JP5769263B2 - Rational point information compression apparatus, rational point information compression method, and rational point information compression program - Google Patents

Description

  The present invention relates to a rational point information compression apparatus, a rational point information compression method, and a rational point information compression program in elliptic curve cryptography and pairing cryptography. In particular, the present invention relates to a rational point information compression apparatus, a rational point information compression method, and a rational point information compression program in elliptic curve cryptography and pairing cryptography when the embedding degree of a rational point group is 1.

  In recent years, information network technology using telecommunications lines such as the Internet has been developed to provide various services such as Internet banking and electronic application to government agencies. Has been.

  When using such a service, authentication processing is required to confirm that the user of the service is an appropriate user, not impersonation or a fictitious person, and a highly reliable authentication method. For example, electronic authentication technology based on public key cryptography using a public key and a secret key is often used.

  However, in the public authentication of the public key cryptosystem, when the public key and the secret key are leaked, it is necessary to change the public key and the secret key immediately. For this reason, it is necessary to carefully manage the public key and the secret key, and there is a trouble that a new public key and secret key setting registration work is required if necessary. For this reason, ID-based encryption that performs electronic authentication using a user-specific ID such as the user's name and email address has recently been used more and more.

  In addition, when user authentication is performed by an authentication device that performs electronic authentication, a history for each user is accumulated in the authentication device. Since this history information itself is the user's personal information, recently there has been an indication that personal information may be leaked due to leakage of this history information.

  Therefore, the authentication device does not authenticate using the user's personal information, but uses multiple users as a group and uses a group signature indicating that they belong to this group. A group signature technique has been proposed in which authentication is performed without specifying a person, thereby enabling authentication without accumulating personal information in an authentication apparatus.

The national UNS strategic program also highlights the importance and necessity of anonymous authentication technology that can authenticate users while protecting privacy.
UNS: Universal Communications, New Generation Networks, Security and safety

There is a pairing cipher as a mathematical foundation for easily realizing such ID-based ciphers and group signatures. Pairing is a function of two inputs and one output defined on an elliptic curve. The input uses two rational points on the elliptic curve and the output uses a finite field element. This pairing has bilinearity for two inputs. For example, rational points on an elliptic curve defined with P on prime field F _p, as rational points on an elliptic curve defined with Q over k-th extension field F _p ^k, and inputs the P and Q larger when the original z body F ^* _p ^k is output, z of ab-th power is outputted by entering the a times of P and b times Q. In pairing cryptography, an encryption system is constructed using this bilinearity. Here, “k” is referred to as an embedding degree, and “F ^* _p ^k ” represents a multiplicative group obtained by removing the unit element 0 from a finite field (expanded field) having an order p ^k .

The rational point on the elliptic curve is a set of original coordinates (x, y) of the finite field F _q that satisfies the elliptic curve y ² = x ³ + ax + b. This set plus the infinity point O forms an additive group and is represented as E (Fq). That is, if a point symmetric about the x axis of a point where a straight line passing through two rational points P and Q on the elliptic curve intersects the elliptic curve is R, P + Q = R is established. This operation is called ellipse addition. When P and Q are the same point, if R is a point symmetric about the x-axis of the point where the tangent line passing through P intersects with the elliptic curve, P + P = 2P = R is established. This operation is called elliptical multiplication. The grounds for security of pairing encryption and elliptic encryption are based on the difficulty of solving discrete logarithm problems on elliptic curves. Compared to RSA ciphers, etc., where the difficulty of prime factorization is the basis of security, it is possible to achieve the same cipher strength (security strength) with a much shorter key length.

  In the digital group signature, when performing an access right authentication process for an individual user belonging to a group, a pairing operation is performed to exclude an individual user whose access right has expired, and then a predetermined individual user is paired. By performing computation and performing authentication processing, it is possible to flexibly cope with issuance of access rights or change of revocation attribute for each individual user.

  Thus, for example, in the case of a digital group signature of a group consisting of 10,000 individual users, if there are 100 individual users whose access rights have expired, 100 pairing operations are required. Since it takes about 0.1 seconds for one pairing operation by a general electronic computer in 100 meters, it takes about 10 seconds for 100 pairing operations. The number of users was limited, and it was not widely used.

  Therefore, in order to improve the practicality of digital group signature by improving the calculation speed of pairing calculation, for example, the Tate pairing calculation method defined on the elliptic curve is used as the pairing calculation to reduce the calculation load A technique for speeding up the process has been proposed.

  In this way, many encryption schemes using pairing (ID-based encryption, group signature, etc.) have been proposed, but many of them are pairing curves (primary pairing curves with prime orders of 160 bits or more). An efficient elliptic curve) is used. The present inventors have so far applied for the calculation in the extension field, the calculation of the elliptic curve cryptography, and the pairing calculation from the mathematical structure of the foundation. Both of these improve the efficiency of pairing ciphers with prime orders.

