JP5505173B2 - LIST GENERATION DEVICE, LIST GENERATION METHOD, AND LIST GENERATION PROGRAM - Google Patents

Description

  The present invention relates to a list generation device, a list generation method, and a list generation program.

  In recent years, online shopping and online banking have become widespread. When performing communication in online shopping or online banking, encryption techniques such as common key encryption are used to prevent information leakage.

  Public key cryptography is a method of encrypting and decrypting data using two pairs of keys. In other words, the sender encrypts the message with the public key published by the receiver and sends it. In contrast, the recipient decrypts the encrypted message with the secret key. The public key is a key for encrypting a message, and the secret key is a key for decrypting information encrypted with the public key. Information encrypted with the public key can only be decrypted with the private key of the pair.

This public key encryption is designed based on a mathematically difficult problem so that security can be ensured even if the public key is disclosed. For example, public key cryptography is designed based on the discrete logarithm problem. This discrete logarithm problem is that ^{α is obtained} from G and G ^α when a generator G of a commutative group consisting of p elements and αεZp.

からαを求めるという補助情報付きの離散対数問題がある。この補助情報付きの離散対数問題を解くアルゴリズムとして、Cheonらの論文では、決定的アルゴリズムと確率的アルゴリズムとが示されている。ｄは、位数ｒから１を減算した値の約数に対応する。 Further, auxiliary information d is added to the discrete logarithm problem, and G, G ^α ,

There is a discrete logarithm problem with auxiliary information to find α from In the paper of Cheon et al., A deterministic algorithm and a stochastic algorithm are shown as algorithms for solving this discrete logarithm problem with auxiliary information. d corresponds to a divisor of a value obtained by subtracting 1 from the order r.

Of these, the deterministic algorithm has an enormous amount of calculation, and it is practically difficult to solve the discrete logarithm problem using this deterministic algorithm. For this reason, Cheon et al. Have proposed a stochastic algorithm that reduces the amount of computation by applying the “Pollard's kangaroo algorithm”. This probabilistic algorithm is applied not only to the discrete logarithm problem but also to a discrete logarithm problem on an elliptic curve. A discrete logarithm problem on an elliptic curve is expressed as an elliptic curve discrete logarithm problem. The elliptic curve discrete logarithm problem is a problem of finding an unknown α from three points G, G ₁ = αG, G _d = α ^d G on the elliptic curve.

In the probabilistic algorithm, G, and k1 retrieved from G _d, G, determine the unknowns α using and k2 retrieved from G _1. Here, when the probabilistic algorithm obtains k1 and k2, a list in which characteristic points (distinguished points) on an elliptic curve are collected is used. When a list is generated by the probabilistic algorithm, feature points are obtained by sequentially multiplying points on the elliptic curve based on values obtained by sequentially substituting the points on the elliptic curve into the random walk function.

  In addition, in order to create a list using a random walk function, enormous repetition processing is required. For this reason, conventionally, by setting a large number of initial points when creating a list, parallel processing is performed by a plurality of computers, and the processing load when creating a list is distributed.

Japanese Patent Laid-Open No. 11-288215 JP 2003-288013 A

  When the computer generates the list, it is necessary to perform scalar multiplication on the points on the elliptic curve, and the calculation cost of this scalar multiplication becomes very high. For this reason, it is required to reduce the calculation cost of scalar multiplication and to speed up the process of generating a list.

  The disclosed technology has been made in view of the above, and provides a list generation device, a list generation method, and a list generation program capable of reducing the calculation cost of scalar multiplication and speeding up the process of generating a list The purpose is to do.

  The list generation apparatus disclosed in the present application uses a fixed point table that stores a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values, and a random walk function for the points on the elliptic curve. The points on the elliptic curve are calculated, a pseudo random function application unit that stores the calculated points in the storage unit, and the values of the points stored in the storage unit are summed, and a scalar value based on the total value A combination of a value corresponding to the scalar value among the values stored in the fixed point table and adding the determined values to each other on the elliptic curve. A point calculation unit that calculates the next point on the elliptic curve from the point and a list generation unit that collects each point calculated by the point calculation unit and generates a list.

  According to one aspect of the list generation device disclosed in the present application, it is possible to reduce the calculation cost of scalar multiplication and to speed up the process of generating a list.

FIG. 1 is a flowchart showing the processing procedure of the stochastic algorithm of Cheon et al. FIG. 2 is a flowchart showing a processing procedure of a conventional collision detection process. FIG. 3 is a flowchart showing a processing procedure of conventional list generation processing. FIG. 4 is a flowchart (1) showing a processing procedure when the stochastic algorithm is processed in parallel. FIG. 5 is a flowchart (2) showing a processing procedure when the probabilistic algorithm is processed in parallel. FIG. 6 is a diagram illustrating a configuration of a conventional list generation apparatus. FIG. 7 is a flowchart showing a processing procedure of the conventional list generation apparatus. FIG. 8 is a diagram illustrating an example of a data structure of a conventional fixed point table. FIG. 9 is a diagram illustrating the configuration of the system according to the present embodiment. FIG. 10 is a diagram illustrating a configuration of the list generation device. FIG. 11 is a diagram illustrating an example of the data structure of the fixed point table. FIG. 12 is a diagram for explaining that G _{i + 1} calculated by each scalar multiplication calculation unit is the same. FIG. 13 is a flowchart illustrating the processing procedure of the list generation device according to the present embodiment. FIG. 14 is a flowchart (1) illustrating the processing procedure of the system according to the present embodiment. FIG. 15: is a flowchart (2) which shows the process sequence of the system concerning a present Example. FIG. 16 is a flowchart showing a processing procedure for generating a fixed point table. FIG. 17 is a diagram illustrating a computer that executes a list generation program.

  First, a technique that is a prerequisite for explaining the technique in the encryption key decryption apparatus disclosed in the present application will be described with reference to the drawings.

  First, the processing procedure of the stochastic algorithm of Cheon et al. For solving the elliptic curve discrete logarithm problem with auxiliary information will be described. FIG. 1 is a flowchart showing the processing procedure of the stochastic algorithm of Cheon et al.

