁ is stored in the temporary storage means.
In the elliptic scalar multiplication calculation means, the eigenvalue λ ₂ obtained by the eigenvalue calculation means is obtained, the scalar multiplication λ ₂ R of the point R is calculated, and the calculation result R ₂ is stored in the temporary storage means.
In the ellipse subtracting means, the calculation result R ₁ and the calculation result R ₂ are obtained from the temporary storage means, R ₁ -R ₂ is performed, and the calculation result R ₃ is stored in the temporary storage means.
Finally, R ₃ is read from the temporary storage means and output by the output means.

と一致する楕円曲線上の点の値を、領域Ｒ_１から読み出し、出力手段により出力する。 The present invention (Claim 3) is defined on an elliptic curve when a rational point group of a non-super singular elliptic curve defined on a finite field includes a Cartesian product group of two cyclic groups having the same order. In the one-way function calculation method for calculating the one-way function,
In the temporary storage means, an area R ₁ for storing points on the elliptic curve, an area i capable of storing an integer of 0 to m,
In the initial value setting means,
Set R ₁ to the infinity point O on the elliptic curve, set the area i to 0,
In the input means,
Elliptic curve E [L] (E [L] (where E [L] is a prime number, and LR = O among the points R on the elliptic curve E defined on the finite field, where O is infinity) A set of R satisfying the point)))
By Frobenius map calculation means,
The Frobenius map φ ⁱ R is calculated, the calculation result and the point R ₁ are input to the ellipse addition calculation means, the calculation result is stored in the region R ₁ , the count of the region i is set to i + 1, and i ≧ m (m Is repeated until the value becomes an integer of 1 or more,
Finally,

The value of a point on an elliptic curve that matches the read from the region R _1, and outputs the output means.

を、

と定義し、任意の点Ｅ［Ｌ］上の点に対して、

なるＥ［Ｌ］上の点Ｐ，Ｑが存在し（点ＲはＲ＝Ｐ＋Ｑ）、線形空間Ｅ［Ｌ］の線形変換

による象

を、フロベニウス写像φの固有値λ ₁ に関する固有空間とし、該固有空間への射影になる線形変換

（但し、固有値は1、及びｑmod L、λ ₁ ＝1、λ _２ ＝ｑmod Lとする）
であるトレースマップを適用し、フロベニウス写像φによりＲ_１＋φ^ｉＲとして、その結果Ｒ ₁ を一時記憶手段に格納し、ｉ＋1とし、ｉ≧ｍ（ｍは0以上の整数）になるまで当該処理を繰り返し、
最終的に、出力手段から計算結果Ｒ_１を一時記憶手段から読み出して出力する。 Coefficient characteristic polynomial of scalar multiplication Z / LZ on decomposition
φ ² −tφ + q = (φ−λ ₁ ) (φ−λ ₂ )
(Where λ ₁ and λ ₂ are eigenvalues of the Frobenius map φ),
Linear transformation of the linear space E [L] when λ ₁ , λ ₂ εZ / LZ and λ ₁ ≠ λ ₂

The

For a point on an arbitrary point E [L],

There are points P and Q on E [L] (point R is R = P + Q), and linear transformation of the linear space E [L]

By elephant

Is the eigenspace with respect to the eigenvalue λ ₁ of the Frobenius map φ, and the linear transformation that projects to the eigenspace

(However, the eigenvalue is 1, and qmod L, λ ₁ = 1, λ ₂ = qmod L)
Applying the trace map as follows, R ₁ + φ ⁱ R by Frobenius map φ , the result R ₁ is stored in temporary storage means, i + 1 is set, and this processing is performed until i ≧ m (m is an integer of 0 or more) Repeat
Finally, read and output from the temporary storage means a calculation result R ₁ from the output unit.

である）とする加算連鎖を用いた一方向性関数計算を用いる。 According to the present invention (Claim 4), in the ellipse addition calculation means,
m addition chain n ₀ = 1, n _i = n _j + n _k , (j, k <i), n _c = m (where c is the length of the addition chain of m) ,
Let the count of region i be i + 1,
Determine j, k <i for region i according to the addition chain,

Way function Get used with addition chain to the a).

  FIG. 2 is a principle configuration diagram of the present invention.

The present invention (Claim 5) is a one-way function computing device for calculating a one-way function,
R ₁ ,..., R ₄ ∈ E [L] (where E [L] is a prime number, and LR = O ( of the points R on the elliptic curve E defined on the finite field) A temporary storage means 250 in which an area for storing a set of R satisfying O) is satisfied;
Eigenvalue calculating means 210 for obtaining eigenvalues λ ₁ and λ ₂ ∈Z / LZ of the Frobenius map;
Scalar times

として予め求めておくスカラー倍設定手段２２０と、
Ｒ∈Ｅ［Ｌ］を入力する入力手段と２３０、
フロベニウス写像φにより、楕円曲線上の点φＲを計算し、計算結果Ｒ_１を一時記憶手段に格納するフロベニウス写像計算手段２４０と、
固有値計算手段２１０から固有値を取得し、点Ｒのスカラー倍λ_２Ｒを計算し、計算結果Ｒ_２を一時記憶手段２５０に格納する楕円スカラー倍計算手段２６０と、
一時記憶手段２５０から計算結果Ｒ _１ と計算結果Ｒ _２ を取得し、Ｒ_１−Ｒ_２を計算し、計算結果Ｒ_３を一時記憶手段２５０に格納する楕円減算手段２７０と、
スカラー倍設定手段２２０からλ_Δを取得し、Ｒ_３のスカラー倍

A scalar multiplication setting means 220 obtained in advance as
230, input means for inputting RεE [L]
Frobenius map calculation means 240 for calculating a point φR on the elliptic curve from the Frobenius map φ and storing the calculation result R ₁ in the temporary storage means;
An ellipse scalar multiplication calculator 260 that obtains an eigenvalue from the eigenvalue calculator 210, calculates a scalar multiple λ ₂ R of the point R, and stores the calculation result R ₂ in the temporary storage unit 250;
Ellipse subtracting means 270 that obtains the calculation result R ₁ and the calculation result R ₂ from the temporary storage means 250, calculates R ₁ -R ₂ , and stores the calculation result R ₃ in the temporary storage means 250;
Λ _Δ is obtained from the scalar multiplication setting means 220, and the scalar multiplication of R ₃

を計算して、計算結果Ｒ_４を一時記憶手段に格納する第２の楕円スカラー倍計算手段と、
最終的に、一時記憶手段２５０からＲ_４を読み出して出力する出力手段２８０と、を有する

A second elliptic scalar multiplication calculating means for storing the calculation result R ₄ in the temporary storage means;
And finally, an output unit 280 that reads and outputs R ₄ from the temporary storage unit 250.

The present invention (Claim 6) is a one-way function calculation device for calculating a one-way function,
R ₁ ,..., R ₃ ∈ E [L] (where E [L] is a prime number, and LR = O (of the points R on the elliptic curve E defined on the finite field). However, O is a temporary storage means in which an area for storing a set of R satisfying the infinity point) is secured;
In advance, eigenvalue calculation means for obtaining the eigenvalue λ ₂ ∈Z / LZ of the Frobenius map;
Input means for inputting RεE [L];
Frobenius map calculating means for calculating a point φR on the elliptic curve from the Frobenius map φ and storing the calculation result R ₁ in the temporary storage means;
An elliptic scalar multiplication calculating means for obtaining the eigenvalue λ ₂ obtained by the eigenvalue calculating means, calculating a scalar multiplication λ ₂ R of the point R, and storing the calculation result R ₂ in the temporary storage means;
Ellipse subtracting means for obtaining the calculation result R ₁ and the calculation result R ₂ from the temporary storage means, performing R ₁ -R ₂ , and storing the calculation result R ₃ in the temporary storage means;
Finally, and an output means for outputting the read out R ₃ from the temporary storage means.