  On the other hand, recently, there has been proposed a method using a pairing curve having a composite order of more than 2000 bits with an embedding degree of rational point group of 1 and a new application has also been proposed (for example, Non-Patent Document 1). reference.).

  The conventional techniques for improving the efficiency of pairing ciphers with prime orders are not immediately applicable to the pairing with large composite orders targeted by the present invention. In other words, the pairing curve of the composite order is placed in a special situation such that the embedding degree is 1, and therefore, it has become necessary to propose a new high-speed method considering this. The reason why the embedding order is 1 is that the embedding order is 1 that is most suitable for balancing the strength and efficiency for ensuring the necessary and sufficient encryption strength of the pairing cipher. When the embedding order is increased, the encryption strength is too high, and the efficiency in realizing it is deteriorated.

  In such a pairing encryption or elliptic curve encryption protocol, information on a plurality of rational points is transmitted and received over a network. For example, rational point P and rational point Q are transmitted. If these rational points are sent individually, if the composite order is 2000 bits, the characteristic will be 4000 bits. Considering the x and y coordinates of rational points P and Q, 4 times 16000 bits will be transmitted. It becomes.

  In the electronic authentication system, a large number of user lists are transmitted / received, and the transmission / reception time on the network of the user list including a large number of rational point information is a problem along with the pairing calculation time.

  On the other hand, in the above example, if a rational point R is compressed by adding an ellipse R = P + Q to a pair of rational points P and Q, the original rational points P and Q are transmitted at the destination. If it can be restored, the amount of information to be transmitted is only half of this pair, 8000 bits.

For example, Non-Patent Document 2 and Patent Document 1 are known as rational point compression methods. Patent Document 1 discloses a method of compressing the two rational points on the finite field F _q and the extension field F _q ^k by ellipse addition and restoring the original rational point by projection at the reception destination.

JP 2008-178035 A

D. Boneh, K. Rubin and A. Silverberg, “Finding Composite Order Ordinary Elliptic Curves Using the Cock-Pinch method” Ian F. Blake et al, “Advances in Elliptic Curve Cryptography”

  However, when the embedding degree of the rational point group targeted by the present invention is 1, the rational points P and Q are compressed and the rational point R is transmitted, and the method of decomposing / restoring this at the reception destination is known so far. It was not done.

  In view of the current situation, the present inventors have conducted research and development to efficiently perform rational point information compression, and have achieved the present invention.

In the rational point information compression device of the present invention,
The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In a rational point information compression device comprising a CPU and storage means for transmitting and receiving information on rational point P∈G ₁ and rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
CPU of the rational point information compression device ,
An input means for inputting a rational point P ′ and storing it in the storage means;
Before SL 'reads, the rational point P read' the rational point P from the storage means the identify rational point P and Q using, by endomorphism [psi,
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Rational point subgroup identification means,
Read the rational point P or Q from the storage means, calculate the self-homogeneous map ψ (P) or ψ (Q), and store the rational point of the result in the storage means;
A first computing means for computing a rational point R = P + Q from the rational point P and the rational point Q;
A second computing means for computing a rational point P and a rational point Q from the rational point R;
It was decided to have.

Furthermore, in the rational point information compression device of the present invention,
The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP

In the rational point information compression device of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[2λ ₁ +1] [ψ + λ ₁ +1] R = [− 3] P, Q = RP

Furthermore, in the rational point information compression device of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² −λ ₁ + 1≡0 (mod r), λ ₂ ² −λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[2λ ₁ −1] [ψ + λ ₁ −1] R = [− 3] P, Q = RP

In the rational point information compression method of the present invention,
The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In the information compression method performed by an electronic computer equipped with a CPU and storage means when transmitting and receiving information on the rational point P∈G ₁ and the rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
An input step of causing the CPU of the electronic computer to function as an input means, inputting a rational point P ′ and storing it in the storage means,
The CPU of the electronic computer is caused to function as a rational point subgroup specifying unit, the rational point P ′ is read from the storage unit, the rational points P and Q are specified using the read rational point P ′, and self By the homomorphic map ψ
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Steps,
The CPU of the electronic computer is made to function as a self-homogeneous mapping calculation means, the rational point P or Q is read from the storage means, the self-homogeneous mapping ψ (P) or ψ (Q) is calculated, and the result A self-homogeneous mapping operation step of storing a rational point in the storage means;
A first calculation step of causing the CPU of the electronic computer to function as a first calculation means, and calculating a rational point R = P + Q from the rational point P and the rational point Q;
A second calculation step of calculating the rational point P and the rational point Q from the rational point R by causing the CPU of the electronic computer to function as a second calculation means;
It was decided to have.

