JP4956817B2 - Pairing calculation device and pairing calculation program - Google Patents

Description

  The present invention relates to a pairing calculation apparatus and a pairing calculation program capable of calculating Tate pairing at high speed.

  As one of indispensable technologies for information and communication technologies, public key cryptography technology that discloses a key for encryption is known. However, public key cryptography techniques have problems such as complicated key management and undeveloped broadcast ciphers that can only be decrypted by a specific group.

  In recent years, an encryption technique using Tate pairing has attracted attention as a technique for solving these problems. In an encryption system using Tate pairing, it is possible to construct an ID-based cipher or broadcast cipher with an ID as a public key, and it is also possible to construct a signature system such as a short signature whose signature length is half that of the conventional one.

  There are two types of calculation for Tate pairing: when used for encryption and signature generation in public key cryptography, and when used for signature verification. When used for encryption or signature generation, the value of Tate pairing e is used as it is. On the other hand, when used for signature verification or the like, it is checked that the two eate pairing values e and e ′ are equal.

Next, Tate pairing on an elliptic curve will be described.
First, consider the elliptic curve represented by equation (1).

（１）式の楕円曲線Ｅ^ｂ上の２点Ｐ，Ｑの和（Ｐ＋Ｑ）を次のように定義する。２点P，Qを通る直線Ｌ（Ｐ＝Ｑの時は、直線ＬはＰを通る楕円曲線Ｅ^ｂの接線とする。）と楕円曲線E^ｂとの交点Ｍを求め、その交点ＭとX軸に関して対称な位置に存在する点Ｎを求める。この交点Ｎを２点Ｐ，Ｑの和（Ｐ＋Ｑ）と定義する。図９は、ｂ＝１の場合の楕円曲線を示す図である。

The sum (P + Q) of two points P and Q on the elliptic curve ^{Eb in the} equation (1) is defined as follows. An intersection M between the straight line L passing through the two points P and Q (when P = Q, the straight line L is a tangent to the elliptic curve E ^b passing through P) and the elliptic curve E ^b is obtained. A point N existing at a symmetrical position with respect to the axis is obtained. This intersection N is defined as the sum of two points P and Q (P + Q). FIG. 9 is a diagram showing an elliptic curve when b = 1.

  The Tate pairing is defined as a function e (P, Q) that returns a certain value with respect to two points P and Q on the elliptic curve of the expression (1) as in the expression (2). Tate pairing has the property of satisfying bilinearity as shown in equation (3), and this bilinearity is applied to encryption technology.

（２）式に示すＴａｔｅペアリングを計算する際には、楕円曲線上の計算及び標数３の体での演算（標数３の体でのアルゴリズム）が必要となる。

When calculating the Tate pairing shown in the formula (2), calculation on an elliptic curve and calculation with a characteristic 3 field (algorithm with a characteristic 3 field) are required.

Conventionally, algorithm 1 (Modified Duursma-Lee algorithm) shown in FIG. 10 is known as an algorithm for calculating <P, ψ (Q)> _N. In Algorithm 1, the loop process is repeated n times from Step 12 to Step 16. Σ satisfies σ ² = 1, ρ satisfies ρ ³ = ρ + b, and the extension field Fq (q = 3 ⁶ⁿ ) is a field based on {1, σ, ρ, σρ, ρ ² , σρ ² }. This is a sixth-order vector space of Fq (q = 3 ⁿ ).

  An algorithm 2 shown in FIG. 11 is an algorithm improved for the purpose of reducing the number of times of the loop processing, and obtains ηT pairing. In Algorithm 2, the number of loop processes from Step 22 to Step 26 is reduced to (n + 1) / 2, but calculation of the cube root that takes time is generated. Note that ηT pairing and Tate pairing have a relationship as shown in equation (4).

ここで、Ｔ、Ｚ、Ｗの定義は（５）式で表される。

Here, the definitions of T, Z, and W are expressed by equation (5).

よって、（６）式を用いることでηＴペアリングからＴａｔｅペアリングを求めることが出来る。なお、ηＴ（Ｐ，Ｑ）^Ｗは双線形性を満たす。

Therefore, Tate pairing can be obtained from ηT pairing by using equation (6). Note that ηT (P, Q) ^W satisfies bilinearity.

図１２は、各手法における署名と署名検証にかかる時間（単位はｍｓ）を比較した表であり、非特許文献１に記載されたものである。図１２において、ＥＣ（Elliptic Curve）は楕円曲線であり、ＢＬＳはshort signature、すなわちＴａｔｅペアリングの計算を用いた暗号である。
P. S. L. Barreto, “Efficient Algorithms for Pairing-Based Cryptosystems,” Advances in Cryptology-CRYPTO 2002, LNCS3027, Springer-Verlag, pp.354-368, 2002. P. S. L. M. Barreto, S. Galbraith, C.O. hEigeartaigh and M. Scott, "Efficient Pairing computation on supersingular Abelian Varieties,"Cryptology ePrint Archive, Report 2004/375, 2004. ［２００６年７月１１日検索］,インターネット＜ＵＲＬ：http://eprint.iacr.org/2004/375＞.

FIG. 12 is a table comparing signatures and time required for signature verification (unit: ms) in each method, which is described in Non-Patent Document 1. In FIG. 12, EC (Elliptic Curve) is an elliptic curve, and BLS is a short signature, ie, encryption using calculation of Tate pairing.
PSL Barreto, “Efficient Algorithms for Pairing-Based Cryptosystems,” Advances in Cryptology-CRYPTO 2002, LNCS3027, Springer-Verlag, pp.354-368, 2002. PSLM Barreto, S. Galbraith, CO hEigeartaigh and M. Scott, "Efficient Pairing computation on supersingular Abelian Varieties," Cryptology ePrint Archive, Report 2004/375, 2004. [Search July 11, 2006], Internet <URL: http : //eprint.iacr.org/2004/375>.

  As apparent from FIG. 12, in the method using the conventional algorithm, it takes time to calculate the Tate pairing particularly in signature verification, and the RSA (Rivest Shamir Adleman) method, the DSA (Digital Signature Algorithm) method, the elliptic curve Processing is slow compared to encryption methods using characteristics. For this reason, speeding up the calculation of Tate pairing has become a major research theme worldwide.