As shown in FIG. 1, in the probabilistic algorithm, E, G, G ₁ , G _d , and len are acquired (step S10). Here, E is various parameters of the elliptic curve. G, G ₁ , and G _d are points on the elliptic curve, and G ₁ = αG and G _d = α ^d G. len is a threshold used when a list is generated. len is set to a value about the fourth root of the order r of the point G of the elliptic curve.

The probabilistic algorithm, to generate the origin ζ of _{Z r} (step S11), and sets the s and s' (step S12). In step S12, s is calculated by “(r−1) / d”. S ′ corresponds to d.

In the probabilistic algorithm, k1 is obtained by executing the collision detection process based on E, G, G _d , s, s ′, ζ, and len (step S13). In the probabilistic algorithm, k2 is obtained by executing the collision detection process based on E, G, G ₁ , s, s ′, ζ, and len (step S14).

」により算出される。 In the stochastic algorithm, α is calculated based on k1 and k2 (step S15), and α is output (step S16). In step S15, α is “

] Is calculated.

Next, the process procedure of the collision detection process shown in step S13 and step S14 of FIG. 1 will be described. FIG. 2 is a flowchart showing a processing procedure of a conventional collision detection process. In the flowchart of FIG. 2, description will be made using G ₀ and G ′ ₀ . In the probabilistic algorithm of FIG. 1, when the collision detection process is executed based on E, G, G _d , s, s ′, ζ, len, G ₀ corresponds to G, and G ′ ₀ Corresponds to _Gd . On the other hand, when the collision detection process is executed based on E, G, G ₁ , s, s ′, ζ, and len, G ₀ corresponds to G, and G ′ ₀ corresponds to G ₁ . Correspond.

As shown in FIG. 2, in the collision detection process, list1 is obtained by executing the list generation process based on E, G ₀ , ζ ^{s ′} , and len (step S20). In the collision detection process, list2 is obtained by executing the list generation process based on E, G ′ ₀ , ζ ^{s ′} , and len (step S21).

」によって算出される。 In the collision detection process, list 1 and list 2 are compared to determine indexes v and u when a collision occurs (step S22). In the collision detection process, k is calculated based on the indices v and u (step S23), and k is output (step S24). In step S23, k is “

".

」によって定義される。 In the above equation for calculating k, f _s is a pseudo random function. For example, f _s is a function that returns x mod s when a point G = (x, y) on the elliptic curve is given. The random walk function F _s is a function that maps the point G of the elliptic curve to a point on another elliptic curve.

”.

For example, when the collision detection process is executed based on E, G, G _d , s, s ′, ζ, and len, k1 is obtained by the equation for calculating k. On the other hand, when the collision detection process is executed based on E, G, G ₁ , s, s ′, ζ, and len, k2 is obtained by the equation for calculating k.

」によって算出される。 Next, the process procedure of the list generation process shown in step S20 and step S21 of FIG. 2 will be described. FIG. 3 is a flowchart showing a processing procedure of conventional list generation processing. As shown in FIG. 3, in the list generation process, the value of i is set to an initial value (step S30), and the value of G _{i + 1} is calculated (step S31). In step S31, G _{i + 1} is “

".

In the list generation process, it is determined whether or not the value of G _{i + 1} is a characteristic point (distinguished point) (step S32). In step S32, in the list generation process, if a part of the value of G _{i + 1} is a predetermined value, it is determined that the value of the point G _{i + 1} of the elliptic curve is a feature point.

In the list generation process, when it is determined that the value of G _{i + 1} is not a feature point (No in step S32), the process proceeds to step S34. On the other hand, in the list generation process, when it is determined that the value of G _{i + 1} is a feature point (step S32, Yes), the value of G _{i + 1} is registered in the list (step S33).

  In the list generation process, 1 is added to the value of i (step S34), and it is determined whether the value of i is larger than len (step S35). In the list generation process, when the value of i is equal to or less than len (No in step S35), the process proceeds to step S31. On the other hand, in the list generation process, when the value of i is larger than len (step S35, Yes), the process ends.

In step S33, in the list generation process, the index i and the value of G _{i + 1} are associated with each other and registered in the list. When the list generation process is executed based on E, G ₀ , ζs ′, and len, the list corresponds to list1. In this case, the index i of list corresponds to the index v of list1.

When the list generation process is executed based on E, G ′ ₀ , ζs ′, and len, the list corresponds to list2. In this case, the index i of list corresponds to the index u of list2.

Current elliptic curve discrete logarithm problem, in order to ensure safety, of order r of a point of the elliptic curve 2 ¹⁶⁰ is utilized. Therefore, when performing the probabilistic algorithm, len is a value of about 2 ⁴⁰ is designated. When the value of len is assigned to 2 ^40, the list generation process shown in FIG. 3, it is necessary to repeatedly run 2 ⁴⁰ times, the amount of calculation becomes enormous.

  The algorithm shown in FIGS. 1 to 3 can be speeded up by parallel processing by a plurality of computers 0 to n. For example, the plurality of computers 0 to n are connected to each other via a network and cooperate to execute parallel processing. In this parallel processing, the plurality of computers 1 to n each generate a list, and the computer 0 collects each list. The computer 0 calculates an unknown α using each list.

  FIG. 4 and FIG. 5 are flowcharts showing a processing procedure when the probabilistic algorithms are processed in parallel. The processes in steps S40 to S43 in FIG. 4 and the processes in steps S50 to S52 and S59 to S62 in FIG. 5 are processes executed by the computer 0. The process in step S44 in FIG. 4 is a process in which the computers 1 to n / 4 each generate a list. The process in step S47 in FIG. 4 is a process in which the computers n / 4 to n / 2 each generate a list. The processing in step S53 in FIG. 5 is processing in which the computers n / 2 to 3n / 4 each generate a list. The processing in step S56 in FIG. 5 is processing in which the computers 3n / 4 to n each generate a list.

As shown in FIG. 4, in parallel processing, E, G, G ₁ , G _d , and len are acquired (step S40), and a generation source ζ is generated (step S41). In parallel processing, s and s ′ are calculated (step S42), and the value of i is set to an initial value (step S43).