Furthermore, in the rational point information compression method of the present invention,
The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
[λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP

Furthermore, in the rational point information compression method of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
[2λ ₁ +1] [ψ + λ ₁ +1] R = [− 3] P, Q = RP

Furthermore, in the rational point information compression method of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
[2λ ₁ −1] [ψ + λ ₁ −1] R = [− 3] P, Q = RP

In the rational point information compression program of the present invention,
The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In the rational point information compression program to be performed by an electronic computer equipped with a CPU and storage means when sending and receiving information on the rational point P∈G ₁ and the rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
Input means for inputting a rational point P ′ to the CPU of the electronic computer and storing it in the storage means;
Read the rational point P ′ from the storage means, identify the rational points P and Q using the read rational point P ′, by the self-homogeneous map ψ,
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Rational point subgroup identification means,
Self-homogeneous mapping calculation means for reading the rational point P or Q from the storage means, calculating the self-homogeneous map ψ (P) or ψ (Q), and storing the resulting rational points in the storage means,
A first computing means for computing a rational point R = P + Q from the rational point P and the rational point Q;
A second computing means for computing a rational point P and a rational point Q from the rational point R;
It was decided to function as.

Furthermore, in the rational point information compression program of the present invention,
The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP

Furthermore, in the rational point information compression program of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[2λ ₁ +1] [ψ + λ ₁ +1] R = [− 3] P, Q = RP

Furthermore, in the rational point information compression program of the present invention,
The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
[2λ ₁ −1] [ψ + λ ₁ −1] R = [− 3] P, Q = RP

  According to the present invention, when transmitting information on rational points P and Q, information on rational points R obtained by performing elliptic addition of rational points P and rational points Q is transmitted, and information on rational points R is decomposed at the receiving destination. Then, the information on the rational points P and Q is restored, and the information amount of the rational points to be transmitted / received can be compressed in half. The calculation required for this decomposition and restoration is approximately one scalar multiplication per rational point pair. As a result, it is possible to improve efficiency when transmitting / receiving rational point information via a network such as the Internet.

1 is a schematic diagram of an information compression apparatus according to an embodiment of the present invention. It is the block diagram which illustrated the whole structure of the information compression apparatus on the client apparatus concerning embodiment of this invention. It is the block diagram which illustrated the whole structure of the information compression device on the authentication server concerning embodiment of this invention. It is the figure which illustrated the functional structure of the rational point subgroup specific | specification part concerning embodiment of this invention. It is the figure which illustrated the functional structure of the rational point information decompression | restoration part concerning embodiment of this invention. It is a flowchart of the rational point information restoration program concerning embodiment of this invention. It is a flowchart of the rational point subgroup specific | specification part program concerning embodiment of this invention.

The pairing curve to which the results of the present invention can be applied must satisfy the following conditions. First, an elliptic curve defined on a finite field F _p of characteristic number p,
E / F _p : y ² = x ³ + ax + b, a∈F _p b∈F _p
E (F _p): additive group of rational points of the elliptic curve defined on a finite field F _p of characteristic p forms,
r: E (F _p) of order #E (F _p) composite number that divides the,
E [r]: set of rational points whose order is the composite number r,
ψ: self-homogeneous mapping for rational points,
t: Trace of Frobenius map,
[j]: Map that multiplies rational points by j,
G: G = E [r] ∩Ker (ψ−λ), defined as a set of rational points satisfying (λ is an integer).
X | y represents that x is divisible by y.

A CM (Complex Multiplication) method is known for generating an elliptic curve. Consider the case of discriminant D = 1, 3 in CM equation such as the following formula by characteristic p, Frobenius self-homogeneous mapping t, discriminant D:
4p = t ² -Ds ² (1)
At this time, the formula of the pairing curve is given as follows.
E _a : y ² = x ³ + ax, a∈F _p (D = 1) (2a)
E _b : y ² = x ³ + b, b∈F _p (D = 3) (2b)
The present inventors have already proposed a simple generation method for generating such a pairing curve for a large synthetic order. In order for the rational point on the pairing curve to have a simple self-homogeneous map ψ (that is, ψ (P) = λP where P is a rational point and λ is an integer), there are parameter conditions. As shown below, there are three cases of the third, fourth, and sixth orders corresponding to the periods 3, 4, and 6 of the self-homogeneous mapping. This self-homogeneous map is used for scalar multiplication and pairing, and in the present invention, this self-homomorphic map is used for compression and decompression of rational point information. The parameter conditions and their mapping are shown below.

このような合成数ｒを位数として持つ有理点をP∈E(F_p)[r]とすれば、3次の場合、[λ₃]P=ψ₃(P)の関係を用いることで後述の有理点情報圧縮の効率化を図っている。<3rd case>
If the elliptic curve parameters are 3 | (p-1), E: y ² = x ³ + b, b∈F _p , D = 3,
For a composite number r that satisfies r | #E (F _p ), 3 | (r−1), there is an integer λ ₃ that satisfies the following equation.
λ ₃ ² + λ ₃ + 1≡0 (mod r) (3)
Further, a self-homogeneous map ψ ₃ having a period 3 shown below is given.