と一致する楕円曲線上の点の値を、領域Ｒ_１から読み出し、出力する出力手段と、
を有する。 The present invention (Claim 7) is defined on an elliptic curve when a rational point group of a non-super singular elliptic curve defined on a finite field includes a Cartesian product group of two cyclic groups having the same order. A one-way function calculation device for calculating a one-way function
An area R ₁ for storing points on the elliptic curve, a temporary storage means for securing an area i in which an integer of 0 to m can be stored;
Elliptic curve E [L] (E [L] (where E [L] is a prime number, and LR = O among the points R on the elliptic curve E defined on the finite field, where O is infinity) set the point at infinity O on an elliptic curve point R ₁ on the set)) of R that satisfies the point), and the initial value setting means for setting a 0 in the area i,
Input means for acquiring a point R on an elliptic curve;
The Frobenius map φ ⁱ R is calculated, the calculation result and the point R ₁ are input to the ellipse addition calculation means, the output result is stored in the region R ₁ , the count of the region i is set to i + 1, and i ≧ m (m Frobenius map calculation means that repeats the process until it becomes an integer of 1 or more,
Finally,

And output means a value of a point on an elliptic curve, read from the realm R _1, and outputs that match,
Have

である）とする加算連鎖を用いた一方向性関数計算を用いる。 The ellipse addition calculation means of the present invention (Claim 8)
m addition chain n ₀ = 1, n _i = n _j + n _k , (j, k <i), n _c = m (where c is the length of the addition chain of m) ,
Let the count of region i be i + 1,
Determine j, k <i for region i according to the addition chain,

Way function Get used with addition chain to the a).

The present invention (claim 9) provides a computer,
A one-way function calculation program for causing each unit of the one-way function calculation device according to claim 5 to function .

として予め求めておくステップと、
Ｒ∈Ｅ［Ｌ］を入力させるステップと、
フロベニウス写像φにより、φＲを計算し、計算結果Ｒ_１を一時記憶手段に格納するステップと、
Ｒのスカラー倍λ_２Ｒを計算し、計算結果Ｒ_２を一時記憶手段に格納するステップと、
一時記憶手段から計算結果Ｒ_１と計算結果Ｒ_２を取得してＲ _１−Ｒ_２を計算し、計算結果Ｒ_３を一時記憶装置に格納するステップと、
Ｒ _３ のスカラー倍

As a step to obtain in advance as
Inputting R∈E [L];
A step of calculating φR from the Frobenius map φ and storing the calculation result R ₁ in a temporary storage means;
Calculating a scalar multiple λ ₂ R of R and storing the calculation result R ₂ in a temporary storage means;
Obtaining the calculation result R ₁ and the calculation result R ₂ from the temporary storage means, calculating R ₁ -R ₂ , and storing the calculation result R ₃ in the temporary storage device;
Scalar multiplication of R ₃

を計算して、計算結果Ｒ_４を一時記憶手段に格納するステップと、
最終的に、一時記憶手段からＲ_４を読み出して出力させるステップと、を実行する。

And storing the calculation result R ₄ in the temporary storage means;
Finally, reading R ₄ from the temporary storage means and outputting it is executed.

The present invention is a one-way function calculation program for calculating a one-way function,
R ₁ ,..., R ₃ ∈ E [L] (where E [L] is the entire twist point on the elliptic curve, L is a prime number) in the temporary storage means;
Obtaining in advance the eigenvalue λ ₂ ∈Z / LZ of the Frobenius map;
In the input means, inputting R∈E [L];
Calculating the Frobenius map φR and storing the calculation result R ₁ in a temporary storage means;
Obtaining a fixed value λ ₂ , calculating an elliptic scalar multiplication λ ₂ R, and storing the calculation result R ₂ in a temporary storage means;
Obtaining the calculation result R ₁ and the calculation result R ₂ from the temporary storage means, performing R ₁ -R ₂ , and storing the calculation result R ₃ in the temporary storage means;
Finally, it executes the steps of outputting reads the R ₃ from the temporary storage means.

  According to the present invention, a one-way function that can be reduced to the difficulty of the elliptic DH determination problem can be configured.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  Prior to the description of the configuration and operation, an elliptic curve, a Frobenius map of a finite field, a Frobenius map of an elliptic curve, and the eigenspace and projection of the Frobenius map will be described.

(1) Elliptic curve:
In general, an elliptic curve defined on the field K is an equation E: y ² + a ₁ xy + a ₃ y = x ³ + a ₂ x ² + a _{4 where} a ₁ , a ₂ , a 3, a ₄ , a ₆ ∈K x + a ₅ (1)
A special point O called an infinite point is added to a set of points (x, y) satisfying the above. Binary operations + called elliptic addition for arbitrary two points on the elliptic curve and unary operations called elliptic inverse element for any one point on the elliptic curve are defined by finite number of K field operations. The elliptic curve forms a group with respect to elliptic addition by having the following properties.

-R ₁ + R ₂ is a point on the elliptic curve for any two points R ₁ and R ₂ on the elliptic curve.

-For any three points R ₁ , R ₂ , R ₃ on the elliptic curve,
R ₁ + (R ₂ + R ₃ ) = (R ₁ + R ₂ ) + R ₃ (bonding rule)
For -O, for any point R1 on the elliptic curve,
R ₁ + O = O + R ₁ = R ₁ (existence of unit element)
-For any point R ₁ on the elliptic curve, there is an inverse element (-R ₁ ) and R ₁ + (-R ₁ ) = (-R ₁ ) + R ₁ = O (existence of the inverse element)
Furthermore, ellipse addition has the following properties.

-R ₁ + R ₂ = R ₂ + R ₁ for any two points R ₁ and R ₂ on the elliptic curve (exchange rule).

If there is one point R on the elliptic curve, the point 2R on the elliptic curve 2R = R + R can be created using elliptic addition. Similarly, if (−k) R = k (−R) and 0R = O are defined for an arbitrary positive integer k, kR can be defined for an arbitrary integer k. Finding the point kR from the integer k and the point R is called an elliptic scalar multiplication. In addition, the binary operation “−” is changed to R ₁ −R ₂ = R ₁ + (− R ₂ ).
And call it elliptical subtraction. In particular, when K is a finite field and a point on K, or a point R on the finite degree expansion of K is a point on the elliptic curve (1), R generates a finite cyclic group and uses it. It is often done to construct a cryptographic system or a signature system. Such an encryption system or signature system uses an elliptic curve that can be efficiently calculated by elliptic addition and elliptic scalar multiplication. Let L be a prime number, and a set of R satisfying LR = O among points R on the elliptic curve E defined on the finite field is E [L]. E [L] is a linear space on Z / LZ in which the addition of ellipse is added and the elliptical scalar multiplication is the scalar multiplication because the following property holds for E [L].

Regarding ellipse addition,
Ellipse addition R ₁ + R ₂ is a point on E [L] with respect to arbitrary two points R ₁ and R ₂ on −E [L].

  -The coupling rule of ellipse addition also holds on E [L].