In the parallel processing, list1 is obtained by executing list generation processing based on E, G _i , ζ ^{s ′} , and len (step S44). In the parallel processing, 1 is added to the value of i (step S45), and it is determined whether or not the value of i is larger than n / 4 (step S46). When the value of i is n / 4 or less (No in step S46), the process proceeds to step S44.

On the other hand, when the value of i is larger than n / 4 (step S46, Yes), in parallel processing, by executing list generation processing based on E, G _id , ζ ^{s ′} , and len, list2 is obtained (step S47). In the parallel processing, 1 is added to the value of i (step S48), and it is determined whether or not the value of i is larger than n / 2 (step S49). When the value of i is n / 2 or less (step S49, No), the process proceeds to step S47.

  On the other hand, when the value of i is larger than n / 2 (step S49, Yes), in parallel processing, list1 and list2 are compared to determine indexes v and u when a collision occurs (step S49). S50).

」によって算出される。並列処理では、ｓおよびｓ’を設定する（ステップＳ５２）。ｓはｄに対応する。ｓ’は「（ｒ−１）／ｄ」により算出される。 In parallel processing, k1 is calculated (step S51). k1 is "

". In the parallel processing, s and s ′ are set (step S52). s corresponds to d. s ′ is calculated by “(r−1) / d”.

In parallel processing, list3 is obtained by executing list generation processing based on E, G _i , ζ ^{s ′} , and len (step S53). In the parallel processing, 1 is added to the value of i (step S54), and it is determined whether or not the value of i is larger than 3n / 4 (step S55). When the value of i is 3n / 4 or less (step S55, No), the process proceeds to step S53.

On the other hand, when the value of i is larger than 3n / 4 (step S55, Yes), in parallel processing, by executing list generation processing based on E, G _1i , ζ ^{s ′} , len, list4 is obtained (step S56). In the parallel processing, 1 is added to the value of i (step S57), and it is determined whether or not the value of i is larger than n (step S58). When the value of i is n or less (step S58, No), the process proceeds to step S56.

  On the other hand, when the value of i is larger than n (step S58, Yes), in the parallel processing, list3 and list4 are compared to determine indexes v and u when a collision occurs (step S59). .

」によって算出される。並列処理では、ｋ１およびｋ２を基にしてαを算出し（ステップＳ６１）、αを出力する（ステップＳ６２）。 In the parallel processing, k2 is calculated (step S60). k2 is "

". In the parallel processing, α is calculated based on k1 and k2 (step S61), and α is output (step S62).

  When the computers 0 to n execute parallel processing according to the processing procedure shown in FIGS. 4 and 5, the processing load for generating the list can be distributed.

  Next, the configuration of the list generation device that executes the list generation processing shown in FIG. 3 will be described. FIG. 6 is a diagram illustrating a configuration of a conventional list generation apparatus. As shown in FIG. 6, the list generation device includes an input unit 11, a repetition determination unit 12, a storage unit 13, a scalar value generation unit 14, a scalar multiplication calculation unit 15, a feature point determination unit 16, and a point output unit 17. Have.

  The input unit 11 is a processing unit that receives parameters for creating a list and outputs the received parameters to the repetition determination unit 12, the scalar value generation unit 14, and the scalar multiplication calculation unit 15. The input unit 11 may receive parameters from an input device such as a keyboard, or may acquire parameters by performing information communication with other devices.

The parameters include E, G ₀ , ζ ^{s ′} , and len. The input unit 11 outputs E and G ₀ of the parameters to the scalar multiplication calculation unit 15 and outputs E and ζ ^{s ′} to the scalar value generation unit 14. Further, the input unit 11 outputs len to the determination unit 12 repeatedly.

Repetition determining unit 12 is a processing unit for counting the number of times of calculating the _{G i + 1} from the _{G i.} Repetition determining unit 12 may count how the number of G _{i + 1} from the G _i is calculated. For example, the repetition determination unit 12 counts the number of calculations each time the scalar multiplication calculation unit 15 outputs the calculation result of G _{i + 1} .

  The repetition determination unit 12 determines to end the list generation process when the counted number of calculations exceeds len. For example, when it is determined that the list generation process is to be ended, the repetition determination unit 12 controls the scalar value generation unit 14 and the scalar multiplication calculation unit 15 to end the process.

  The storage unit 13 is a storage unit that stores the calculation result of the scalar multiplication calculation unit 15.

を算出する処理部である。図６に示すように、スカラ値生成部１４は、ランダム関数部１４ａおよび冪乗余剰計算部１４ｂを有する。 The scalar value generator 14 starts from G _i

Is a processing unit for calculating. As shown in FIG. 6, the scalar value generation unit 14 includes a random function unit 14a and a power surplus calculation unit 14b.

Random function unit 14a is a processing unit for calculating the _f s _{(G i)} from the _{G i.} For example, f _s is a function that returns “x mod s” when a point G = (x, y) on the elliptic curve is given. The random function unit 14a outputs f _s (G _i ) to the power surplus calculation unit 14b. Note that the random function unit 14 a acquires G ₀ as an initial value of G _i from the input unit 11. Further, the random function unit 14a acquires the value of G _i other than the initial value from the storage unit 13.

を算出する処理部である。冪乗余剰計算部１４ｂは、

をスカラ倍算計算部１５に出力する。 The power surplus calculation unit 14b acquires f _s (G _i ) and ζ ^{s ′,} and

Is a processing unit for calculating. The power surplus calculation unit 14b

Is output to the scalar multiplication calculation unit 15.

とを取得して、Ｇ_ｉ＋１を計算する処理部である。スカラ倍算計算部１５は、Ｇ_ｉ＋１を「

」によって計算する。スカラ倍算計算部１５は、Ｇ_ｉ＋１を記憶部１３に記憶する。また、スカラ倍算計算部１５は、Ｇ_ｉ＋１を特徴点判定部１６に出力する。 The scalar multiplication calculation unit 15 calculates G _i

And a processing unit that calculates G _{i + 1} . The scalar multiplication calculation unit 15 sets G _{i + 1} to “

To calculate. The scalar multiplication calculation unit 15 stores G _{i + 1} in the storage unit 13. Further, the scalar multiplication calculation unit 15 outputs G _{i + 1} to the feature point determination unit 16.