If a rational point having such a composite number r as an order is P∈E (F _p ) [r], then in the third order, the relation [λ ₃ ] P = ψ ₃ (P) is used. The rational point information compression described later is made more efficient.

However, when the embedding degree of the rational point group is 1, [λ ₃ ] P ′ = ψ ₃ (P ′) does not hold for the general rational point P′∈E (F _p ) [r]. As described above, the proportion of rational points satisfying this is ^{1 / r = 1/2 2000} , there is a need to be able to prepare easily such rational points and rational points subgroup.

In the present invention, the following properties discovered by the present inventors are used.
First, an arbitrary rational point P′∈E (F _p ) [r] satisfies the following expression.
[(ψ ₃ -λ ₃ ) (ψ ₃ + λ ₃ +1)] P '= O (5)
Here, O indicates a point at infinity. The same applies to the following description.
That is, rationally generated rational point P′∈E (F _p ) [r] is multiplied by (ψ ₃ + λ ₃ +1),
P = [ψ ₃ + λ ₃ +1] P '(6)
Thus, the rational point P satisfies [λ ₃ ] P = ψ ₃ (P). Then, let G ₁ be a rational point subgroup generated by such P. Conversely,
Q = [ψ ₃ -λ ₃ ] P '(7)
Then, the rational point Q that satisfies [λ ₃ +1] Q = −ψ ₃ (Q) is obtained. Then, let G ₂ be a rational point subgroup generated by such Q. Using these G ₁ and G ₂ , compression / decompression of rational point information described later can be realized.

<Explanation of relational derivation method>
Derivation of equation (5) in the third-order case will be described below.
First, it is known that an arbitrary rational point P′∈E (F _p ) [r] satisfies the following equation using the F tévenius map trace t and Frobenius map φ of E (F _p ).
φ: (x, y) → (x ^p , y ^p )
(φ ² -tφ + [p]) P '= O (8)
Similarly, given mapping the rational point P ~ in 'the E (F _p) and isomorphic extension fields on twisted curve E which encloses the group' (F _p ³⁾ _P, Frobenius mapping E '(F _p) The following equation is satisfied with t ′ as the trace.
(φ ² -t'φ + [p]) P ~ = O (9)
Here, the twist curve is given by E ′: y ² = x ³ + bv ⁻² , b∈F _p , v is a cube non-residue element of F _p , and P˜ is P ′ = ( x, y) is given below.
P ~ = (xv ^2/3 , yv) (10)
Here, if the above equation is mapped ψ: P′εE (F _p ) → P˜εE ′ (F _p ³ ), equation (9) can be transformed as the following equation.
{(Ψ ^-1 φ ² ψ) -t '(ψ ^-1 φψ) + [p]} P' = O (11)
In this case, ψ ^-1 φψ = ψ ₃ holds, so the following equation is obtained.
(ψ ₃ ² -t'ψ ₃ + [p]) P '= O (12)
For the above equation, p≡1 (mod r) because the embedding degree of the rational point group is 1, and the elliptic curve used for this is t'≡-1 (3rd order), 0 (4th order) ), 1 (6th order) (mod r) so that P′∈E (F _p ) [r] (the rational point of order r) Get the formula.
(ψ ₃ ² + ψ ₃ + [1]) P '= O (13)
On the other hand, in the third-order case, there is an integer λ ₃ that satisfies Equation (3), that is, ψ ₃ ² + ψ ₃ + 1≡0 (mod r) and ψ ₃ as a variable If you think about it, one of the solutions is ψ ₃ . Therefore, a factored relational expression such as Expression (5) is obtained.

このような合成数ｒを位数として持つ有理点をP∈E(F_p)[r]とすれば、４次の場合、[λ₄]P=ψ₄(P)の関係を用いることで後述の有理点情報圧縮の効率化を図っている。<4th case>
Similarly, if the elliptic curve parameters are 4 | (p-1), E: y ² = x ³ + ax, a∈F _p , D = 1,
For a composite number r that satisfies r | #E (F _p ), 4 | (r−1), there is an integer λ ₄ that satisfies the following equation.
λ ₄ ² + 1≡0 (mod r) (14)
Further, a self-homogeneous map ψ ₄ having a period 4 shown below is given.

If a rational point having such a composite number r as an order is P∈E (F _p ) [r], then in the fourth order, the relation [λ ₄ ] P = ψ ₄ (P) is used. The rational point information compression described later is made more efficient.