  The ellipse addition exchange rule holds even on E [L].

-O is a point on E [L] and has a property that O + R ₁ = R _{1 with} respect to an arbitrary point R1 on E [L].

For any point R ₁ on -E [L], the inverse element (-R ₁ ) exists only on E [L].

Regarding Elliptical Scalar Multiplication For an arbitrary point R ₁ on -E [L] and an arbitrary element k ₁ of the field Z / LZ, the elliptic scalar multiplication k ₁ R ₁ is a point on E [L].

For any point R ₁ on E [L] and any binary k ₁ , k ₂ on Z / LZ, (k ₁ + k ₂ ) R ₁ = k ₁ R ₁ + k ₂ R ₂ .

For any two points R ₁ , R ₂ on E [L] and any element k ₁ on the field Z / LZ, k ₁ (R ₁ + R ₂ ) = k ₁ R ₁ + k ₁ R ₂ .

For any point R ₁ on E [L] and any binary k ₁ , k ₂ on the field Z / LZ, (k ₁ , k ₂ ) R ₁ = k ₁ (k ₂ R ₁ ).

1R ₁ R ₂ for any point R ₁ on E [L] and the multiplicative unit ₁ of the field Z / LZ.

(2) Frobenius map of finite field:
Let q be a prime number or its power. To represent an element x on the finite field GF (q ^m ), a set of m elements x _i , (0 ≦ i <m) on the finite field GF (q) can be used. A typical method for associating a set of m x _i εGF (q), (0 ≦ i <m) with an element on GF (q ^m ) is m α _i εGF (q ^m ), Using a set of (0 ≦ i <m)

なる対応をとることである。この時、α_ｉ，（０≦ｉ＜ｍ）は、ＧＦ（ｑ）^ｍとＧＦ（ｑ^ｍ）とで１対１対応が取れるような特別な組み合わせでなくてはならない。このような性質を持つα_ｉ（０≦ｉ＜ｍ）を基底と呼ぶ。とこで、二項定理によれば、

Is to take a response. At this time, α _i , (0 ≦ i <m) must be a special combination that allows a one-to-one correspondence between GF (q) ^m and GF (q ^m ). Α _i (0 ≦ i <m) having such properties is called a base. Here, according to the binomial theorem,

である。右辺の各項の係数

It is. Coefficient of each term on the right side

は、二項係数と呼ばれる定数で、ｉ≠０かつｉ≠ｑの場合、必ずｑの倍数となる。α，β∈ＧＦ（ｑ^ｍ）の時は、ｑの整数倍は０と同値であるから、
（α＋β）_ｑ＝α^ｑ＋β^ｑ
が成立する。さらに、ｃ∈ＧＦ（ｑ）なるｃに関してｃ^ｑ＝ｃが成立する。一般に、α_１，α_２，…，α_ｎを不定元とする任意のＧＦ（ｑ）係数有理式ｆ（α_１，α_２，…，α_ｎ）に対して、

Is a constant called a binomial coefficient, and is always a multiple of q when i ≠ 0 and i ≠ q. When α, β∈GF (q ^m ), an integer multiple of q is equivalent to 0, so
(Α + β) _q = α ^q + β ^q
Is established. Furthermore, c ^q = c holds for c c∈GF (q). In general, alpha _1, alpha _2, ..., any GF (q) coefficient rational expression f to the alpha _n and indeterminate _{(α 1, α 2, ...} , α n) with respect to,

が成立する。従って、

Is established. Therefore,

なるとき、

When

である。従って事前に、

It is. So in advance,

なるｃ_ｉｊ∈ＧＦ（ｑ）が計算してあれば、

If c _ij ∈GF (q) is calculated,

によって、元の基底α_ｉを使ったｘ^ｑの表現

^Gives the representation of x ^q using the original basis α _i

を求めることができる。すなわち、ｘ∈ＧＦ（ｑ^ｍ）を表現するベクトル（ｘ_ｉ）に行列（ｃ_ｉｊ）をかけるだけでｘ^ｑを表現するベクトルが得られる。この演算コストは一般には、ＧＦ（ｑ^ｍ）上の乗算１回分の演算コストと略等しい。また、行列（ｃ_ｉｊ）^ｎ，（ｎ＝２，３，…）を事前に求めておけば、行列（ｃ_ｉｊ）をかけるだけで、

Can be requested. That is, a vector expressing x ^q can be obtained by simply multiplying the vector (x _i ) expressing x∈GF (q ^m ) by the matrix (c _ij ). This calculation cost is generally substantially equal to the calculation cost for one multiplication on GF (q ^m ). If the matrix (c _ij ) ⁿ , (n = 2, 3,...) Is obtained in advance, simply multiplying the matrix (c _ij )

を表現するベクトルが得られる。あるいは、（ｃ_ｉｊ）^−１を事前に求めておけば、（ｃ_ｉｊ）^−１をかけるだけで、ｘ^１／ｑを表現するベクトルが得られる。従って一般の整数ｎに対して、

Can be obtained. Alternatively, if (c _ij ) ⁻¹ is obtained in advance, a vector expressing x ^{1 / q} can be obtained simply by multiplying (c _ij ) ⁻¹ . Therefore, for a general integer n,

の演算コストは、一般にＧＦ（ｑ^ｍ）上の演算１回分の演算コストに等しい。さらに、行列（ｃ_ｉｊ）が簡単になるようにな、特別な基底が存在し、そのような基底を採用した場合、

Is generally equal to the operation cost for one operation on GF (q ^m ). Furthermore, if there is a special base that makes the matrix (c _ij ) simple, and adopting such a base,

の演算コストはＧＦ（ｑ^ｍ）上の乗算と比較して、無視できるほど小さい。ＧＦ（ｑ^ｍ）上の元ｘからｘ^ｑへの写像をフロベニウス写像と呼ぶ。また、整数ｎに関して、ｘから

The computation cost of is negligibly small compared to the multiplication on GF (q ^m ). The mapping from element x to x ^q on GF (q ^m ) is called the Frobenius map. For integer n, from x

への写像をｑ^ｎ乗フロベニウス写像と呼ぶ。

The mapping to is called the qn- ^th power Frobenius map.

(3) Frobenius map of elliptic curve:
Let m be an integer and q be a prime number or its power. Elliptic curve defined on a finite field GF (q) E / GF (q): y ² + a ₁ xy + a ₃ y = x ₃ + a ₂ x ² + a ₄ x + a ₆ (3)
_(However, the _{a 1, a 2, a 3} , a 4, a 5 ∈GF (q)). For GF (q ^m ) rational point R above,

なるφを楕円曲線のフロベニウス写像と呼ぶ。有限体のフロベニウス写像の（２）式の性質により、点Ｒが楕円曲線Ｅ／ＧＦ（ｑ）上の点であるなら、点φＲも楕円曲線Ｅ／ＧＦ（ｑ）上の点である。一般に、Ｅ／ＧＦ（ｑ）上の点の楕円加算及び楕円スカラー倍演算は、与えられる点の座標に関するＧＦ（ｑ）係数有理写像で与えられる。従って有限体のフロベニウス写像の（２）式の性質により以下の性質が成り立つので、フロベニウス写像φは、線形空間Ｅ［Ｌ］の線形変換である。

This φ is called the Frobenius map of an elliptic curve. If the point R is a point on the elliptic curve E / GF (q) due to the nature of the Frobenius map of the finite field, the point φR is also a point on the elliptic curve E / GF (q). In general, the elliptic addition and elliptic scalar multiplication of points on E / GF (q) are given by a GF (q) coefficient rational map for the given point coordinates. Accordingly, since the following property is established by the property of the Frobenius map of the finite field, the Frobenius map φ is a linear transformation of the linear space E [L].