  The present invention has been made in consideration of the above circumstances, and its purpose is to propose an algorithm that can perform Tate pairing calculation with a small amount of calculation and can be performed at high speed, and performs pairing using the algorithm. To provide a computing device.

The present invention has been made to solve the above problems, one aspect of the present invention, the elliptic curve ^{E b: y 2 = x 3} -x + b, with respect to the point P on B∈ {-1,1} wherein a respective coordinate data of the point Q on the elliptic curve obtained by calculation on ^{E b} the elliptic curve ^E points on ^{b 3 (n-1) /} 2 P and the elliptic curve ^{E b} Te _(x p, y _p), (x _q, enter the _y q), if the constant b is 1, the coordinate value _{y p} and input means Ru replaced -y _p, Characteristic 3 body Fq (here, q = 3 ⁿ ) , the first computing means for substituting the value of the constant b into d, the bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and {1, σ, ρ, σρ, ρ ² , σρ ^2} Characteristic 3 extension field Fq (here, q ^{= 3 6n)} of the base of the _{the -y p (x p + x q} + b) + y q σ + y p ρ The value obtained by calculation and the second calculation means substitutes the R _0, wherein the target number 3 of the body Fq, substitutes the value obtained by calculating the _x p ₊ x q _{+ d} to r _0, the Characteristic 3 in the extension field _{^{Fq, -r 0 2 + y p}} y q σ-r 0 ρ-ρ 2 to a value obtained by calculation by substituting the _{R 1,} R 0 and _{R 1} calculates the value obtained by the R substituted into _0, in the target number 3 of the body Fq, the -y _p is substituted into the coordinate value _{y p,} the value obtained by calculating the _x ^{q 9} by substituting the coordinate value _{x q,} calculates the _y ^{q 9} The value obtained by substituting for the coordinate value y _q , substituting the value obtained by calculating (d−b) mod 3 for d, and calculating R ₀ ³ for the extension field Fq of characteristic 3 The process of substituting the obtained value into R ₀ is repeated (n + 1) / 2 times, and the finally obtained value of R ₀ is expressed as point 3 ^{(n−1) / 2} P and point Q. to coordinate data ΗT pairing ηT to brute ^{(3 (n-1) /} 2 P, Q) of ^{3 (n + 1) / 2} the square of the third arithmetic means for outputting a value, the third the ηT pairing ηT the arithmetic unit has outputted Based on the value of 3 ^{(n + 1) / 2} squared of (3 ^{(n-1) / 2} P, Q), e () obtained by calculating Expressions (5), (7), and (6) P, and Q), a pairing calculation apparatus characterized by comprising a fourth arithmetic means you output as the value of the Tate pairing, the.

Another embodiment of the present invention, the elliptic curve ^{E b: y 2 = x 3} -x + b, a 2-point P, the coordinate data of Q on _{b∈ {-1,1} (x p,} y p) _{, (x} q, _y q) enter a, if the constant b is 1, an input unit that Ru replace coordinate values _{y p} to -y _p, Characteristic 3 body Fq (here, q = ^{3 n} ) , The first calculation means for substituting the value of the constant b into d, and the bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and {1, σ, ρ, σρ, ρ ² , σρ ² } In an extension field Fq of characteristic 3 with the basis of (where q = 3 ⁶ⁿ ), a value obtained by calculating −y _p (x _p + x _q + b) + y _q σ + y _p ρ is substituted into R ₀ And the value obtained by calculating x _p + x _q + d in the field Fq of characteristic 3 is substituted into r ₀ , and −r ₀ ² + y _p y _q σ−r ₀ ρ−ρ ² The value obtained by calculating is substituted for R _1, and the value obtained by calculating R ₀ R ₁ is substituted for R ₀ in the extension field Fq of characteristic 3 and the field Fq of characteristic 3 The value obtained by calculating x _p ³ is substituted into the coordinate value x _p , the value obtained by calculating y _p ³ is substituted into the coordinate value y _p, and the value obtained by calculating x _q ²⁷ Is substituted for the coordinate value x _q , the value obtained by calculating y _q ²⁷ is substituted for the coordinate value y _q , the value obtained by calculating (d + b) mod 3 is substituted for the d, and the characteristic in 3 of the extension field Fq, R _{0 9} except the last ^round, the process of substituting a value obtained by calculating the R ₀ ³ in the R ₀ in the last round (n + 1) / repeatedly executed twice, finally the value of _{R 0} obtained in the two points P, a third arithmetic means for outputting as ^{3 n-th} power value of ηT pairing ηT based on the coordinate data of the Q (P, Q), prior to Based on the value of the serial third arithmetic means said ItaT pairing has output ηT (P, Q) obtained by computing the ^{3 n} root from ^{3 n-th} power value of ηT (P, Q), ( 5) formula and (6) e obtained by calculating the equation (P, Q) of a pairing calculation apparatus characterized by comprising a fourth arithmetic means you output as the value of the Tate pairing, the.

In one embodiment of the present invention, a computer is obtained by calculation on the elliptic curve E ^{b with} respect to the point P on the elliptic curve E ^b : y ² = x ³ −x + b, b∈ {−1, 1}. is the is the coordinate data of the point Q on the elliptic curve ^{E b} on the point ^{3 (n-1) / 2} P and the elliptic curve _{^{E b (x p, y p}} ), the (x _{q, y} q) type, if the constant b is 1, an input unit that Ru replacing the coordinate value _{y p} to -y _p, (where, q ^{= 3} n) Characteristic 3 of the body Fq in the value of the constant b A first computing means for substituting d into d, and a characteristic 3 whose bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and whose base is {1, σ, ρ, σρ, ρ ² , σρ ² } extension field Fq (here, q ^{= 3 6n)} of _the, to assign -y _p a _{(x p + x q + b} ) + y q σ + y p ρ and the obtained calculated value to _{R 0} A second calculating means, in the target number 3 of the body _Fq, substitutes the value obtained by calculating the _x p ₊ x q ₊ d to _{r 0,} the extension field Fq of the Characteristic _3, ^-r 0 2 + _{y p} The value obtained by calculating y _q σ−r ₀ ρ−ρ ² is substituted for R ₁ , the value obtained by calculating R ₀ R ₁ is substituted for R ₀ , and the field Fq of the characteristic 3 -Y _p is substituted for the coordinate value y _p , the value obtained by calculating x _q ⁹ is substituted for the coordinate value x _q, and the value obtained by calculating y _q ⁹ is substituted for the coordinate value y _q Then, (d−b) the value obtained by calculating mod 3 is substituted for d, and in the extension field Fq of characteristic 3, the value obtained by calculating R ₀ ³ is substituted for R ₀ . processing (n + 1) / 2 times repeatedly executed, and the finally obtained value of _{R 0,} the point ^{3 (n-1) / 2} ηT pairing ηT (3 based on the coordinate data of the P and point Q ^{n-1) / 2 P,} Q) of ^{3 (n + 1) / 2} the square of the third arithmetic means for outputting a value, the third the ηT pairing ηT arithmetic unit has outputted ^{(3 (n-1) / 2} P, based on the value of ^{3 (n + 1) / 2} square of Q), the equation (5), (7), and (6) were obtained by calculating the equation e (P, Q), Tate pairs a pairing computation program for functioning as a fourth arithmetic means you output as the value of the ring.