In the present invention, the following properties discovered by the present inventors are used.
First, an arbitrary rational point P′∈E (F _p ) [r] satisfies the following expression.
[(ψ ₄ -λ ₄ ) (ψ ₄ + λ ₄ )] P '= O (16)
That is, rationally generated rational point P′∈E (F _p ) [r] is multiplied by (ψ ₄ + λ ₄ ),
P = [ψ ₄ + λ ₄ ] P '(17)
Thus, the rational point P satisfies [λ ₄ ] P = ψ ₄ (P). Then, let G ₁ be a rational point subgroup generated by such P. Conversely,
Q = [ψ ₄ -λ ₄ ] P '(18)
Then, the rational point Q that satisfies [λ ₄ ] Q = −ψ ₄ (Q) is obtained. Then, let G ₂ be a rational point subgroup generated by such Q. Using these G ₁ and G ₂ , compression / decompression of rational point information described later can be realized.

  The derivation of Equation (16) in the fourth order is the same as in the third order, and the description thereof is omitted.

このような位数ｒを持つ有理点をP∈E(F_p)[r]とし、6次の場合、[λ₆]P=ψ₆(P)の関係を用いることで後述の有理点情報圧縮の効率化を図っている。<In case of 6th order>
Similarly, if the elliptic curve parameters are 6 | (p-1), E: y ² = x ³ + b, b∈F _p , D = 3,
For a composite number r that satisfies r | #E (F _p ), 3 | (r−1), there exists λ ₆ that satisfies the following expression.
λ ₆ ² -λ ₆ + 1≡0 (mod r) (19)
Further, a self-homogeneous map ψ ₆ having a period 6 shown below is given.

A rational point having such an order r is set as P∈E (F _p ) [r], and in the case of the sixth order, the rational point information described later is used by using the relation [λ ₆ ] P = ψ ₆ (P). We are trying to improve the efficiency of compression.

In the present invention, the following properties discovered by the present inventors are used.
First, an arbitrary rational point P′∈E (F _p ) [r] satisfies the following expression.
[(ψ ₆ -λ ₆ ) (ψ ₆ + λ ₆ -1)] P '= O (22)
That is, the randomly generated rational point P′∈E (F _p ) [r] is multiplied by (ψ ₆ + λ ₆ −1),
P = [ψ ₆ + λ ₆ -1] P '(23)
Thus, the rational point P satisfies [λ ₆ ] P = ψ ₆ (P). Then, let G ₁ be a rational point subgroup generated by such P. Conversely,
Q = [ψ ₆ -λ ₆ ] P '(24)
Then, the rational point Q that satisfies [λ ₆ −1] Q = −ψ ₆ (Q) is obtained. Then, let G ₂ be a rational point subgroup generated by such Q. Using these G ₁ and G ₂ , compression / decompression of rational point information described later can be realized.

  The derivation of Equation (22) in the sixth order is also the same as in the third order, and the description is omitted.

In the rational point information compression apparatus, compression method, and compression program of the present invention, when the embedding degree of the rational point group is 1, the rational point subgroups G ₁ and G ₂ are specified, and the two rational points P∈G ₁ , GεG ₂ is transmitted, and rational points R, which are compressed by elliptically adding rational points P and Q, are transmitted. Decomposition / restoration into original rational point information P and Q at the reception destination is performed using the above-described characteristics of G ₁ and G ₂ . In the following, the fourth, third, and sixth orders will be described. In both cases, rational point information can be decomposed and restored with a single scalar multiplication.

<4th case>
First, rational points P and Q satisfy the following equation.
[λ ₄ ] P = ψ ₄ (P), [λ ₄ ] Q = -ψ ₄ (Q) (25)
In other words, the following expressions are satisfied respectively.
[ψ ₄ -λ ₄ ] P = O, [ψ ₄ + λ ₄ ] Q = O (26)
Therefore, for example, if [ψ ₄ + λ ₄ ] multiplication is performed on the received data R = P + Q,
[ψ ₄ + λ ₄ ] R = [ψ ₄ + λ ₄ ] (P + Q)
= [ψ ₄ + λ ₄ ] P + [ψ ₄ + λ ₄ ] Q
= [ψ ₄ + λ ₄ ] P + O
= ψ ₄ (P) + [λ ₄ ] P
= [λ ₄ ] P + [λ ₄ ] P
= 2 [λ ₄ ] P
If both sides are multiplied by λ ₄ and r = λ ₄ ² + 1≡0 is applied, the following equation is obtained.
[λ ₄ ] [ψ ₄ + λ ₄ ] R = 2 [λ ₄ ² ] P = [-2] P
If this is multiplied by [−2 ⁻¹ mod r], P can be obtained. Q can be obtained by Q = RP. As described above, since the data can be decomposed and restored with a calculation amount of about one scalar multiplication, it is possible to improve the efficiency of transmitting data after compressing information.