-The Frobenius map of an elliptic curve is a self-homogeneous map on E / GF (q). That is,
φ (R ₁ + R ₂ ) ≈ (φR ₁ ) + (φR ₂ )
-Elliptical scalar multiplication and Frobenius maps of elliptic curves are commutative. That is,
φ (kR) = k (φR)
In particular, a point on E [L] is moved to a point on E [L] by the Frobenius map. That is,

ｎを整数として、一般にｑ^ｎ乗フロベニウス写像φ^ｎは、

In general, n is an integer, and the q ⁿ power Frobenius map φ ⁿ is

と定義されるが、上記のことは、ｑ^ｎ乗フロベニウス写像φ^ｎでも同様に成立する。

The above holds true for the qn- ^th power Frobenius map φ ⁿ as well.

(4) Eigenspace and projection of Frobenius map:
See references in "Ian F. Brake, Gadiel Selossi, Nigel P. Smart = Author, Jiro Suzuki = Translation," Elliptic Curve Cryptography ", p112 Publishing, Pearson Education, ISBN4-89471-431-0" In addition, the Frobenius map φ is given for any GF (q ^m ) rational point R in the above equation (3).
(Φ ² −tφ + q) R = O (4)
Meet. (Where t is an integer uniquely determined by q, a ₁ , a ₂ , a ₃ , a ₄ , and a ₆ ) A polynomial φ ² −tφ + q related to φ is called a characteristic polynomial. If the elliptic curve to be considered is limited to E [L] (where L is a prime number), the scalar multiplication may be considered as Z / LZ.

In the characteristic polynomial of the Z / LZ coefficient, on the decomposition,
φ ² −tφ + q = (φ−λ ₁ ) (φ−λ ₂ )
Λ ₁ and λ ₂ are called eigenvalues of the Frobenius map φ. Hereinafter, let us consider a case where λ ₁ , λ ₂ ∈Z / LZ, and λ ₁ ≠ λ ₂ . Linear transformation of linear space E [L]

を

The

と定義すると、任意のＥ［Ｌ］上の点Ｒに対して、

For any point R on E [L],

なるＥ［Ｌ］上の点Ｐ，Ｑが存在し、点Ｒは、
Ｒ＝Ｐ＋Ｑ （７）
と一意に分解できる。線形空間Ｅ［Ｌ］の線形変換

There exist points P and Q on E [L], and the point R is
R = P + Q (7)
And can be decomposed uniquely. Linear transformation of linear space E [L]

による像

Statue by

を、フロベニウス写像φの固有値λ_１に関する固有空間とよび、固有空間

Is called the eigenspace for the eigenvalue λ ₁ of the Frobenius map φ, and the eigenspace

上の任意の点Ｐに関して、
φＰ＝λ_１Ｐ
が成立する。Ｅ［Ｌ］から固有空間

For any point P above,
φP = λ ₁ P
Is established. E [L] to eigenspace

への準同型写像を

Homomorphism to

への射影と呼ぶ。線形変換

Called projection to. Linear transformation

は、

Is

への射影である。同様に、

Projection to. Similarly,

による像

Statue by

を、フロベニウス写像φの固有値λ_２に関する固有空間と呼び、固有空間

Is called the eigenspace for the eigenvalue λ ₂ of the Frobenius map φ, and the eigenspace

上の任意の点Ｑに関して
φＱ＝λ_２Ｑ
が成立する。Ｅ［Ｌ］から固有空間

For any point Q above
φQ = λ ₂ Q
Is established. E [L] to eigenspace

への準同型写像を

Homomorphism to

への射影と呼ぶ。線形変換

Called projection to. Linear transformation

は、

Is

への射影である。上記の（７）式の分解をフロベニウス写像φの固有空間に関する固有分解と呼ぶ。固有空間は、それぞれ、位数Ｌの巡回群となり、

Projection to. The decomposition of the above equation (7) is called eigendecomposition related to the eigenspace of the Frobenius map φ. Each eigenspace is a cyclic group of order L,

である。一般に、ｑ^ｎ乗フロベニウス写像φ^ｎに関してもＥ［Ｌ］に関するＺ／ＬＺ係数の特性多項式
（φ^ｎ）^２−ｔ_ｎ（φ^ｎ）＋ｑ^ｎ＝（φ^ｎ−λ_１ ^ｎ）（φ^ｎ−λ_２ ^ｎ）
（ｔ_ｎは、ｔ，ｎ，ｑによって決まる整数）を考えることにより、固有値、固有空間、固有分解、射影等を構成できる。本発明をｑ^ｎ乗フロベニウス写像φ^ｎを使っても実現できるので、以降、フロベニウス写像φと云った場合、単なるｑ乗フロベニウス写像だけでなく、ｑ^ｎ乗フロベニウス写像も含むものとする。

It is. Generally, ^{q n-th} power Frobenius map phi E regard ⁿ [L] about Z / LZ coefficients of the characteristic polynomial _{^{(φ n) 2 -t n (}} φ n) + q n = (φ n -λ 1 n) (φ n - λ ₂ ⁿ )
By considering (t _n is an integer determined by t, n, and q), eigenvalues, eigenspaces, eigendecompositions, projections, and the like can be configured. Since the present invention can also be realized using the q ^{n -th} power Frobenius map φ ⁿ , hereinafter, the Frobenius map φ includes not only a q-th power Frobenius map but also a q ⁿ power Frobenius map.

(5) Pairing:
Let μL be a multiplicative group created by the L root of the multiplicative unit element 1 on the algebraic closure of the elliptic curve definition field K. References "Alfred J.Menezes," ELLIPTIC CUEVE PUBLIC KEY CEYPTOSYSTEMS "pp.61-81, published KLUWER ACADEMIC PUBLISHERS, as in ISBN0-7923-9368-6, the pairing e _L,
e _L : E [L] × E [L] → μ _L
Which has the following properties:

-For any point R ₁ on E [L], e _L (R ₁ , R ₁ ) = 1.
For any two points R ₁ and R ₂ on −E [L], e _L (R ₁ , R ₂ )
= E _L (R ₂ , R ₁ ) ⁻¹
For any three points R ₁ , R ₂ , R ₃ on −E [L],
e _L (R ₁ + R ₂ , R ₃ ) = e _L (R ₄ , R ₃ ) e _L (R ₂ , R ₃ ),
_{e L (R 1, R 2} + R 3) = e L (R 1, R 2) e L (R 1, R3)
For any point R ₁ on −E [L], e _L (R ₁ , O) = 1, and
If a point R ₁ on E [L] satisfies e _L (R ₁ , R ₂ ) = 1 for all points R ₂ on E [L], then R1 = O.
(6) Unidirectional function using projection:
In the following, assuming that L is sufficiently large, an eigenspace is considered in which the eigenvalues λ ₁ and λ _{2 of} the Frobenius map φ are λ ₁ and λ ₂ ∈Z / LZ and λ ₁ ≠ λ _{2 with} respect to E [L]

の任意の生成元Ｐ及び固有空間

Any generator P and eigenspace of

の任意の生成元Ｑを用いて、Ｅ［Ｌ］上の任意の点Ｒは、ｋ_１，ｋ_２∈Ｚ／ＬＺとして、
Ｒ＝ｋ_１Ｐ＋ｋ_２Ｑ
と書ける。Ｒによって生成される巡回群（Ｒ）上の任意の点Ｒ_１から、固有空間