Another embodiment of the present invention, a computer, an elliptic curve ^{E b: y 2 = x 3} -x + b, 2 points P on B∈ {-1,1}, which is the coordinate data of Q _(x p, y _p), (x _q, enter the _y q), if the constant b is 1, an input unit that Ru replace coordinate values _{y p} to -y _p, Characteristic 3 body Fq (here, q = 3 ⁿ ) , the first computing means for substituting the value of the constant b into d, the bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and {1, σ, ρ, σρ, ρ ² , Σρ ² } based on an extension field Fq of characteristic 3 (where q = 3 ⁶ⁿ ), the value obtained by calculating −y _p (x _p + x _q + b) + y _q σ + y _p ρ is R _In the second arithmetic means for substituting for ₀ and the field Fq of characteristic 3 , substituting the value obtained by calculating x _p + x _q + d for r ₀ , −r ₀ ² + y _p y _q σ-r ₀ ρ-ρ ² of the calculated and obtained values are substituted into R _1, the in the extension field Fq of Characteristic 3, substitutes the value obtained by calculating the R ₀ R ₁ to the R ₀ In the field Fq of characteristic 3, the value obtained by calculating x _p ³ is substituted into the coordinate value x _p , the value obtained by calculating y _p ³ is substituted into the coordinate value y _p , and x _q ^The value obtained by calculating ²⁷ is substituted for the coordinate value x _q , the value obtained by calculating y _q ²⁷ is substituted for the coordinate value y _q , and the value obtained by calculating (d + b) mod 3 is substituted into d, the extension field Fq of the Characteristic 3, _R ^{0 9} except the last round, the value obtained by calculating the _R ^{0 3} in the final times a process of substituting the _{R 0 (n + 1) /} 2 Repeat run times, the finally obtained value of R _0, the outputs Examples 3 ^n-th power values of the two points P, ItaT pairing ItaT based on the coordinate data of the Q (P, Q) 3 and calculating means, based on the value of the third arithmetic means said ItaT pairing has output ηT (P, Q) obtained by computing the ^{3 n} root from ^{3 n-th} power value of ηT (P, Q) Te, (5) and (6) were obtained by calculating the equation e (P, Q), in the pairing computation program for functioning as a fourth arithmetic means, you output as the value of the Tate pairing is there.

According to the present invention, it is not necessary to calculate the cube root, which is a factor that increases the calculation cost in the conventional algorithm for calculating ηT pairing (algorithm 2 in FIG. 11). It can be performed. When the ηT pairing is obtained, the Tate pairing can be obtained by using the equation (6), and hence the Tate pairing can be calculated at high speed.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
First, an algorithm obtained by speeding up the conventional algorithm 2 shown in FIG. 11 will be described with reference to FIG.

The algorithm 3 in FIG. 1 is an algorithm for obtaining 3 ^{(n + 1) / 2} squares of ηT (P, Q). Unlike the algorithm 2, each value (x _q ) of the algorithm 1 at the end of the loop (step 35-d). , Y _q , x _p , y _p ) become 3 ^{i + 1} powers. For the purpose of obtaining the 3 ^{i + 1} power, the base is adjusted in step 31-b, step 33, step 35-a, and step 35-c.

The processing of algorithm 3 will be described in detail. Two points on the elliptic curve ^{_{E b P (x p, y}} p) and _{Q (x} q, _y q) If you enter, in the case of b = 1 substitutes the value of -y _p to _{y p} (Step 31 -A). Subsequently, the value of b is substituted for d on the field Fq (q = 3 ⁿ ) (step 31-b).

Subsequently, −y _p (x _p + x _q + b) + y _q σ + y _p ρ is calculated on the extension field Fq (q = ^{36 n} ), and the result is substituted into R ₀ (step 31-c). Thereafter, the loop calculation of steps 32 to 36 is performed (n + 1) / 2 times. In the loop calculation, first, the calculation of x _p + x _q + d is performed on the field Fq (q = 3 ⁿ ), and the result is substituted into γ ₀ (step 33).

Then, it calculates the ^{_{-γ 0 2 + y p y q}} σ-γ 0 ρ-ρ 2 on an extension field Fq (q ^{= 3 6n),} is substituted into _{R 1} (Step 34-a). Thereafter, R ₀ R ₁ is calculated on the extension field Fq (q = ^{36 n} ), and the result is substituted into R ₀ (step 34-b).

Subsequently, it substitutes the value of -y _p to _{y p} on an extension field Fq (q = ^{3 n)} (Step 35-a). Thereafter, x _q ⁹ is calculated on the extension field Fq (q = 3 ⁿ ), and the result is substituted into x _q . Further, y _q ⁹ is calculated and the result is substituted into y _q (step 35-b). Thereafter, mod3 is calculated for (db), and the result is substituted for d (step 35-c). Thereafter, R ₀ ³ is calculated on the extension field Fq (q = 3 ⁶ⁿ ), and the result is substituted into R ₀ (step 35-d).

When the loop operation is completed, the value of R ₀ is output as 3 ^{(n + 1) / 2 to the} power of ηT (P, Q). The time cost of the computation in the field 3 of characteristic number Fq (q = 3 ⁿ ) is characterized by the fact that the time cost of 3 multiplication is smaller than the time cost of multiplication and the cube root because of the mathematical nature. FIG. 2 is a diagram showing the time cost of each calculation using the time cost of multiplication as a reference (M).