<3rd case>
First, rational points P and Q satisfy the following equation.
[λ ₃ ] P = ψ ₃ (P), [λ ₃ +1] Q = -ψ ₃ (Q) (27)
In other words, the following expressions are satisfied respectively.
[ψ ₃ -λ ₃ ] P = O, [ψ ₃ + λ ₃ +1] Q = O (28)
Therefore, for example, if [ψ ₃ + λ ₃ +1] multiplication is performed on the received data R = P + Q,
[ψ ₃ + λ ₃ +1] R = [ψ ₃ + λ ₃ +1] (P + Q)
= [ψ ₃ + λ ₃ +1] P + [ψ ₃ + λ ₃ +1] Q
= [ψ ₃ + λ ₃ +1] P + O
= ψ ₃ (P) + [λ ₃ ] P + P
= [2λ ₃ +1] P
If both sides are multiplied by [2λ ₃ +1] and r = λ ₃ ² + λ ₃ + 1≡0 is applied, the following equation is obtained.
[2λ ₃ +1] [ψ ₃ + λ ₃ +1] R = [2λ ₃ +1] ² P
= [4λ ₃ ² + 4λ ₃ +1] P
= [-3] P (29)
If this is multiplied by [−3 ⁻¹ mod r], P can be obtained. Q can be obtained by Q = RP. As described above, since the data can be decomposed and restored with a calculation amount of about one scalar multiplication, it is possible to improve the efficiency of transmitting data after compressing information.

<6th case>
First, rational points P and Q satisfy the following equation.
[λ ₆ ] P = ψ ₆ (P), [λ ₆ -1] Q = -ψ ₆ (Q) (30)
In other words, the following expressions are satisfied respectively.
[ψ ₆ -λ ₆ ] P = O, [ψ ₆ + λ ₆ -1] Q = O (31)
Therefore, for example, if [ψ ₆ + λ ₆ −1] multiplication is performed on the received data R = P + Q,
[ψ ₆ + λ ₆ -1] R = [ψ ₆ + λ ₆ -1] (P + Q)
= [ψ ₆ + λ ₆ -1] P + [ψ ₆ + λ ₆ -1] Q
= [ψ ₆ + λ ₆ -1] P + O
= ψ ₆ (P) + [λ ₆ ] PP
= [2λ ₆ -1] P (32)
If both sides are multiplied by [2λ ₆ -1] and r = λ ₆ ² -λ ₆ + 1≡0 is applied, the following equation is obtained.
[2λ ₆ -1] [ψ ₆ + λ ₆ -1] R = [2λ ₆ -1] ² P
= [4λ ₆ ² -4λ ₆ +1] P
= [-3] P (33)
If this is multiplied by [−3 ⁻¹ mod r], P can be obtained. Q can be obtained by Q = RP. As described above, since the data can be decomposed and restored with a calculation amount of about one scalar multiplication, it is possible to improve the efficiency of transmitting data after compressing information.

As described above, 2 ^-1 multiplication is required in the fourth order, and 3 ^-1 multiplication is required in the third and sixth orders. These scalar multiplications can be obtained more efficiently than ordinary scalar multiplication.

<2 ^-1 multiplication>
First, paying attention to r = λ ₄ ² +1, 2 ⁻¹ mod r can be obtained by the following equation. Note that λ ₄ is an even integer.
2 ^-1 = (r + 1) / 2
= (λ ₄ ² +2) / 2
_{= λ 4 · (λ 4/} 2) +1
That is, the 2 ⁻¹ multiplication for the rational point T is as follows.
^{[2 -1] T = [λ} 4 · (λ 4/2) +1] T
_{= ψ 4 ([λ 4/} 2] T) + T
That, in effect, obtained by the calculation amount of about lambda _4/2, which is computationally expensive because about half the bit size of r is half the normal scalar multiplication.

<3 ^-1 multiplication>
The 3 ^-1 multiplication in the third-order case can be obtained as follows, paying attention to r = λ ₃ ² + λ ₃ +1.
3 ^-1 = (2r + 1) / 3
= (2λ ₃ ² + 2λ ₃ +3) / 3
= (2λ ₃ (λ ₃ +1) +3) / 3
= λ ₃・ 2 (λ ₃ +1) / 3 + 1
However, in this case, it is a condition that λ ₃ +1 is a multiple of 3.
That is, 3 ^-1 multiplication for the rational point T is as follows.
[3 ^-1 ] T = [λ ₃・ 2 (λ ₃ +1) / 3 + 1] T
= ψ ₃ ([2 (λ ₃ +1) / 3] T) + T
In other words, the calculation amount is about λ ₃ · 2/3, which is about half of the bit size of r, so that the calculation cost is half of the normal scalar multiplication.