An arbitrary point R on E [L] is given by k ₁ , k ₂ ∈Z / LZ, using an arbitrary generator Q of
R = k ₁ P + k ₂ Q
Can be written. From an arbitrary point R ₁ on the cyclic group (R) generated by R, the eigenspace

あるいは、固有空間

Or eigenspace

への射影は、各々、前述の（５）、（６）式に従って、楕円加算、楕円逆元、楕円スカラー倍、フロベニウス写像を用いて、効率的に計算することができる。一方、ｋ_１≠０かつｋ_２≠０なる時、Ｒ_１の射影

The projection onto can be calculated efficiently using ellipse addition, elliptic inverse, elliptic scalar multiplication, and Frobenius map, respectively, according to the above-described equations (5) and (6). On the other hand, when k ₁ ≠ 0 and k ₂ ≠ 0, the projection of R ₁

あるいは、

Or

のどちらか一方からＲ_１を求めることは、楕円曲線Ｅが特別な場合を除いて、一般には困難であると考えられる。この一方向性関数に関して次のことがわかる。

It is generally considered difficult to obtain R ₁ from either of them except for the case where the elliptic curve E is special. The following can be seen for this one-way function.

-With respect to the non-super singular elliptic curve E / GF (q) defined on GF (q), let E (GF (q)) be the rational point of GF (q) of E / GF (q), and E (GF (q ^m )) is the rational point of GF (q ^m ) of E / GF (q). L│ # E (GF (q)) and

とし、Ｌ^２│＃Ｅ（ＧＦ（ｑ^ｍ））とする。このとき、λ_１＝１及び、λ_２＝ｑmod Ｌとできる。ｍは、Ｌに比べて十分小さいとする。このとき、例えば、前述の参考文献記載の方法のように、効率的に計算可能なペアリングｅ_Ｌが存在する。

And L ² | #E (GF (q ^m )). At this time, λ ₁ = 1 and λ ₂ = qmod L. It is assumed that m is sufficiently smaller than L. In this case, for example, as a method of the aforementioned references described, efficiently computable pairing e _L is present.

  -For the elliptic curve as above, the eigenspace

または、固有空間の

Or eigenspace

のどちらか一方から巡回群（Ｒ）への同型写像で、単一の有理写像で記述できるものは存在しない。

There is no isomorphic mapping from either of these to the cyclic group (R) that can be described by a single rational mapping.

  -For the elliptic curve as above, the eigenspace

から巡回群（Ｒ）への同型写像が効率的に計算可能であると仮定すると、上記ペアリングｅ_Ｌを用いてＥ（ＧＦ（ｑ））の位数Ｌの部分群に対する楕円ＤＨ判定問題が効率的に計算可能となる。現在、非超特異楕円曲線の十分大きい素数位数部分群での楕円ＤＨ判定問題は効率的に計算することは困難であるという暗号学的仮定は広く信じられており、本発明の一方向性が破られれば楕円ＤＨ判定問題を利用した情報セキュリティ技術に対して新たな制約条件が必要となる。

Assuming that the isomorphism from C to the cyclic group (R) can be calculated efficiently, the elliptical DH decision problem for the subgroup of order L of E (GF (q)) using the pairing e _L is It can be calculated efficiently. Currently, the cryptographic assumption that the elliptic DH decision problem with sufficiently large prime order subgroups of non-super singular elliptic curves is difficult to compute efficiently is widely believed, and the unidirectionality of the present invention If this is broken, a new constraint condition is required for the information security technology using the elliptic DH determination problem.

- above-described elliptic curve with respect to E [L] any point cyclic _{group R 1} generates a non O on _{(R 1)} and, for any point _{R 2} on the E [L], _{R 2} The problem of determining whether or not ε <R ₁ > can be efficiently determined using the pairing e _L as described below, for example.

(6-1) First Embodiment / Subgroup Upper Determination Method:
FIG. 3 shows the configuration of the subgroup element determination device according to the first embodiment of the present invention. The subgroup element determination apparatus 100 shown in the figure includes an input unit 110 for inputting R ₁ , R ₂ εE [L], R ₁ ≠ O, a pairing calculation unit 120, a temporary storage unit 130, a determination unit 140, and The output unit 150 outputs a truth value (∈ {TRUE, FALSE}) of R ₂ ∈ <R ₁ >.

  FIG. 4 is a flowchart of the subgroup element determination method according to the first embodiment of the present invention.

First, as a preparation, to secure the temporary storage unit 130 the T∈myu _L as a temporary storage area (step 101).

R ₁ , R ₂ ∈ E [L], R ₁ ≠ O are input from the input unit 110 (step 102).

The pairing calculation unit 120 calculates pairing t ← e _L (R ₁ , R ₂ ) (step 103).

  In the determination unit 140, if t = 1 (step 104), TRUE is output from the output unit 150 and the process ends (step 105). If t ≠ 1 (step 104), FALSE is output from the output unit 150. The process ends (step 106).

(6-2) Second embodiment / one-way function calculation method:
For any point R on E [L] above, its projection, eg

を計算するためには、前述の（５）式に従って、以下の処理を行う。

Is calculated according to the above-described equation (5).

  FIG. 5 shows a configuration of a one-way function calculation apparatus according to the second embodiment of the present invention. The one-way function calculation apparatus 200 shown in the figure includes an input unit 230 for inputting RεE [L], a fixed value calculation unit 210, a scalar value setting unit 220, a Frobenius map calculation unit 240, a temporary storage unit 250, an ellipse A scalar multiplication calculation unit 260, an ellipse subtraction unit 270, and an output unit 280 are included.

  FIG. 6 is a flowchart of the one-way function calculation method according to the second embodiment of the present invention.

First, as preparatory processing, temporary storage R ₁ ,... R ₄ εE [L] is secured in the temporary storage unit 250 in advance (step 201). Further, eigenvalue λ ₂ εZ / LZ is obtained in advance in fixed value calculation unit 210 (step 202). In the scalar value setting unit 220,

を、

The

として予め求めておく(ステップ２０３)。

(Step 203).

  From the input unit 230,

を入力し(ステップ２０４)、フロベニウス写像計算部２４０において、フロベニウス写像Ｒ_１←φＲを計算し、一時記憶部２５０に格納し(ステップ２０５)、楕円スカラー倍計算部２６０において、楕円スカラー倍Ｒ_２←λ_２Ｒを計算し、一時記憶部２５０に格納し(ステップ２０６)。楕円減算部２７０において、楕円減算Ｒ_３←Ｒ_１−Ｒ_２を計算し、一時記憶部２５０に格納し(ステップ２０７)、再度楕円スカラー倍計算部２６０において、楕円スカラー倍

(Step 204), the Frobenius map calculation unit 240 calculates the Frobenius map R ₁ ← φR, stores it in the temporary storage unit 250 (step 205), and the elliptic scalar multiplication calculation unit 260 stores the elliptic scalar multiplication R _2. ← λ ₂ R is calculated and stored in the temporary storage unit 250 (step 206). The ellipse subtraction unit 270 calculates the ellipse subtraction R ₃ <-R ₁ −R ₂ and stores it in the temporary storage unit 250 (step 207). The ellipse scalar multiplication unit 260 again performs the elliptic scalar multiplication.