  When the calculation amount of the algorithm 3 is estimated based on the time cost shown in FIG. 2, (10.25n + 11.25) M is obtained. On the other hand, the calculation amount of the conventional algorithm 2 is (12.05n + 13.05) M. In general, n = 97 is often used. However, when n = 97, the algorithm 3 is approximately 15% lighter than the algorithm 2.

Since the output of algorithm 3 is 3 ^{(n + 1) / 2 to the} power of ηT (P, Q), an operation for obtaining Tate pairing e (P, Q) is required. This operation is performed according to the following procedure. Easily required. ηT (P, Q) From the bilinearity of ^W , equation (7) is established.

すなわち、楕円曲線上の演算において予め３^{（ｎ−１）／２}Ｐを求めた上でアルゴリズム３を実行し、Ｗ乗の計算を行うことで（７）式の左辺が求められる。続いて３^ｎ乗根（計算コストは小さい）を行うことでηＴ（Ｐ，Ｑ）^Ｗが求まり、（６）式に代入することでＴａｔｅペアリングｅ（Ｐ，Ｑ）が求まる。

That is, after calculating 3 ^{(n-1) /} 2P in advance on the calculation of the elliptic curve, the algorithm 3 is executed and the power of W is calculated to obtain the left side of the equation (7). Then ^{3 n} root (computational cost is small) ItaT by performing (P, ^{Q) W} is Motomari, Tate pairing e (P, Q) is obtained by substituting the equation (6).

Note that ηT (P, Q) ^W also satisfies bilinearity as described above, and can be applied to encryption technology. When ηT (P, Q) ^W is used for the cryptographic technique, it is not necessary to perform the calculation of equation (6).

  Next, a pairing calculation apparatus that performs processing of algorithm 3 will be described. FIG. 3 is a block diagram showing the configuration of the pairing calculation apparatus. In FIG. 3, the finite field calculator 301 of the pairing calculation device 30 is hardware that executes an operation performed by the algorithm 3, and may be a general-purpose CPU (Central Processing Unit) that performs an operation by binary logic. Alternatively, dedicated hardware specialized for arithmetic processing with a field of characteristic 3 may be used.

  The console interface 302 is an interface used when controlling the pairing calculation device 30 from an external device (not shown). The communication interface 303 is an interface that inputs data from an input port and outputs an operation result to an output port.

  The memory 304 is a memory that stores data. The memory 304 stores an operator control program 305 that is a program for executing the algorithm 3, and an operation data storage unit 306 that is an area for storing operation results in the finite field 301 is secured.

When P and Q data is input from the input port, the communication interface 303 outputs the P and Q data to the finite field calculator 301. The finite field calculator 301 executes the processing of the algorithm 3 in accordance with the calculator control program 306 and outputs the result (ηT (P, Q) 3 ^{(n + 1) / 2} ) to the communication interface 303. The communication interface 303 outputs the calculation result of 3 ^{(n + 1) / 2} square of ηT (P, Q) from the output port.

  Next, another algorithm that speeds up the conventional algorithm 2 shown in FIG. 11 will be described with reference to FIG.

Algorithm 4 in FIG. 4 is an algorithm for obtaining the multiplication ^{3 n} of ηT (P, Q), unlike the algorithms 2, the value of the algorithm 1 at the end of the loop (Step _{45-d) (x q,} y q, x _p , y _p ) becomes 3 ^{2i + 2} . For the purpose of obtaining 3 ^{2i + 2} , the base is adjusted in step 41-b, step 43, and step 45-c.

The processing of algorithm 4 will be described in detail. Two points on the elliptic curve ^{_{E b P (x p, y}} p) and _{Q (x} q, _y q) If you enter, in the case of b = 1 substitutes the value of -y _p to _{y p} (Step 41 -A). Subsequently, the value of b is substituted for d on the field Fq (q = 3 ⁿ ) (step 41-b).

Subsequently, −y _p (x _p + x _q + b) + y _q σ + y _p ρ is calculated on the extension field Fq (q = ^{36 n} ), and the result is substituted into R ₀ (step 41-c). Thereafter, the loop calculation of steps 42 to 46 is performed (n + 1) / 2 times. In the loop operation, first, an operation of x _p + x _q + d is performed on the field Fq (q = 3 ⁿ ), and the result is substituted into γ ₀ (step 43).

Then, it calculates the ^{_{-γ 0 2 + y p y q}} σ-γ 0 ρ-ρ 2 on an extension field Fq (q ^{= 3 6n),} is substituted into _{R 1} (Step 44-a). Thereafter, R ₀ R ₁ is calculated on the extension field Fq (q = ^{36 n} ), and the result is substituted into R ₀ (step 44-b).

Subsequently, the calculation of x _p ³ is performed on the extension field Fq (q = 3 ⁿ ), and the result is substituted into x _p . _Furthermore, it performs calculation of _y ^{p 3,} which assigns the result to _{y p} (Step 45-a). Thereafter, x _q ²⁷ is calculated on the extension field Fq (q = 3 ⁿ ), and the result is substituted into x _q . Further, y _q ²⁷ is calculated, and the result is substituted into y _q (step 45-b). Thereafter, mod3 is calculated for (d + b), and the result is substituted for d (step 45-c).

Subsequently, when i <(n−1) / 2, R ₀ ⁹ is calculated on the extension field Fq (q = 3 ⁶ⁿ ), and the result is substituted into R ₀ . On the other hand, if i = (n−1) / 2, R ₀ ³ is calculated and the result is substituted into R ₀ (step 45-d). When the loop calculation is completed, it outputs the value of _{R 0} as th power ^{3 n} of ηT (P, Q).

  When the calculation amount of the algorithm 4 is estimated based on the time cost shown in FIG. 2, it is (10.5n + 11.2) M. On the other hand, the calculation amount of the conventional algorithm 2 is (12.05n + 13.05) M. In general, n = 97 is often used. However, when n = 97, the algorithm 4 is approximately 13% lighter than the algorithm 2.

Since the output of the algorithm 3 which is a power of 3 ⁿ of ηT (P, Q), Tate pairing e (P, Q) is a necessary operation for obtaining a easily obtained by this operation the following steps . ItaT determined by the algorithm ^{3 (P, Q) 3 n} 3 n root against th power of (computational cost is small) performs the operation of further W ItaT by performing a multiplication computation (P, ^{Q) W} is Desired. By substituting this into equation (6), Tate pairing e (P, Q) is obtained.