The 3 ^-1 multiplication in the 6th order can be obtained as follows, paying attention to r = λ ₆ ² -λ ₆ +1.
3 ^-1 = (2r + 1) / 3
= (2λ ₆ ² -2λ ₆ +3) / 3
= (2λ ₆ (λ ₆ -1) +3) / 3
= λ ₆・ 2 (λ ₆ -1) / 3 + 1
However, in this case, λ ₆ -1 is a condition that is a multiple of 3.
That is, 3 ^-1 multiplication for the rational point T is as follows.
[3 ^-1 ] T = [λ ₆・ 2 (λ ₆ -1) / 3 + 1] T
= ψ ₆ ([2 (λ ₆ -1) / 3] T) + T
In other words, the calculation amount is about λ ₆ · 2/3, which is about half of the bit size of r, so that the calculation cost is half of the normal scalar multiplication.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic diagram of a rational point information compression apparatus according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating the overall configuration of the rational point information compression device 100 on the client device according to the embodiment of the present invention.
FIG. 3 is a block diagram illustrating the overall configuration of the rational point information compression apparatus 200 on the authentication server according to the embodiment of the present invention.
First, the entirety of this embodiment will be described with reference to FIGS. 1, 2, and 3, and then the details will be described.
In the present embodiment, a program for identifying the above-described rational point subgroup from a given pairing curve when performing authentication processing of a digital group signature by an authentication server and a client device configured with a required electronic computer, Only the program portion for restoring rational point information will be described. The calculation of the rational point subgroup and the calculation of rational point information restoration are not limited to the case where the calculation is performed by the authentication server or the client device, but at least a device including a calculation unit such as a CPU and a storage unit. Any device can be used.

  As shown in FIG. 1, an electronic computer 10 constituting an authentication server or client device includes a CPU 11 that executes arithmetic processing, various programs such as a rational point subgroup specifying program, a rational point information restoring program, a pairing arithmetic program, and the like. A storage device 12 such as a hard disk that stores data used in these programs, and a RAM that allows these programs to be expanded and executed, and temporarily stores data generated as a result of the execution of these programs And a memory device 13 composed of the above. In FIG. 1, 14 is a bus.

  The electronic computer 10 constituting the authentication server is connected to a telecommunication line 20 such as the Internet, and can receive the signature data of the digital group signature transmitted from the client device 30 connected to the telecommunication line 20. . In FIG. 1, 15 is an input / output unit of the electronic computer 10.

FIG. 2 shows the rational point information compression apparatus 100 on the client apparatus. As shown in FIG. 2, the rational point information compression apparatus 100 includes a rational point subgroup specifying unit 110, an authentication data generation unit 120, a rational point information compression unit 130, and an input / output unit 140.
First, a client device that generates digital group signature data (authentication data) specifies rational point subgroups G ₁ and G ₂ from a given pairing curve (rational point subgroup specifying unit 110). Next, signature data is generated (authentication data generation unit 120), and a pair of rational points P∈G ₁ and Q∈G ₂ constituting the signature data is elliptically added to compress to rational point R (rational point information compression) Part 130). After all pairs are compressed, the signature data is transmitted from the input / output unit 140 to the authentication server.

FIG. 3 shows a rational point information compression apparatus 200 on the authentication server. As shown in FIG. 3, the rational point information compression apparatus 200 includes an input / output unit 210, a rational point information restoration unit 220, an authentication processing unit 230, an authentication result data generation unit 240, a rational point information compression unit 250, And an input / output unit 260.
In the electronic computer 10 constituting the authentication server, when the signature data of the digital group signature is transmitted from the client device 30, the signature data is received via the input / output unit 210, and the received signature data is temporarily stored in the memory device 13. After memorizing and starting the rational point information restoration program to restore the original rational point pair information (rational point information restoration unit 220), the pairing computation program is launched to execute the pairing computation (Authentication processing unit 230).
After that, authentication result data is generated (authentication result data generation unit 240), rational point pair information is compressed (rational point information compression unit 250), and transmitted to the client device via the input / output unit 260. ing.

Next, details of the present embodiment will be described with reference to the drawings.
<Identification of rational point subgroup>

FIG. 4 is a diagram exemplifying a functional configuration of the rational point subgroup specifying unit 110 realized by executing a predetermined program by the apparatus shown in FIG.
FIG. 7 is a flowchart of a rational point subgroup specifying program that performs processing of the rational point subgroup specifying unit.
In the electronic computer 10, a rational point subgroup that enables efficient self-homogeneous mapping is specified based on the flowchart shown in FIG. That is, a general rational point whose rational point group is embedded degree 1 is converted into a rational point in a specific rational point subgroup. In this case, the electronic computer 10 functions as rational point subgroup specifying means. Hereinafter, the third case will be described.