を計算し、一時記憶部２５０に格納する(ステップ２０８)。最後に、出力部２８０は、一時記憶部２５０に格納されているＲ_４を出力する(ステップ２０９)。

Is stored in the temporary storage unit 250 (step 208). Finally, the output unit 280 outputs R ₄ stored in the temporary storage unit 250 (step 209).

(6-3) Third embodiment / one-way function calculation method:
The calculation cost of the one-way function calculation method (6-2) above is one Frobenius map, one elliptical subtraction, and two elliptical scalar multiplications, and the elliptical scalar occupies most of the computational cost. This is twice as many parts. By the way, for any k∈Z / LZ where k ≠ 0, linear operation

も固有空間

Eigenspace

への射影であるから、上記の一方向性を持つ。従って、ｋ＝λ_１−λ_２等としておけば、上記の（６−２）の楕円スカラー倍の演算を１回分削減できる。

It has the above-mentioned unidirectionality. Therefore, if k = λ ₁ −λ ₂ or the like, the calculation of the elliptic scalar multiplication (6-2) can be reduced by one time.

  FIG. 7 shows a configuration of a one-way function calculation apparatus according to the third embodiment of the present invention. The one-way function calculation apparatus 300 shown in the figure includes an input unit 330 for inputting RεE [L], an eigenvalue calculation unit 310, a Frobenius map calculation unit 340, a temporary storage unit 350, an elliptic scalar multiplication calculation unit 360, an ellipse. A subtractor 370 and an output unit 380 are included.

  FIG. 8 is a flowchart of the one-way function calculation method according to the third embodiment of the present invention.

First, as a preparatory process, R ₁ ,... R ₃ ∈ E [L] are secured in the temporary storage unit 350 in advance as temporary storage areas (step 301). Next, the eigenvalue calculation unit 310 obtains λ2εZ / LZ in advance (step 302).

RεE [L] is input from the input unit 310 (step 303), the Frobenius map calculation unit 340 calculates the Frobenius map R ₁ ← φR, and stores R ₁ in the temporary storage unit 350 (step 304).

The elliptic scalar multiplication calculator 360 calculates the elliptic scalar multiplication R ₂ ← λ ₂ R, and stores R ₂ in the temporary storage unit 350 (step 305).

The ellipse subtraction unit 370 calculates the ellipse subtraction R ₃ ← R ₁ −R ₂ and stores R ₃ in the temporary storage unit 350 (step 306).

Finally, the output unit 380 outputs R ₃ stored in the temporary storage unit 350 (step 307).

(6-4) Fourth Embodiment / One-way Function Calculation Method Using Trace Map:
The calculation cost of the one-way function (6-3) is one Frobenius map, one elliptical subtraction, and one elliptical scalar multiplication. is there. When the elliptic curve E / GF (q) is L ² | #E (GF (q)) and L ² | #E (GF (q ^m )), the characteristic polynomial is
φ ² −tφ + q = (φ−1) (φ−q) (mod L)
Can be disassembled. That is, the eigenvalues are 1 and q mod L. When λ ₁ = 1 and λ ₂ = qmodL, linear transformation

は、固有空間

Is the eigenspace

への射影になる。線形変換をトレースマップと呼ぶ。一般に、ｍ＜Ｌであるが、ｍがlog₂Lに比べて小さいとき以下の一方向性関数計算方法は、一方向性関数計算方法（６−３）より高速である。

It becomes a projection to. The linear transformation is called a trace map. In general, m <L, but when m is smaller than log ₂ L, the following one-way function calculation method is faster than the one-way function calculation method (6-3).

  FIG. 9 shows the configuration of a one-way function calculation apparatus according to the fourth embodiment of the present invention. The one-way function calculation apparatus 400 shown in the figure includes an input unit 410 for inputting RεE [L], an initial value setting unit 420, a temporary storage unit 430, a point calculation unit 440, and an output unit 450.

  FIG. 10 is a flowchart of the one-way function calculation method according to the fourth embodiment of the present invention.

First, as a preparation process, the temporary storage area R ₁ εE [L], iε {0,..., M} is secured in the temporary storage unit 430 (step 401).

The initial value setting unit 420 sets R ₁ ← O, i ← 0 in the temporary storage unit 430 (step 402).

Next, the point calculation unit 440 sets R ₁ <-R ₁ + φ ⁱ R (step 403), stores R ₁ in the temporary storage unit 430 (step 404), and sets i ← i + 1 (step 405). If i <m, the process of step 403 is performed again (step 406). If i ≧ m, the output unit 450 outputs R ₁ stored in the temporary storage unit 430 and ends. (Step 407).

(6-5) Fifth Embodiment / One-way Function Calculation Using Addition Chain:
In the present embodiment, a method for calculating the trace map more efficiently with respect to a general m (˜log ₂ L) in a computable enlargement is considered. For general positive integer n

とするなら、上記の第４の実施の形態における、一方向性関数計算方法と同様の方法で、Ｔ_ｎ（Ｒ）を計算するとｎ−１回の楕円加算が発生し、これが演算の律速段階となる。いま仮に、ｃを正整数としてｎ＝２^ｃだったとすると、

If T _n (R) is calculated in the same manner as the one-way function calculation method in the fourth embodiment, n−1 elliptic additions occur, which is the rate-determining step of the calculation. It becomes. Assuming that c is a positive integer and n = ^2c ,

と書くことができる。この時、

Can be written. At this time,

のような演算方法を用いると、ｃ回即ち、log_２ｎ回の楕円加算でＴ_ｎ（Ｒ）を計算することができる。このような計算法は、例え、ｎが２の冪でなかったとしても一般に構成することが可能であり、例えば、次のように構成する。

T _n (R) can be calculated by elliptic addition of c times, that is, log ₂ n times. Such a calculation method can be generally configured even if n is not a power of 2, for example, as follows.

i, j, k are integers and integers (1 =) n0,..., n _c (= n) are n ₀ = 1, n _i = n _j + n _k , (j, k <i)
And The integer sequence n ₀ ,..., _Nc is called an addition chain of n. The calculation of T _n (R) can be performed as follows using the addition chain of _n . First, consider the addition chain n ₀ ,..., N _c of n. For i = 0,..., C, according to the correspondence of i, j, k as n _i = n _j + n _k , (j, k <i) in the addition chain,

なる演算により、Ｒ_０，…，Ｒ_ｃを求める。このとき、

R ₀ ,..., R _c are obtained by the following calculation. At this time,

が成立する。

Is established.

であるから、Ｒ_ｃが求めるＴ_ｎ（Ｒ）となる。ｎの最短の加算連鎖の長さｃは、例えば、２進計算法等を用いることによって最悪でもｃ≦２log_２ｎに抑えることができる。即ち、Ｒｃも最悪２log_２ｎ回程度の楕円加算で求めることができる。Ｔ_ｎ（Ｒ）を効率よく求めたいなら、効率の良いｎの加算連鎖を与えればよい。参考文献「Knuth著『The Art of Computer Programming』VOLUME 2 Seminumerical Algorithms Third Edition,p.465出版 Addison Wesley,ISBN0-201-89684-2」には、１以上１００以下の整数の加算回数に関する最適加算連鎖のツリー図が掲載されている。そのような加算連鎖を用いることによって、Ｔ_ｎ（Ｒ）の計算を最適化できる。

_Therefore , R _c is obtained as T _n (R). The length c of the shortest addition chain of n can be suppressed to c ≦ 2 log ₂ n at worst by using, for example, a binary calculation method. That is, Rc can also be obtained by ellipse addition of the worst 2 log ₂ n times. If it is desired to obtain T _n (R) efficiently, an efficient addition chain of n may be given. The reference "Knuth's" The Art of Computer Programming "VOLUME 2 Seminumerical Algorithms Third Edition, p.465 publication Addison Wesley, ISBN0-201-89684-2" contains the optimal addition chain for the number of integer additions from 1 to 100. The tree diagram is published. By using such an addition chain, the calculation of T _n (R) can be optimized.