Note that ηT (P, Q) ^W also satisfies bilinearity as described above, and can be applied to encryption technology. When ηT (P, Q) ^W is used for the cryptographic technique, it is not necessary to perform the calculation of equation (6). The pairing calculation device that performs the processing of the algorithm 4 can be realized by making the arithmetic unit control program 305 of the pairing calculation device 30 shown in FIG.

  Next, an algorithm that speeds up DH (Diffie-Hellman) verification that verifies whether two Tate pairing values e (P, Q) and e (R, S) match will be described. The conventional DH verification takes time as described above with reference to FIG. 12 because the coincidence determination is performed after calculating e (P, Q) and e (R, S). Further, even if e (P, Q) and e (R, S) are speeded up by obtaining from ηT pairing obtained by the conventional algorithm 2, algorithm 2 needs to calculate the cube root, take time.

In DH verification, it is necessary to verify e (P, Q) = e (R, S), but e (R, S) = e (−R, S) ⁻¹ due to the bilinearity of Tate pairing. Therefore, Equation (8) is established. Therefore, in the DH verification, it is only necessary to verify whether e (P, Q) · e (−R, S) = 1.

ここで、Ｒの座標を（ｘ，ｙ）とおくと、−Ｒの座標は（ｘ，−ｙ）となり容易に求められる。

Here, if the coordinates of R are (x, y), the coordinates of -R are easily obtained as (x, -y).

  An algorithm for verifying whether or not e (P, Q) · e (−R, S) = 1 will be described with reference to FIG. FIG. 5 shows a DH verification algorithm based on the algorithm 1 of FIG.

R ₀ (0) to algorithm _{1 (P 0, Q 0)} R 0 when you _{enter, R} 0 (1) to the algorithm _{1 (P 1, Q 1)} R 0 when you enter, _{R 1} When (0) is R ₁ when (P ₀ , Q ₀ ) is input to algorithm 1 and R ₁ (1) is R 1 when (P ₁ , Q ₁ ) is input to algorithm ₁ , the algorithm Reference _numeral 5 denotes an algorithm for obtaining R ₀ (0) R ₀ (1).

The processing of algorithm 5 will be described in detail. When four points P ₀ (x _p0 , y _p0 ), Q ₀ (x _q0 , y _q0 ), P ₁ (x _p1 , y _p1 ) and Q ₁ (x _q1 , y _q1 ) on the elliptic curve E ^b are input First, 1 is assigned to R ₀ on the extension field Fq (q = 3 ⁶ⁿ ) (step 51-a).

Subsequently, x _q0 ³ is calculated on the field Fq (q = 3 ⁿ ), and the result is substituted into x _qo . _Similarly, the calculation result of _{y po} ³ to _{y p0,} the operation result of _{x q1} ³ in _{x q1,} if the values are the calculation results of the _{y q1} ³ to _{y q1} (step 51-b). Further, mod3 is calculated for bn, and the result is substituted for d (step 51-c).

Thereafter, the loop calculation of steps 52 to 56 is performed n times. In the loop calculation, first, x _p0 ⁹ is calculated on the field Fq (q = 3 ⁿ ), and the result is substituted into x _po . _Similarly, the calculation result of _{y p0} ⁹ to _{y p0,} the operation result of _{x p1} ⁹ in _{x p1,} the operation result of _{y p1} ⁹ substituting each _{y p1} (Step 53-a).

Subsequently, S (x _p0 , y _p0 , x _q0 , y _q0 , x _p1 , y _p1 , x _q1 , y _q1 , d
) And substitute the result into (λ ₀ , λ ₁ , λ ₂ , λ ₃ , λ ₄ , λ ₅ ) (step 53-b). Here, S is a sub-algorithm, and detailed processing thereof will be described later. (Λ ₀ , λ ₁ , λ ₂ , λ ₃ , λ ₄ , λ ₅ ) is substituted for R ₁ (step 53-c). R ₁ obtained here corresponds to R ₁ (0) R ₁ (1) described above.

Subsequently, R ₀ ³ is calculated on the extension field Fq (q = 3 ⁶ⁿ ), and the result is assigned to R ₀ (step 54-a). Further, R ₀ R ₁ is calculated and the result is substituted into R ₀ (step 54-b). Thereafter, -y _q0 is substituted into y _q0 and -y _q1 is substituted into y _q1 on the field Fq (q = 3 ⁿ ) (step 55-a). Thereafter, mod3 is calculated for (d−b), and the result is substituted for d (step 55−b).

When the loop calculation is completed, the value of R ₀ is output as <P ₀ , ψ (Q ₀ )> _N · <P ₁ , ψ (Q ₁ )> _N (N = 3 ³ⁿ +1). In Algorithm 5, N in the equation (2) is 3 ³ⁿ +1. At this time, since (3 ⁶ⁿ −1) / (3 ³ⁿ +1) = 3 ³ⁿ −1, the equation (9) is To establish.

ところが、数学的性質により、Ｆｑ（ｑ＝３^６ｎ）の０でない元ｘに対して、ｘの３^３ｎ−１乗が１であることとｘがＦｑ（ｑ＝３^３ｎ）の元であることとは同値である。したがって、Ｐ，Ｑ，−Ｒ，Ｓをアルゴリズム５に代入し、その結果がＦｑ（ｑ＝３^３ｎ）の元であるか否かを判定することでＤＨ判定を行うことが可能であり、べき乗の演算を行う必要はない。

However, due to mathematical properties, for a non-zero element x of Fq (q = 3 ⁶ⁿ ), x 3 ³ⁿ −1 is 1 and x is an element of Fq (q = 3 ³ⁿ ). Is equivalent. Therefore, it is possible to perform DH determination by substituting P, Q, -R, and S into algorithm 5 and determining whether or not the result is an element of Fq (q = 3 ³ⁿ ). There is no need to perform the operation.

Subsequently, the processing of the sub-algorithm S used in step 53-b will be described with reference to FIG. In the sub-algorithm, x _p0 , y _p0 , x _q0 , y _q0 , x _p1 , y _p1 , x _q1 , y _q1 , d are input, and x _p0 + x _q0 + d is calculated on the field Fq (q = 3 ⁿ ). And assign the result to γ ₀ . Similarly, x _p1 + x _q1 + d is calculated, and the result is substituted into γ ₁ (step S01).