The feature point determination unit 16 is a processing unit that determines whether or not G _{i + 1} is a feature point. For example, the feature point determination unit 16 determines that G _{i + 1} is a feature point when a part of the value of G _{i + 1} is a predetermined value. The feature point determination unit 16 outputs G _{i + 1} determined as the feature point to the point output unit 17.

The point output unit 17 is a processing unit that generates a list by registering G _{i + 1} determined as a feature point in a table. The point output unit 17 outputs the list information to an external device.

Next, a processing procedure of the list generation device 10 shown in FIG. 6 will be described. FIG. 7 is a flowchart showing a processing procedure of the conventional list generation apparatus. As shown in FIG. 7, the list generation apparatus 10 sets the value of i to an initial value (step S70), inputs G _i to the random function, and obtains an input result f _s (G _i ) (step S71). .

が得られる。リスト生成装置１０は、スカラ倍算計算を実行し、Ｇ_ｉ＋１を得る（ステップＳ７３）。 The list generation device 10 performs a power surplus calculation (step S72). By performing the power surplus calculation,

Is obtained. The list generation device 10 executes scalar multiplication calculation to obtain G _{i + 1} (step S73).

The list generation device 10 determines whether or not G _{i + 1} is a feature point (step S74). If G _{i + 1} is not a feature point (No at Step S74), the list generating apparatus 10 proceeds to Step S76.

On the other hand, if G _{i + 1} is a feature point (Yes in step S74), the list generating apparatus 10 registers G _{i + 1} in the list (step S75). The list generation device 10 adds 1 to i (step S76), and determines whether the value of i is larger than len (step S77). If the value of i is larger than len (step S77, Yes), the list generation device 10 ends the process. On the other hand, if the value of i is equal to or less than len (step S77, No), the list generation device 10 proceeds to step S71.

  Of various calculations executed when the list generation device 10 generates a list, the scalar multiplication calculation of FIG. 7 is the main calculation. For this reason, if the scalar multiplication calculation can be speeded up, the list generating apparatus 10 can speed up the process of generating the list.

  As a technique for speeding up the scalar multiplication calculation, there is a technique called a fixed point table method. In this fixed point table method, a plurality of scalar multiplication calculations are executed in advance, and the calculation results are stored in the fixed point table. In the fixed point table method, when a scalar multiplication calculation is newly executed, the scalar multiplication calculation is executed by adding the calculation results stored in the fixed point table.

  Specifically, the fixed point table method will be described. FIG. 8 is a diagram illustrating an example of a data structure of a conventional fixed point table. As shown in FIG. 8, in this fixed point table, values obtained by doubling and multiplying the numerical values in the first column are stored. For example, 1G, 2G, and 3G are stored in the first row. In the second row, 4G, 8G, and 12G are stored. In the third row, 16G, 32G, and 48G are stored. In the fourth row, 64G, 128G, and 192G are stored. In the fifth row, 256G, 512G, and 768G are stored. Each G in the fixed point table is the same point.

  For example, a case where the fixed point table method calculates 10G will be described. In this case, in the fixed point table method, 2G stored in the first row and second column in FIG. 8 and 8G stored in the second row and second column are elliptically added to calculate 10G. Rather than multiplying 10 and G by scalar multiplication, the calculation cost is lower when 2G and 8G are elliptically added. For this reason, if the list generation process can be executed using the fixed point table method, the process of generating the list can be accelerated.

However, when the fixed point table method is used, there is a restriction that the point G on the elliptic curve for scalar multiplication always has the same value. For example, in the fixed point table method, a 10G _1, it can be calculated by elliptic curve addition of 2G ₁ and 8G _1, a 10G _2, can not be calculated in elliptic curve addition of 2G ₁ and 8G _1.

  When the scalar multiplication calculation unit 15 shown in FIG. 6 executes the scalar multiplication calculation, the point G on the elliptic curve is updated every time. For this reason, the conventional list generation apparatus 10 cannot speed up the scalar multiplication calculation using the fixed point table method.

  Next, this embodiment will be described. FIG. 9 is a diagram illustrating the configuration of the system according to the present embodiment. As illustrated in FIG. 9, the system includes list generation devices 100 a to 100 n and an encryption key analysis device 200. The list generation devices 100a to 100n and the encryption key analysis device 200 are connected to each other via the network 50.

  The list generation devices 100a to 100n are processing units that generate a list based on a random walk function and a point G on an elliptic curve. The list generation devices 100a to 100n transmit the list to the encryption key analysis device 200.

  The encryption key analysis apparatus 200 is an apparatus that analyzes an encryption key by collecting lists from the list generation apparatuses 100a to 100n and solving an elliptic curve discrete logarithm problem with auxiliary information based on each list. The encryption key analysis apparatus 200 is an apparatus corresponding to the computer 0 described above, and solves the elliptic curve discrete logarithm problem with auxiliary information by the processing procedure shown in FIG.

  Next, the configuration of the list generation device 100a will be described. Other configurations of the list generation device are the same as the configuration of the list generation device 100a. FIG. 10 is a diagram illustrating a configuration of the list generation device. As illustrated in FIG. 10, the list generation device 100 a includes an input unit 110, a repetition determination unit 120, a storage unit 130, a scalar multiplication calculation unit 150, a feature point determination unit 160, and a point output unit 170.

  The input unit 110 is a processing unit that receives parameters for creating a list and outputs the received parameters to the repetition determination unit 120, the scalar value generation unit 140, and the scalar multiplication calculation unit 150. The input unit 110 may receive parameters from an input device such as a keyboard, or may acquire parameters by performing information communication with other devices.

The parameters include E, G ₀ , ζ ^{s ′} , and len. The description regarding E, G ₀ , ζ ^{s ′} , and len is the same as described above. Among the parameters, the input unit 110 outputs E and G ₀ to the scalar multiplication calculation unit 150 and outputs E and ζ ^{s ′} to the scalar value generation unit 140. Further, the input unit 110 outputs len to the determination unit 120 repeatedly.

Repetition determining unit 120 is a processing unit for counting the number of times of calculating the _{G i + 1} from the _{G i.} Repetition determining unit 120 may count how the number of G _{i + 1} from the G _i is calculated. For example, the repetition determination unit 120 counts the number of calculations each time the scalar multiplication calculation unit 150 outputs a calculation result of G _{i + 1} .