  Using this method, a one-way function using a trace map can be calculated as follows.

  FIG. 11 shows a configuration of a one-way function calculation apparatus according to the fifth embodiment of the present invention. The one-way function calculation apparatus 500 shown in the figure includes an input unit 510 for inputting RεE [L], an initial value setting unit 520, a temporary storage unit 530, an addition chain calculation unit 540, and an output unit 550. .

  FIG. 12 is a flowchart of the one-way function calculation method according to the fifth embodiment of the present invention.

First, as a preparatory process, m addition chains n ₀ = 1, n _i = n _j + n _k , (j, k <i), and n _c = m to be used are determined (step 501). However, it is not always necessary to use an optimal addition chain. For example, a binary calculation method can be used.

  Further, temporary storage areas R0,..., RcεE [L], iε {0,..., C} are secured in the temporary storage unit 530 in advance (step 502).

The initial value setting unit 520 sets R ₀ <-R, i ← 0 in the temporary storage unit 530 (step 503).

  RεE [L] is input from the input unit 510 (step 504).

  The addition chain calculation unit 540 sets i ← i + 1 (step 505), determines j, k <i corresponding to i in accordance with the addition chain predetermined in step 501,

とし、計算結果Ｒ_ｉを一時記憶部５３０に格納する(ステップ５０６)。

And the calculation result R _i is stored in the temporary storage unit 530 (step 506).

Here, if i <c (step 507), step 505 repeats the subsequent processing, if i ≧ c, the output unit 550 outputs from the temporary storage unit 530 reads out the _{R c} 508).

(6-6) Sixth Embodiment / One-way Function Calculation Method:
The temporary storage areas R ₀ ,..., R _c required in the one-way function calculation method of the fifth embodiment described above are not necessarily required in accordance with the addition chain. As a result, the temporary storage area can be reduced. The number sequence of the addition chain itself can also be determined during operation. In this embodiment, for example, a case where a binary calculation method is used will be described.

  FIG. 13 shows a configuration of a one-way function calculation apparatus according to the sixth embodiment of the present invention. The one-way function calculation apparatus 600 shown in the figure includes an input unit 610 for inputting RεE [L], an initial value setting unit 620, a temporary storage unit 630, an addition chain calculation unit 640, and an output unit 650. .

  FIG. 14 shows a flowchart of a one-way function calculation method according to the sixth embodiment of the present invention.

First, as a preparatory process, the addition chain of m to be used is a binary calculation method, and binary expansion m _i ε {0, 1} of m is

とする（ステップ６０１）。但し、ｍ_ｃ＝１とする。

(Step 601). However, it is assumed that m _c = 1.

Further, temporary storage areas R ₀ ∈E [L], i∈ {0,..., C}, j∈ {1,..., M} are secured in the temporary storage unit 630 in advance (step 602).

In the initial value setting unit 620, the values in the temporary storage unit 620 are set as R ₀ ← R, j ← 1, and i ← c (step 603).

  RεE [L] is input from the input unit 610 (step 604).

The addition chain calculation unit 640 sets i ← i−1 (step 605), sets R ₀ ← φ ^j R ₀ + R ₀ , j ← j + 1 (step 606), and if m _i = 1 (step 607), adds The chain calculation unit 604 sets R ₀ ← φR ₀ + R, j ← j + 1 (step 608), and if i> 0 (step 609), proceeds to step 605, and if i ≦ 0 (step 609), The output unit 650 reads and outputs the final R ₀ from the temporary storage unit 630 (step 610).

  When m is expressed in binary, the value of j in the first half of the above step 606 is determined by using the value of i at that time point and viewing the c-1 bit from the beginning of m as an unsigned integer. In this case, it is not necessary to set the value of j in steps 603, 606, and 607, and j is not secured as a temporary storage area.

  The present invention constructs the operation in the first to sixth embodiments as a program, and stores the computer as a one-way function calculation device and a subgroup element determination device. It is also possible to install the program on a computer and execute it by a control means such as a CPU, or distribute it via a network.

  In addition, the constructed program is stored in a portable storage medium such as a one-way function calculator, a hard disk device connected to a computer used as a partial group element determination device, a flexible disk, or a CD-ROM. It is also possible to install on these computers when implementing.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

  The present invention can be applied to information security technology based on the computational complexity theory.

It is a figure for demonstrating the principle of this invention. It is a principle block diagram of this invention. It is a block diagram of the subgroup element origin determination apparatus in the 1st Embodiment of this invention. It is a flowchart of the subgroup element origin determination method in the 1st Embodiment of this invention. It is a block diagram of the one-way function calculation apparatus in the 2nd Embodiment of this invention. It is a flowchart of the one-way function calculation method in the 2nd Embodiment of this invention. It is a block diagram of the one way function calculation apparatus in the 3rd Embodiment of this invention. It is a flowchart of the one-way function calculation method in the 3rd Embodiment of this invention. It is a block diagram of the one-way function calculation apparatus in the 4th Embodiment of this invention. It is a flowchart of the one-way function calculation method in the 4th Embodiment of this invention. It is a block diagram of the one way function calculation apparatus in the 5th Embodiment of this invention. It is a flowchart of the one-way function calculation method in the 5th Embodiment of this invention. It is a block diagram of the one way function calculation apparatus in the 6th Embodiment of this invention. It is a flowchart of the one-way function calculation method in the 6th Embodiment of this invention.

Explanation of symbols

100 Subgroup Upper Element Determination Device 110 Input Unit 120 Pairing Calculation Unit 130 Temporary Storage Unit 140 Determination Unit 150 Output Unit 200 Unidirectional Function Calculation Device 210 Fixed Value Calculation Unit 220 Scalar Multiplier Setting Unit 230 Input Unit 240 Frobenius Map Calculation Unit 250 Temporary storage unit 260 Elliptical scalar multiplication unit 270 Ellipse subtraction unit 280 Output unit 300 Unidirectional function calculation device 310 Eigenvalue calculation unit 330 Input unit 340 Frobenius map calculation unit 350 Temporary storage unit 360 Elliptical scalar multiplication unit 370 Ellipse subtraction unit 380 Output unit 400 Unidirectional function calculation device 410 Input unit 420 Initial value setting unit 430 Temporary storage unit 440 Point calculation unit 450 Output unit 500 Unidirectional function calculation device 510 Input unit 520 Initial value setting unit 530 Temporary storage unit 540 Addition Chain calculation unit 550 Output unit 600 One direction Function computer 610 input unit 620 the initial value setting unit 630 the temporary storage unit 640 adds the chain calculating unit 650 output unit

Claims (9)

In the one-way function calculation method for calculating the one-way function,
R ₁ ,..., R ₄ ∈ E [L] (where E [L] is a prime number, and LR = L of the points R on the elliptic curve E defined on the finite field) An area for storing O (where R is a set of R satisfying O is an infinite point) is reserved,
In the eigenvalue calculation means, eigenvalues λ ₁ and λ ₂ ∈Z / LZ of the Frobenius map are obtained,
In the input means, R∈E [L] is input,
In the scalar multiplication setting means,