Subsequently, the calculation result of y _p0 y _q0 is assigned to γ ₂ and the calculation result of y _p1 y _q1 is assigned to γ ₃ (step S02). Thereafter, γ ₀ γ ₁ is calculated, and the result is substituted into γ ₄ (step S03). Thereafter, γ ₂ γ ₃ is calculated, and the result is substituted into γ ₅ (step S04). The calculation result of γ ₂ + γ ₀ is assigned to γ ₆ and the calculation result of γ ₃ + γ ₁ is assigned to γ ₇ (step S05). Thereafter, γ ₀ + γ ₁ is calculated, and the result is substituted into γ ₈ (step S06).

Subsequently, γ ₆ γ ₇ -γ ₄ -γ ₅ is calculated on the field Fq (q = 3 ⁿ ), and the result is substituted into λ ₃ (step S07). Thereafter, γ ₂ + γ ₃ is calculated, and the result is substituted into λ ₅ (step S08). Thereafter, γ ₄ ² −γ ₅ + bγ ₈ is calculated and substituted for λ0 (step S09). Furthermore, [gamma] _{8 [} lambda] _{3- [} gamma] _{4 [} lambda] ₅ is calculated and the result is substituted into [lambda] 1 (step S10).

Subsequently, (γ ₄ +1) γ ₈ + b is calculated on the field Fq (q = 3 ⁿ ), and the result is substituted into λ ₂ (step S11). Thereafter, γ ₈ ² −γ ₄ +1 is calculated, and the result is substituted into λ ₄ (step S12). When the above processing is completed, (λ ₀ , λ ₁ , λ ₂ , λ ₃ , λ ₄ , λ ₅ ) is output.

  When the calculation amount of the algorithm 5 is estimated based on the time cost shown in FIG. 2, it is (28.3n + 0.5) M. On the other hand, the time cost when performing exponentiation calculation using the conventional algorithm 1 for each of e (P, Q) and e (R, S) and performing DH verification is (41n + 18.1) M + 2F. is there.

  Here, F is a power calculation cost, which is 1M to 1000M. In general, n = 97 is often used, but when n = 97, the algorithm 4 is approximately 30% lighter than the algorithm 1.

  Next, a pairing calculation apparatus that performs processing of algorithm 5 will be described. FIG. 7 is a configuration diagram showing the configuration of the pairing device. In FIG. 7, the same components as those in FIG. 3 are denoted by the same reference numerals, and detailed description thereof is omitted. The computing unit control program 705 of the pairing calculation device 31 is a program for executing the algorithm 5.

When P, Q, R, and S data is input from the input port, the communication interface 303 outputs the P, Q, R, and S data to the finite field calculator 301. The finite field computing unit 301 converts R into −R and executes the processing of the algorithm 5 according to the computing unit control program 705, and the result (<P ₀ , ψ (Q ₀ )> _N · <P ₁ , It is determined whether ψ (Q ₁ )> _N (N = 3 ³ⁿ +1)) is an element of Fq (q = 3 ³ⁿ ) (determination means).

If it is an element of Fq (q = 3 ³ⁿ ), the result of the DH determination is determined to match, and “Yes” data is output to the communication interface 303. On the other hand, if it is not the source of Fq (q = 3 ³ⁿ ), it is determined that the DH determination results do not match, and “No” data is output to the communication interface 303. The communication interface 303 outputs “Yes” or “No” data from the output port.

  Next, another algorithm that speeds up DH (Diffie-Hellman) verification for verifying whether two Tate pairing values e (P, Q) and e (R, S) match will be described. FIG. 8 shows a DH verification algorithm based on the algorithm 3 and performs ηT pairing DH verification. The algorithm is based on the fact that the equation (8) is established, and is similar to the algorithm 5.

The processing of algorithm 6 will be described in detail. When four points P ₀ (x _p0 , y _p0 ), Q ₀ (x _q0 , y _q0 ), P ₁ (x _p1 , y _p1 ) and Q ₁ (x _q1 , y _q1 ) on the elliptic curve E ^b are input First, when b = 1, the value of -y _p0 is substituted for y _p0 , and the value of -y _p1 is substituted for y _p1 (step 61-a). Subsequently, the value of b is substituted for d on the field Fq (q = 3 ⁿ ) (step 61-b).

Subsequently, y _p0 (x _p0 + x _q0 + b) + y _q0 σ + y _p0 ρ is calculated on the field Fq (q = ^{36 n} ), and the result is substituted into R ₀ . Further, y _p1 (x _p1 + x _q1 + b) + y _q1 σ + y _p1 ρ is calculated, and the result is substituted into R ₁ (step 61-c). Thereafter, R ₀ R ₁ is calculated, and the result is substituted into R ₀ (step 61-d).

Thereafter, the loop calculation of steps 62 to 66 is performed (n + 1) / 2 times. In the loop calculation, first, S (x _p0 , y _p0 , x _q0 , y _q0 , x _p1 , y _p1 , x _q1 , y _q1 , d) is calculated, and the result is (λ ₀ , λ ₁ , λ _2). , Λ ₃ , λ ₄ , λ ₅ ) (step 63-a). Thereafter, the values of (λ ₀ , λ ₁ , λ ₂ , −λ ₃ , λ ₄ , −λ ₅ ) are substituted into R ₁ (step 63-b).

Subsequently, R ₀ R ₁ is calculated on the extension field Fq (q = 3 ⁶ⁿ ), and the result is substituted into R ₀ (step 64). Thereafter, x _q0 ⁹ is calculated, and the result is substituted into x _q0 . _{Similarly, y q0} ⁹ operation result of the _{y q0,} the operation result of _{x q1} ⁹ in _{x q1,} if the values are the calculation results of the _{y q1} ⁹ to _{y q1} (step 65-a). Further, mod3 is calculated for (d−b), and the result is substituted for d (step 65−b).

Subsequently, R ₀ ³ is calculated on the field Fq (q = 3 ⁶ⁿ ), and the result is assigned to R ₀ (step 65-c). When the loop operation is completed, the value of R ₀ is output as 3 ^{(n + 1) / 2} square of (ηT (P ₀ , Q ₀ ) · ηT (P ₁ , Q ₁ )). The DH verification is determined after the power calculation of Expression (10) is performed on R ₀ output from the algorithm 6.