  The iterative determination unit 120 determines to end the list generation process when the counted number of calculations exceeds len. For example, when it is determined that the list generation process is to be ended, the repetition determination unit 120 controls the scalar value generation unit 140 and the scalar multiplication calculation unit 150 to end the process.

  The storage unit 130 is a storage unit that stores the calculation result of the scalar multiplication calculation unit 150.

を算出する処理部である。図１０に示すように、スカラ値生成部１４０は、ランダム関数部１４１、加算部１４２、加算結果格納部１４３、冪乗余剰計算部１４４を有する。 Scalar value generator 140, the _{G i}

Is a processing unit for calculating. As illustrated in FIG. 10, the scalar value generation unit 140 includes a random function unit 141, an addition unit 142, an addition result storage unit 143, and a power surplus calculation unit 144.

Random function unit 141 is a processing unit for calculating the _f s _{(G i)} from the _{G i.} For example, f _s is a function that returns “x mod s” when a point G = (x, y) on the elliptic curve is given. The random function unit 141 outputs f _s (G _i ) to the adding unit 142. Note that the random function unit 141 acquires G ₀ as an initial value of G _i from the input unit 110. Further, the random function unit 141 acquires the value of _{G i} other than the initial value from the storage unit 130.

The adding unit 142 is a processing unit that sequentially adds the values of f _s (G _i ) and outputs the addition result a _i to the power-residue calculating unit 144. In addition, the addition unit 142 stores the addition result a _i in the addition result storage unit 143. The addition result storage unit 143 is a storage unit that stores the addition result a _i . The addition result storage unit 143 stores ₀ as the initial value a ₀ of the addition result a _i .

Specifically, the addition unit 142 calculates the _{a i} by _{"a i = a i-1 +} f s (G i) ." That is, the adding unit 142 calculates a _i by adding f _s (G _i ) acquired from the random function unit 141 and a _i−1 stored in the addition result storage unit 143.

を算出する処理部である。冪乗余剰計算部１４４は、

をスカラ倍算計算部１５に出力する。 The power surplus calculation unit 144 obtains ai and ζ ^{s ′} ,

Is a processing unit for calculating. The power surplus calculation unit 144

Is output to the scalar multiplication calculation unit 15.

とを取得し、固定テーブル法を利用して、Ｇ_ｉ＋１を計算する処理部である。スカラ倍算計算部１５０は、Ｇ_ｉ＋１を「

」によって計算する。ここで、

に着目すると、Ｇ_ｉ＋１のｉの値が順次変化し、Ｇ_２、Ｇ_３、・・・Ｇ_ｌｅｎを算出する場合でも、スカラ倍算計算部１５０は、楕円曲線上の点Ｇ_０を固定したままで、「

」倍すればよい。つまり、スカラ倍算計算部１５０は、固定テーブル法を利用して、スカラ倍算を算出することが可能となる。 The scalar multiplication calculation unit 150 calculates G ₀

And using the fixed table method to calculate G _{i + 1} . The scalar multiplication calculation unit 150 converts G _{i + 1} to “

To calculate. here,

When the value of i in G _{i + 1} changes sequentially and G ₂ , G ₃ ,... G _len are calculated, the scalar multiplication calculation unit 150 fixes the point G ₀ on the elliptic curve. as it is,"

"You can double it. That is, the scalar multiplication calculation unit 150 can calculate the scalar multiplication using the fixed table method.

The scalar multiplication calculation unit 150 holds a fixed point table. FIG. 11 is a diagram illustrating an example of the data structure of the fixed point table. As shown in FIG. 11, in this fixed point table, a value obtained by doubling or multiplying the value in the first column is stored. For example, 1G ₀ , 2G ₀ , 3G ₀ are stored in the first row. In the second row, 4G ₀ , 8G ₀ and 12G ₀ are stored. In the third row, 16G ₀ , 32G ₀ , and 48G ₀ are stored. In the fourth row, 64G ₀ , 128G ₀ , and 192G ₀ are stored. In the fifth row, 256G ₀ , 512G ₀ , and 768G ₀ are stored. Each G ₀ of the fixed point table is the same point on all elliptic curves.

」実行する。例えば、「

」の値が「１０」の場合には、スカラ倍算計算部１５０は、図１１の１行目２列目に格納された２Ｇ_０と、２行目２列目に格納された８Ｇ_０とを楕円加算することで、１０Ｇ_０を算出する。 The scalar multiplication calculation unit 150 combines the values stored in the fixed point table to create a scalar multiplication “

"Run. For example, "

When the value of “10” is “10”, the scalar multiplication calculation unit 150 calculates 2G ₀ stored in the first row and second column of FIG. 11 and 8G ₀ stored in the second row and second column of FIG. 10G ₀ is calculated by adding the ellipses.

The scalar multiplication calculation unit 150 stores G _{i + 1} as a calculation result in the storage unit 130. Further, the scalar multiplication calculation unit 150 outputs G _{i + 1} to the feature point determination unit 160.

Meanwhile, the G _{i + 1} scalar multiplication calculation portion 150 calculates, G _{i + 1} scalar multiplication calculation portion 15 shown in FIG. 6 calculates is the same. FIG. 12 is a diagram for explaining that G _{i + 1} calculated by each scalar multiplication calculation unit is the same. For the sake of simplicity, it will be described for calculating the G _2.

のｉに１を代入したものである。図１２の１ａは、２ａのように置き換えることができる。２ａ部分のａ_１は、冪乗余剰計算部１４４が出力する算出結果である。そして、２ａは、３ａのように置き換えることができる。３ａは、

のｉに１を代入したものである。つまり、スカラ倍算計算部１５０が算出するＧ_ｉ＋１と、図６に示したスカラ倍算計算部１５が算出するＧ_ｉ＋１は同じものである。しかし、スカラ倍算計算部１５０は、Ｇ_０が固定されているので、固定点テーブル法を利用することができる。 1a in FIG.