As
In the Frobenius map calculation means, a point φR on the elliptic curve is calculated from the Frobenius map φ, and the calculation result R ₁ is stored in the temporary storage means.
In the elliptic scalar multiplication calculating means, the scalar multiplication λ ₂ R of the point R is calculated, and the calculation result R ₂ is stored in the temporary storage means,
In elliptical subtracting means, said acquired the calculated from temporary storage unit results R ₁ and the calculation result R ₂ calculates the R ₁ -R _2, the calculation result R ₃ may be stored in the temporary storage means,
In the elliptic scalar multiplication calculation means, a scalar multiplication of R ₃

And the calculation result R ₄ is stored in the temporary storage means,
Finally, the output unit, one-way function calculation method and outputting from said temporary memory means reads out the R _4. In the one-way function calculation method for calculating the one-way function,
R ₁ ,..., R ₃ ∈ E [L] (where E [L] is a prime number, and LR = O (of the points R on the elliptic curve E defined on the finite field). However, an area for ensuring a set of R satisfying O) is satisfied,
In the eigenvalue calculation means, the eigenvalue λ ₂ ∈Z / LZ of the Frobenius map is obtained,
In the input means, R∈E [L] is input,
In the Frobenius map calculation means, a point φR on the elliptic curve is calculated from the Frobenius map φ, and the calculation result R ₁ is stored in the temporary storage means.
In the elliptic scalar multiplication means, the eigenvalue λ ₂ obtained by the eigenvalue calculation means is obtained, the scalar multiplication λ ₂ R of the point R is calculated, and the calculation result R ₂ is stored in the temporary storage means,
In elliptical subtracting means, the calculation result to obtain the R ₂ the calculation result R ₁ from the temporary storage means, performs R ₁ -R _2, and stores the calculation result R ₃ in the temporary storage means,
Finally, the output unit, one-way function calculation method and outputting from said temporary memory means reads the R _3. When a rational point group of a non-super singular elliptic curve defined on a finite field includes a Cartesian product group of two cyclic groups having the same order, a one-way function defined on the elliptic curve is calculated. In the direction function calculation method,
In the temporary storage means, an area R ₁ for storing points on the elliptic curve, an area i capable of storing an integer of 0 to m,
In the initial value setting means,
Set an infinite point O on the elliptic curve to R ₁ , set 0 to the region i,
In the input means,
Elliptic curve E [L] (E [L] (where E [L] is a prime number, and LR = O among the points R on the elliptic curve E defined on the finite field, where O is infinity) A set of R satisfying the point)))
By Frobenius map calculation means,
The Frobenius map φ ⁱ R is calculated, the calculation result and the point R ₁ are input to the ellipse addition calculation means, the calculation result is stored in the region R ₁ , the count of the region i is i + 1, and i ≧ The process is repeated until m (m is an integer of 1 or more),
Finally,

One-way function calculating method of the value of a point on an elliptic curve to match is read from the region R _1, and outputs the output means and. In the ellipse addition calculation means,
The m addition chain n ₀ = 1, n _i = n _j + n _k , (j, k <i), n _c = m (where c is the length of the m addition chain) ,
Let the count of region i be i + 1,
Determine j, k <i for the region i according to the addition chain,

One-way function calculating method according to claim 3, wherein using the one-way function calculation using the adder chain according to the be). A one-way function computing device for calculating a one-way function,
R ₁ ,..., R ₄ ∈ E [L] (where E [L] is a prime number, and LR = O (of the points R on the elliptic curve E defined on the finite field) O is a temporary storage means in which an area for storing a set of R satisfying the infinity point) is secured;
Eigenvalue calculating means for obtaining eigenvalues λ ₁ and λ ₂ ∈Z / LZ of the Frobenius map;
Scalar times

As a scalar multiplication setting means obtained in advance,
Input means for inputting RεE [L];
Frobenius map calculation means for calculating a point φR on the elliptic curve from the Frobenius map φ and storing the calculation result R ₁ in the temporary storage means;
An elliptic scalar multiplication calculating means for obtaining the eigenvalue from the eigenvalue calculating means, calculating a scalar multiplication λ ₂ R of the point R, and storing the calculation result R ₂ in the temporary storage means;
And elliptic subtracting means for the acquired said calculated from temporary storage unit results R ₁ and the calculation result R _2, calculates the R ₁ -R _2, and stores the calculation result R ₃ in the temporary storage means,
The λ _Δ is obtained from the scalar multiplication setting means, and the scalar multiplication of R ₃

The calculated, the second ellipse scalar multiplication means for storing the calculation result R ₄ in the temporary storage means,
And an output means for reading and outputting R ₄ from the temporary storage means. A one-way function calculation device for calculating a one-way function,
R ₁ ,..., R ₃ ∈ E [L] (where E [L] is a prime number, and LR = O (of the points R on the elliptic curve E defined on the finite field). However, O is a temporary storage means in which an area for storing a set of R satisfying the infinity point) is secured;
In advance, eigenvalue calculation means for obtaining the eigenvalue λ ₂ ∈Z / LZ of the Frobenius map;
Input means for inputting RεE [L];
Frobenius map calculation means for calculating a point φR on the elliptic curve from the Frobenius map φ and storing the calculation result R ₁ in the temporary storage means;
Obtaining the eigenvalue λ ₂ obtained by the eigenvalue calculating means, calculating a scalar multiplication λ ₂ R of the point R, and storing the calculation result R ₂ in the temporary storage means;
Ellipse subtracting means for obtaining the calculation result R ₁ and the calculation result R ₂ from the temporary storage means, performing R ₁ -R ₂ , and storing the calculation result R ₃ in the temporary storage means;
Finally, one-way function calculation apparatus characterized by comprising output means for outputting the previous SL temporary memory means reads the R _3, a. When a rational point group of a non-super singular elliptic curve defined on a finite field includes a Cartesian product group of two cyclic groups having the same order, a one-way function defined on the elliptic curve is calculated. A directional function calculation device,
An area R ₁ for storing points on the elliptic curve, a temporary storage means for securing an area i in which an integer of 0 to m can be stored;
Elliptic curve E [L] (E [L] (where E [L] is a prime number, and LR = O among the points R on the elliptic curve E defined on the finite field, where O is infinity) An initial value setting means for setting an infinity point O on the elliptic curve to the point R ₁ on the set of R satisfying the point)) and setting the area i to 0;
Input means for acquiring a point R on an elliptic curve;
The Frobenius map φ ⁱ R is calculated, the calculation result and the point R ₁ are input to the ellipse addition calculation means, the output result is stored in the region R ₁ , the count of the region i is i + 1, and i ≧ Frobenius map calculation means for repeating the process until m (m is an integer of 1 or more),
Finally,

And output means a value of a point on an elliptic curve to match is read from the region R _1, and outputs a,
A one-way function computing device comprising: The ellipse addition calculation means includes:
The m addition chain n ₀ = 1, n _i = n _j + n _k , (j, k <i), n _c = m (where c is the length of the m addition chain) ,
Let the count of region i be i + 1,
Determine j, k <i for the region i according to the addition chain,

One-way function calculating device according to claim 7, wherein using the one-way function calculation using the adder chain according to the be). Computer
A one-way function calculation program for causing each unit of the one-way function calculation device according to claim 5 to function .

Images