アルゴリズム６の処理を行うペアリング計算装置は、図７に示したペアリング計算装置３１の演算器制御プログラム７０５を、アルゴリズム６を実行するプログラムとすることで実現できる。有限体演算器３０１は、（１０）式によるべき乗計算後のＲ_０が１である場合にはＤＨ検証で一致したと判定し、出力ポートへの出力は「Ｙｅｓ」となる。一方、Ｒ_０が１でない場合にはＤＨ検証で一致しないと判定し、出力ポートへの出力は「Ｎｏ」となる。

The pairing calculation device that performs the processing of the algorithm 6 can be realized by making the arithmetic unit control program 705 of the pairing calculation device 31 shown in FIG. The finite field calculator 301 determines that the DH verification matches when R ₀ after the power calculation according to the equation (10) is 1, and the output to the output port is “Yes”. On the other hand, when R ₀ is not 1, it is determined that the DH verification does not match, and the output to the output port is “No”.

  If the calculation amount of the algorithm 6 is estimated based on the time cost shown in FIG. 2, it is (14.7n + 34.25) M + F. On the other hand, the time cost for performing power calculation after using algorithm 3 for each of ηT (P, Q) and ηT (R, S) and performing DH verification is (24.1n + 26.1) M + 2F. is there. In general, n = 97 is often used. However, when n = 97, the algorithm 6 is approximately 40% lighter than the algorithm 2.

  In the algorithms 3 and 4 of the present invention, instead of increasing the calculation of 3 multiplication with a small time cost in the operation in the characteristic 3 field, the calculation of the cube root is not performed, so that the Tate pairing (or ηT pairing) is performed. ) Can be calculated at high speed. Further, in the algorithms 5 and 6 of the present invention, not only the cube root operation is not performed, but also the DH verification is performed using the property of the equation (8), thereby reducing the amount of calculation and performing the DH verification at high speed. It can be carried out.

  As mentioned above, although embodiment of this invention was explained in full detail, the concrete structure is not restricted to this embodiment, The design change etc. of the range which does not deviate from the summary of this invention are included.

  The present invention calculates Tate pairing or ηT pairing at the stage of signature or signature verification in a signature system such as ID-based encryption or broadcast encryption using an ID as a public key, and a short signature whose signature length is half that of the prior art. It is suitable for use in an apparatus.

It is the 1st algorithm of this application which calculates | requires 3 ^{(n + 1) / 2} square of ⁽ eta) T (P, Q). It is the figure which showed the time cost of each calculation by making the time cost of multiplication into a reference | standard (M). It is a block diagram which shows the structure of the pairing calculation apparatus which performs the algorithm of FIG. ηT (P, Q) is a second algorithm of the present application for obtaining the multiplication ^{3 n} of. It is the 3rd algorithm of this application which performs DH verification based on the algorithm of FIG. It is a figure which shows the sub algorithm S of FIG. It is a block diagram which shows the structure of the pairing calculation apparatus which performs the algorithm of FIG. It is the 4th algorithm of this application which performs DH verification based on (eta) T pairing. is a diagram showing an elliptic curve ^{y 2 = x 3 -x + 1} . It is a figure which shows the conventional Modified Duursma-Lee algorithm. FIG. 11 is a diagram showing an algorithm obtained by improving the algorithm of FIG. 10 and obtaining ηT pairing. It is the table | surface which compared the time (unit is ms) concerning the signature in each method used for encryption, and signature verification.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 30 ... Pairing calculation apparatus, 301 ... Finite field calculator, 302 ... Console I / O, 303 ... Communication interface, 304 ... Memory, 305 ... Calculator control program, 306 ... Calculation data storage part.

Claims (4)

Elliptic curve E ^b : y ² = x ³ −x + b, point 3 on the elliptic curve E ^b obtained by calculation on the elliptic curve E ^{b with} respect to the point P on bε {−1,1} ^{(n -1)} is ^{/ 2} P and the coordinate data of a point Q on the elliptic curve _{^{E b (x p, y p}} ), type a (x _{q, y} q), if the constant b is 1, input means for Ru replaced -y _p the coordinates _{y p,}
First arithmetic means for substituting the value of the constant b for d in a field 3 of characteristic number Fq (where q = 3 ⁿ ) ;
Bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and an extension field Fq of characteristic 3 with {1, σ, ρ, σρ, ρ ² , σρ ² } as a basis, where q = 3 ⁶ⁿ ), second calculating means for substituting the value obtained by calculating -y _p (x _p + x _q + b) + y _q σ + y _p ρ into R ₀ ;
In the target number 3 of the body _{Fq, x} p ₊ x q ₊ calculated to give a value of d is substituted into _{r 0,} the extension field Fq of the Characteristic _{^{3, -r 0 2 + y p}} y q σ-r 0 the value obtained by calculating the [rho-[rho ² is substituted in _{R 1,} it substitutes the value obtained by calculating the R 0 _{R 1} to the _{R 0,} in the target number 3 of the body Fq, the -y _p Substituting for the coordinate value y _p , substituting the value obtained by calculating x _q ⁹ for the coordinate value x _q , substituting the value obtained by calculating y _q ⁹ for the coordinate value y _q , (d−b ) the mod 3 assigns the calculated and obtained value to the d, wherein the extension field Fq of Characteristic _3, the process of substituting a value obtained by calculating the _R ^{0 3} to the _{R 0} (n + 1) / The value of R ₀ finally obtained is repeated twice, and ηT pairing ηT ( 3 ^{(n−1) / 2} based on the coordinate data of point 3 ^{(n−1) / 2} P and point Q is obtained. P, Q) third computing means for outputting as a value of 3 ^{(n + 1) / 2} square;
Based on the value of 3 ^{(n + 1) / 2} squared of the ηT pairing ηT (3 ^{(n−1) / 2} P, Q) output by the third calculation means ,