1 is substituted for i. In FIG. 12, 1a can be replaced with 2a. A _{1 in the} 2a portion is a calculation result output by the power surplus calculation unit 144. And 2a can be replaced like 3a. 3a is

1 is substituted for i. That is, the G _{i + 1} scalar multiplication calculation portion 150 calculates, G _{i + 1} scalar multiplication calculation portion 15 shown in FIG. 6 calculates is the same. However, the scalar multiplication calculation unit 150 can use the fixed point table method because _G0 is fixed.

  The scalar multiplication calculation unit 150 acquires a fixed point table from the input unit 110. Alternatively, the scalar multiplication calculation unit 150 itself may generate a fixed point table. For example, the scalar multiplication calculation unit 150 repeatedly calculates the scalar value of the points by repeatedly executing the process of adding the same points on the elliptic curve, and stores the calculation result in the fixed point table. For example, a point on the elliptic curve to be added is designated by an administrator or the like.

Returning to the description of FIG. The feature point determination unit 160 is a processing unit that determines whether or not G _{i + 1} is a feature point. For example, the feature point determination unit 160 determines that G _{i + 1} is a feature point when a part of the value of G _{i + 1} is a predetermined value. The feature point determination unit 160 outputs G _{i + 1} determined as the feature point to the point output unit 170.

The point output unit 170 is a processing unit that generates a list by registering G _{i + 1} determined as a feature point in a table. The point output unit 170 transmits the list information to the encryption key analysis apparatus 200.

Next, a processing procedure of the list generation apparatus 100a according to the present embodiment will be described. FIG. 13 is a flowchart illustrating the processing procedure of the list generation device according to the present embodiment. As illustrated in FIG. 13, the list generation device 100a sets the value of i to an initial value (step S101), inputs G _i to a random function, and obtains an input result f _s (G _i ) (step S102). ).

The list generation device 100a executes addition processing (step S103). In step S <b> 103, the list generation device 100 a executes addition processing by adding f _s (G _i ) output from the random function unit 141 and a _i−1 stored in the addition result storage unit 143. To do.

が得られる。リスト生成装置１００ａは、固定点テーブルを利用して、スカラ倍算計算を実行し、Ｇ_ｉ＋１を得る（ステップＳ１０５）。 The list generation device 100a executes a power surplus calculation (step S104). In step S104, the list generation device 100a executes a power surplus calculation,

Is obtained. The list generation device 100a executes scalar multiplication calculation using the fixed point table to obtain G _{i + 1} (step S105).

The list generation device 100a determines whether or not G _{i + 1} is a feature point (step S106). If G _{i + 1} is not a feature point (No at Step S106), the list generating apparatus 100a proceeds to Step S108.

On the other hand, if G _{i + 1} is a feature point (Yes in step S106), the list generating apparatus 100a registers G _{i + 1} in the list (step S107). The list generation device 100a adds 1 to i (step S108), and determines whether the value of i is larger than len (step S109). When the value of i is larger than len (step S109, Yes), the list generation device 100a outputs the list to the encryption key analysis device 200 (step S110). On the other hand, when the value of i is equal to or less than len (step S109, No), the list generation device 100a proceeds to step S102.

  Next, a processing procedure of the system according to the present embodiment will be described. 14 and 15 are flowcharts illustrating the processing procedure of the system according to the present embodiment. The processes in steps S200 to S203 in FIG. 14 and the processes in steps S210 to S212 and steps S210 to S222 in FIG. 15 are processes executed by the encryption key analysis apparatus 200. The processing in step S204 in FIG. 14 is processing in which the list generation devices 100a to N / 4 each generate a list. The processing in step S207 in FIG. 14 is processing in which the list generation devices N / 4 to N / 2 each generate a list. The processing in step S213 in FIG. 15 is processing in which the list generation devices N / 2 to 3N / 4 each generate a list. The processing in step S216 in FIG. 15 is processing in which the list generation devices 3N / 4 to 100n each generate a list.

The encryption key analysis apparatus 200 acquires E, G, G, G _d , and len (step S200), and generates a generation source ζ (step S201). The encryption key analysis apparatus 200 calculates s and s ′ (step S202). In step S202, the encryption key analysis apparatus 200 calculates s and s ′ by s = (r−1) / d and s ′ = d.

  The value of i is set to an initial value (step S203), and the list generation apparatus 100 obtains list1 by executing list generation processing (step S204). 1 is added to the value of i (step S205), and it is determined whether or not the value of i is greater than N / 4 (step S206).

  When the value of i is N / 4 or less (No at Step S206), the process proceeds to Step S204. When the value of i is larger than N / 4 (Yes at Step S206), each list generation device 100 transmits list1 to the encryption key analysis device 200 (Step S207).

  The list generation device 100 obtains list2 by executing the list generation process (step S208). 1 is added to the value of i (step S209), and it is determined whether or not the value of i is greater than N / 2.

  When the value of i is N / 2 or less (No in step S210), the process proceeds to step S208. On the other hand, if the value of i is greater than N / 2 (Yes in step S210), each list generation device 100 transmits list2 to the encryption key analysis device 200 (step S211).

に基づいて、ｋ１を算出するものとする。 The description shifts to the description of FIG. The encryption key analysis apparatus 200 compares list1 and list2, and determines indexes v and u when a collision occurs (step S212). The encryption key analysis apparatus 200 calculates k1 (step S213). In step S213, the encryption key analysis apparatus 200

Assume that k1 is calculated based on the above.

  The encryption key analysis apparatus 200 calculates s and s ′ (step S214). In step S214, the encryption key analysis apparatus 200 calculates s and s 'by s = d and s' = (r-1) / d.

  The list generation device 100 obtains list3 by executing list generation processing (step S215). 1 is added to the value of i (step S216), and it is determined whether or not the value of i is greater than 3N / 4 (step S217).

  If the value of i is 3N / 4 or less (step S217, No), the process proceeds to step S215. On the other hand, when the value of i is larger than 3N / 4 (step S217, Yes), the list generation device 100 transmits list3 to the encryption key analysis device 200 (step S218).

  The list generation device 100 obtains list4 by executing the list generation processing (step S219). 1 is added to the value of i (step S220), and it is determined whether or not the value of i is greater than N (step S221).

  When the value of i is N or less (step S221, No), the process proceeds to step S219. On the other hand, if the value of i is greater than N (step S221, Yes), list4 is transmitted to the encryption key analyzer (step S222). The encryption key analysis apparatus 200 compares list3 and list4 and determines indexes v and u when a collision occurs (step S223).

に基づいて、ｋ２を算出するものとする。暗号鍵解析装置２００は、ｋ１とｋ２とを基にしてαを算出し（ステップＳ２２５）、αを出力する（ステップＳ２２６）。ステップＳ２２５において、暗号鍵解析装置２００は、

に基づいて、αを算出するものとする。 The encryption key analysis apparatus 200 calculates k2 (step S224). In step S224, the encryption key analysis apparatus 200

Based on the above, k2 is calculated. The encryption key analysis apparatus 200 calculates α based on k1 and k2 (step S225), and outputs α (step S226). In step S225, the encryption key analysis apparatus 200

Based on the above, α is calculated.

  The list generation processing shown in steps 204 and S208 of FIG. 14 and steps 215 and S219 of FIG. 15 corresponds to the processing procedure shown in FIG.

  Next, a processing procedure when the list generation device 100a generates a fixed point table will be described. FIG. 16 is a flowchart showing a processing procedure for generating a fixed point table. As illustrated in FIG. 16, the list generation device 100a acquires G and bit (step S300), and sets the value of G to G ″ (step S301). Here, bit is a threshold value that determines the number of rows in the fixed point table.

  The list generation device 100a sets the value of i to an initial value (step S302), and sets the value of G ″ to G ′ (step S303). The list generation device 100a sets the value of j as an initial value (step S304), and stores the value of G ″ in the i-th row and j-th column of the fixed point table (step S305).

  The list generation device 100a updates the value of G ″ with the value obtained by adding G ″ and G ′ (step S306), and adds 1 to the value of j (step S307). The list generation device 100a determines whether the value of j is greater than 3 (step S308).

  If the value of j is 3 or less (No at Step S308), the list generating apparatus 100a proceeds to Step S305. On the other hand, when the value of j is greater than 3 (step S308, Yes), the list generation device 100a adds 1 to the value of i (step S309).

  The list generation device 100a determines whether or not the value of i is larger than bit (step S310). If the value of i is less than or equal to bit (step S310, No), the list generation device 100a proceeds to step S303. On the other hand, if the value of i is larger than bit (Yes in step S310), the list generation device 100a ends the process.

Next, the effect of the list generation device 100a according to the present embodiment will be described. In the list generation device 100a, the generation source is raised based on the value obtained by adding the value output from the random function unit 141 and the value stored in the addition result storage unit 143, and the power result and the elliptic curve are calculated. and an initial value _{G 0} of the point by a scalar multiplication to calculate the _{G i + 1} from the _{G i.} If the list generating apparatus 100a calculates G _{i + 1} by such a method, the point on the elliptic curve when performing scalar multiplication is always fixed at the initial value G ₀ . For this reason, the list generation device 100a can obtain the scalar multiplication by adding each point of the fixed point table, and can reduce the calculation cost for the scalar multiplication.

Specifically, the position number r = 2 ¹⁶⁰ points of the elliptic curve, the variable n-ary number deployed in the production method of the fixed point table and 2 ^16. In this case, the list generation device 100a can generate the list 21 times faster than the case where the list is generated by the conventional stochastic algorithm. Also, when the n-ary expansion variable is set to 4, the list generation device 100a can generate the list 2.5 times faster than the case of generating the list by the conventional stochastic algorithm. As a premise of the above effect, it is assumed that the calculation cost of the power surplus and the random walk function is sufficiently smaller than the calculation cost of the elliptic scalar multiplication. Also, the length of the list len = r ^1/4 , the calculation cost of ellipse addition is (4log ₂ r) / 3, and the calculation cost of elliptic scalar multiplication is (640/3). Further, when performing parallel processing using 2 ^ten computers, by executing the processing shown in FIGS. 13 to 16, FIG. 4, as compared with the conventional process shown in FIG. 5, The calculation cost can be reduced to 1/1365.

  The list generation device 110a does not register all the points generated by the scalar multiplication calculation unit 150 in the list, but registers only the feature points in the list. For this reason, the data amount of the list can be reduced.

  By the way, the configuration of the list generation device 100a illustrated in FIG. 10 is an example, and the list generation device 100a does not necessarily include all the processing units illustrated in FIG. For example, the list generation device 100a may include a fixed point table, a pseudo random function application unit, a scalar value generation unit, a point calculation unit, and a list generation unit.

  The fixed point table stores a plurality of values obtained by multiplying predetermined points on the elliptic curve by different scalar values. This fixed point table corresponds to the fixed point table held by the scalar multiplication calculation unit 150. The pseudo-random function application unit is a processing unit that calculates a point on the elliptic curve by using a random walk function with respect to the point on the elliptic curve, and stores the calculated point in the storage unit. This pseudo random function application unit corresponds to the random function unit 141.

  The scalar value generation unit is a processing unit that adds the values of the points stored in the storage unit and generates a scalar value based on the total value. The scalar value generation unit corresponds to the scalar value generation unit 140. The point calculation unit determines a combination of values corresponding to the scalar value among the values stored in the fixed point table, and adds the determined values to the elliptic curve from a point on the elliptic curve. Is a processing unit for calculating the next point. This point calculation unit corresponds to the scalar multiplication calculation unit 150. The list generation unit is a processing unit that collects each point calculated by the point calculation unit and generates a list. The list generation unit corresponds to the feature point determination unit 160 and the point output unit 170.

  Various processes of the list generation apparatus 100a described in the above embodiment can be realized by executing a program prepared in advance on a computer system such as a personal computer or a workstation. In the following, an example of a computer that executes a list generation program having the same function as the list generation apparatus 100a described in the above embodiment will be described with reference to FIG. FIG. 17 is a diagram illustrating a computer that executes a list generation program.

  As shown in the figure, the computer 400 as the list generation device 100a includes an input / output control unit 410, an HDD (Hard Disk Drive) 420, a RAM (Random Access Memory) 430, and a CPU (Central Processing Unit) 440. Each device 410 to 440 is configured by being connected by a bus 450.