The e (P, Q) obtained by calculation and a fourth arithmetic means you output as the value of the Tate pairing,
A pairing calculation apparatus comprising: Elliptic curve ^{E b: y 2 = x 3} -x + b, a 2-point P, the coordinate data of Q on _{b∈ {-1,1} (x p,} y p), the (x _{q, y} q) type, if the constant b is 1, an input means for Ru replace coordinate values _{y p} to -y _p,
First arithmetic means for substituting the value of the constant b for d in a field 3 of characteristic number Fq (where q = 3 ⁿ ) ;
Bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and an extension field Fq of characteristic 3 with {1, σ, ρ, σρ, ρ ² , σρ ² } as a basis, where q = 3 ⁶ⁿ ), second calculating means for substituting the value obtained by calculating -y _p (x _p + x _q + b) + y _q σ + y _p ρ into R ₀ ;
The value obtained by calculating x _p + x _q + d in the field Fq of characteristic 3 was substituted into r ₀ and obtained by calculating −r ₀ ² + y _p y _q σ−r ₀ ρ−ρ ² . assign values to _{R 1,} the extension field Fq of the Characteristic _3, it substitutes the value obtained by calculating the R 0 _{R 1} to the _{R 0,} in the target number 3 of the body _Fq, the _x ^{p 3} The value obtained by calculating is substituted for the coordinate value x _p , the value obtained by calculating y _p ³ is substituted for the coordinate value y _p, and the value obtained by calculating x _q ²⁷ is the coordinate value x _q . Substituting the value obtained by calculating y _q ²⁷ into the coordinate value y _q , substituting the value obtained by calculating (d + b) mod 3 into d, and in the extension field Fq of characteristic 3 , R _{0 9} except the last ^round, the process of substituting a value obtained by calculating the R ₀ ³ in the last round to the _{R 0 (n + 1) /} 2 times repeatedly executed, finally obtained R A value of _0, the two points P, a third arithmetic means for outputting as ^{3 n-th} power value of ηT pairing ηT based on the coordinate data of the Q (P, Q),
Based on the value of the third arithmetic means said ItaT pairing has output ηT (P, Q) obtained by computing the 3 ⁿ root from 3 ^n-th power value of ηT (P, Q),

The e (P, Q) obtained by calculation and a fourth arithmetic means you output as the value of the Tate pairing,
A pairing calculation apparatus comprising: The computer,
Elliptic curve E ^b : y ² = x ³ −x + b, point 3 on the elliptic curve E ^b obtained by calculation on the elliptic curve E ^{b with} respect to the point P on bε {−1,1} ^{(n -1)} is ^{/ 2} P and the coordinate data of a point Q on the elliptic curve _{^{E b (x p, y p}} ), type a (x _{q, y} q), if the constant b is 1, input means for Ru replaced -y _p the coordinates _{y p,}
First arithmetic means for substituting the value of the constant b for d in a field 3 of characteristic number Fq (where q = 3 ⁿ ) ;
Bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and an extension field Fq of characteristic 3 with {1, σ, ρ, σρ, ρ ² , σρ ² } as a basis, where q = 3 ⁶ⁿ ), second calculating means for substituting the value obtained by calculating -y _p (x _p + x _q + b) + y _q σ + y _p ρ into R ₀ ;
In the target number 3 of the body _{Fq, x} p ₊ x q ₊ calculated to give a value of d is substituted into _{r 0,} the extension field Fq of the Characteristic _{^{3, -r 0 2 + y p}} y q σ-r 0 the value obtained by calculating the [rho-[rho ² is substituted in _{R 1,} it substitutes the value obtained by calculating the R 0 _{R 1} to the _{R 0,} in the target number 3 of the body Fq, the -y _p Substituting for the coordinate value y _p , substituting the value obtained by calculating x _q ⁹ for the coordinate value x _q , substituting the value obtained by calculating y _q ⁹ for the coordinate value y _q , (d−b ) the mod 3 assigns the calculated and obtained value to the d, wherein the extension field Fq of Characteristic _3, the process of substituting a value obtained by calculating the _R ^{0 3} to the _{R 0} (n + 1) / The value of R ₀ finally obtained is repeated twice, and ηT pairing ηT ( 3 ^{(n−1) / 2} based on the coordinate data of point 3 ^{(n−1) / 2} P and point Q is obtained. P, Q) third computing means for outputting as a value of 3 ^{(n + 1) / 2} square;
Based on the value of 3 ^{(n + 1) / 2} squared of the ηT pairing ηT (3 ^{(n−1) / 2} P, Q) output by the third calculation means ,

The e (P, Q) obtained by calculation and a fourth arithmetic means you output as the value of the Tate pairing,
Pairing calculation program to function as. The computer,
Elliptic curve ^{E b: y 2 = x 3} -x + b, a 2-point P, the coordinate data of Q on _{b∈ {-1,1} (x p,} y p), the (x _{q, y} q) type, if the constant b is 1, an input means for Ru replace coordinate values _{y p} to -y _p,
First arithmetic means for substituting the value of the constant b for d in a field 3 of characteristic number Fq (where q = 3 ⁿ ) ;
Bases σ and ρ satisfy σ ² = 1, ρ ³ = ρ + b, and an extension field Fq of characteristic 3 with {1, σ, ρ, σρ, ρ ² , σρ ² } as a basis, where q = 3 ⁶ⁿ ), second calculating means for substituting the value obtained by calculating -y _p (x _p + x _q + b) + y _q σ + y _p ρ into R ₀ ;
The value obtained by calculating x _p + x _q + d in the field Fq of characteristic 3 was substituted into r ₀ and obtained by calculating −r ₀ ² + y _p y _q σ−r ₀ ρ−ρ ² . assign values to _{R 1,} the extension field Fq of the Characteristic _3, it substitutes the value obtained by calculating the R 0 _{R 1} to the _{R 0,} in the target number 3 of the body _Fq, the _x ^{p 3} The value obtained by calculating is substituted for the coordinate value x _p , the value obtained by calculating y _p ³ is substituted for the coordinate value y _p, and the value obtained by calculating x _q ²⁷ is the coordinate value x _q . Substituting the value obtained by calculating y _q ²⁷ into the coordinate value y _q , substituting the value obtained by calculating (d + b) mod 3 into d, and in the extension field Fq of characteristic 3 , R _{0 9} except the last ^round, the process of substituting a value obtained by calculating the R ₀ ³ in the last round to the _{R 0 (n + 1) /} 2 times repeatedly executed, finally obtained R A value of _0, the two points P, a third arithmetic means for outputting as ^{3 n-th} power value of ηT pairing ηT based on the coordinate data of the Q (P, Q),
Based on the value of the third arithmetic means said ItaT pairing has output ηT (P, Q) obtained by computing the 3 ⁿ root from 3 ^n-th power value of ηT (P, Q),

The e (P, Q) obtained by calculation and a fourth arithmetic means you output as the value of the Tate pairing,
Pairing calculation program to function as.

Images