  Here, the input / output control unit 410 controls input / output of various types of information. The HDD 420 stores information necessary for the CPU 440 to execute various processes. The RAM 430 temporarily stores various information. The CPU 440 executes various arithmetic processes.

  The HDD 420 stores list generation system data in advance. The list generation system data includes a list generation program that exhibits the same function as each processing unit of the list generation apparatus 100a illustrated in FIG. The list generation system data includes list generation data including various parameters necessary for processing. The list generation system data may be appropriately distributed and stored in a storage unit of another computer that is communicably connected via a network.

  Then, the CPU 440 reads out this list generation system data from the HDD 420 and expands it in the RAM 430, so that the list generation system data functions as a list generation system. The list generation system includes a list generation process.

  That is, the list generation system and the list generation process installed therein read out the data for list generation from the HDD 420, expand it in the area allocated to itself in the RAM 430, and execute various processes based on the expanded data and the like. .

  Note that the list generation system and the list generation process correspond to processing executed in each functional unit shown in FIG. For example, the list generation process corresponds to the repetition determination unit 120, the scalar value generation unit 140, the scalar multiplication calculation unit 150, the feature point determination unit 160, and the point output unit 170.

  Note that the above-described list generation program is not necessarily stored in the HDD 420 from the beginning.

  For example, each program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, and an IC card inserted into the computer 400. Then, the computer 400 may read and execute each program from these.

  Further, each program is stored in “another computer (or server)” connected to the computer 400 via a public line, the Internet, a LAN, a WAN, or the like. Then, the computer 400 may read and execute each program from these.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific state of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the functions of the list generation devices 100a to 100n and the encryption key analysis device 200 may be integrated, and list generation and encryption key analysis may be executed by a single device.

  10 correspond to an integrated device such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). Alternatively, each of the processing units 120 and 140 to 170 corresponds to an electronic circuit such as a CPU or MPU (Micro Processing Unit). 10 corresponds to, for example, a semiconductor memory device such as a RAM, a ROM (Read Only Memory), and a flash memory, or a storage device such as a hard disk or an optical disk.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Supplementary note 1) a fixed point table for storing a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values;
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage unit;
Summing the values of the points stored in the storage unit, and generating a scalar value based on the summed value,
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculation unit for calculating the points of
A list generation device comprising: a list generation unit that collects each point calculated by the point calculation unit and generates a list.

(Supplementary Note 2) A fixed point table generating unit that executes scalar multiplication of points by repeatedly performing addition of the same points on an elliptic curve and stores the execution result of the scalar multiplication in the fixed point table. The list generation device according to attachment 1, further comprising:

(Additional remark 3) The said list production | generation part produces | generates the said list | wrist by collecting the point which has a predetermined characteristic among the values calculated by the said point calculation part, The additional remark 1 or 2 characterized by the above-mentioned. List generator.

(Supplementary Note 4) A computer having a fixed point table that stores a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values,
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage device; and
A scalar value generation step of summing the values of the points stored in the storage device, and generating a scalar value based on the total value;
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculating step for calculating
A list generation method comprising: a list generation step of collecting each point calculated by the point calculation unit and generating a list.

(Supplementary Note 5) A fixed point table generating step of performing scalar multiplication of points by repeatedly performing addition of the same points on the elliptic curve and storing the result of scalar multiplication in the fixed point table. The list generation method according to appendix 4, further comprising:

(Additional remark 6) The said list production | generation step produces | generates the said list | wrist by collecting the point which has a predetermined characteristic among the values calculated by the said point calculation part, Additional remark 4 or 5 characterized by the above-mentioned. List generation method.

(Supplementary note 7) A computer having a fixed point table for storing a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values,
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage device; and
A scalar value generation procedure for summing the values of the points stored in the storage device and generating a scalar value based on the total value;
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculation procedure for calculating the points of
A list generation program that collects each point calculated by the point calculation unit and generates a list.

(Supplementary note 8) A fixed point table generation procedure for executing scalar multiplication of points by repeatedly performing addition of the same points on an elliptic curve and storing the execution result of the scalar multiplication in the fixed point table. The list generation program as set forth in appendix 7, which is further executed by a computer.

(Additional remark 9) The said list production | generation procedure produces | generates the said list | wrist by collecting the point which has a predetermined characteristic among the values calculated by the said point calculation part, The additional remark 7 or 8 characterized by the above-mentioned. List generator.

DESCRIPTION OF SYMBOLS 100 List production | generation apparatus 110 Input part 120 Repetition determination part 130 Storage part 140 Scalar value generation part 150 Scalar multiplication calculation part 160 Feature point determination part 170 Point output part

Claims (5)

A fixed point table for storing a plurality of values obtained by multiplying predetermined points on the elliptic curve by different scalar values;
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage unit;
Summing the values of the points stored in the storage unit, and generating a scalar value based on the summed value,
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculation unit for calculating the points of
A list generation device comprising: a list generation unit that collects each point calculated by the point calculation unit and generates a list.   It further includes a fixed point table generating unit that executes scalar multiplication of points by repeatedly performing addition of the same points on the elliptic curve and stores the result of scalar multiplication in the fixed point table. The list generation device according to claim 1.   The list generation device according to claim 1, wherein the list generation unit generates the list by collecting points having a predetermined characteristic among the values calculated by the point calculation unit. . A computer having a fixed point table for storing a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values,
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage device; and
A scalar value generation step of summing the values of the points stored in the storage device, and generating a scalar value based on the total value;
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculating step for calculating
A list generation method comprising: a list generation step of collecting each point calculated by the point calculation unit and generating a list. A computer having a fixed point table for storing a plurality of values obtained by multiplying predetermined points on an elliptic curve by different scalar values,
Calculating a point on the elliptic curve by using a pseudo-random function for the point on the elliptic curve, and storing the calculated point in a storage device; and
A scalar value generation procedure for summing the values of the points stored in the storage device and generating a scalar value based on the total value;
Among each value stored in the fixed point table, a combination of values corresponding to the scalar value is determined, and each determined value is added to the next on the elliptic curve from a point on the elliptic curve. A point calculation procedure for calculating the points of
A list generation program that collects each point calculated by the point calculation unit and generates a list.

Images