In step T1 (rational point input unit 111), a general rational point P ′ given from the outside and stored in the storage means by the input means is read.
In step T2 (constant operation unit 112), λ ² + λ + 1≡0 (mod r) shown in Expression (3) is obtained by using the characteristic p and finite number r of the finite field stored in the register 119 in advance. And ε (≠ 1) that satisfies ε ³ ≡1 (mod p) shown in Expression (4b) are set.
In step T3 (self-homogeneous mapping operation unit 113), ψ (P ′): (x, y) → (εx, y) in equation (4b) is multiplied by ε times the x coordinate value of P ′, and ψ Seeking (P ').
In step T4 (rational point calculation unit 114), P = ψ (P ′) + (λ + 1) P ′ in equation (6) is calculated.
In step T5 (determination unit 115), it is determined whether or not P = O (point at infinity).
For P = O, 2 two can not identify the subgroup are error return (probability is about 1/2 ^2000.).
In step T6 (rational point calculation unit 114), Q = ψ (P ′) + (− λ) P ′ in equation (7) is calculated.
In step T7 (determination unit 115), it is determined whether or not Q = O (point at infinity).
Q = is the error return can not identify the two subgroups in the case of O (probability is about 1/2 ^2000.).
In step T8, P and Q are stored in the storage means. The set of P becomes the rational point subgroup G ₁ and the set of Q becomes the rational point subgroup G ₂ .

In the present embodiment, the third-order case has been described, but in the fourth-order and sixth-order cases, λ, ψ (P ′), ε or ζ, P, Q are respectively
In the fourth order, equation (14): λ ² + 1≡0 (mod r),
Formula (15b): ψ (P ′) :( x, y) → (−x, ζy), (ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ),
Equation (17): P = ψ (P ′) + λP ′,
Expression (18): Q = ψ (P ′) + (− λ) P ′
And
In the 6th order, Equation (19): λ ² -λ + 1≡0 (mod r),
Equation (20b): ψ (P ') :( x, y) → (εx, -y), (ε ³ = 1, ε (≠ 1) εF _p ),
Formula (23): P = ψ (P ′) + (λ−1) P ′,
Formula (24): Q = ψ (P ′) + (− λ) P ′
Similarly, the rational point subgroup can be specified in the same manner (the description is omitted).

<Compression of rational point information>
The rational points P∈G ₁ and Q∈G ₂ are compressed by elliptically adding these rational points to a rational point R. As a result, the data length of the rational point is halved.

<Restoring rational point information>
FIG. 5 is a diagram exemplifying a functional configuration of the rational point information restoration unit 220 that is realized by executing a predetermined program by the apparatus shown in FIG.
FIG. 6 is a flowchart of a rational point restoration program that performs the processing of the rational point information restoration unit (fourth case).
In the electronic computer 10, the rational points P and Q are obtained from the rational point R based on the flowchart shown in FIG. In this case, the electronic computer 10 functions as a second calculation means. Hereinafter, the fourth-order case will be described.

First, the rational point R is input and stored in the memory means 13. (Step S1, parameter input unit 221)
next,
T ₁ = [λ ₄ ] [ψ ₄ + λ ₄ ] R
Calculate (Step S2, register 229, constant operation unit 222, self-homogeneous mapping operation unit 224)
next,
P =-[2 ^-1 ] T ₁
Calculate (Step S3,2 ^-1 calculation section 223, rational point arithmetic unit 225)
next,
Q = RP
Calculate (Step S4, rational point calculation unit 225)

Specifically, the 2 ^-1 multiplication performs the following algorithm.
[Table 1] 2 ^-1 multiplication algorithm input for 4th order: λ ₄ , T ₁ ∈ G ₁
Output: [2 ^-1 ] T <sub>1
1. T ← [λ 4/2</sub> ] T 1
2. T ← ψ ₄ (T) + T ₁
3. Return T
That is, in step 1, perform the [λ _4/2] multiplication of rational points T _1, is substituted into T. In step 2, the self-homogeneous mapping ψ ₄ of T obtained in step 1 is executed, and a rational point T ₁ is added and substituted into T. In step 3, the return value is T and the process returns.

To restore rational points in the fourth order, specifically, the following algorithm is executed.
[Table 2] Fourth-order rational point restoration algorithm input: λ ₄ , R = P + Q, P∈G ₁ , Q∈G ₂
Output: P, Q
1. T ₁ ← ψ ₄ (R)
2. T ₁ ← [λ ₄ ] T ₁ -R
3. P ←-[2 ^-1 ] T ₁
4. Q ← RP
5. Return P, Q
That is, in step 1, the automorphism map ψ ₄ of the rational point R is executed and assigned to T ₁ . In Step 2, [λ ₄ ] multiplication of the rational point T ₁ is executed, and then -R is elliptically added and substituted for T ₁ . In step 3, the algorithm of [Table 1] is executed to obtain P with a minus sign. In step 4, R and -P are elliptically added to obtain Q. In step 5, P and Q are returned as return values.

Next, the third case will be described.
Specifically, the 3 ^-1 multiplication in the third case executes the following algorithm.
[Table 3] 3 ^-1 multiplication algorithm input in case of third order: λ ₃ , T ₁ ∈G ₁
Output: [3 ^-1 ] T ₁
1. T ← [2 (λ ₃ +1) / 3] T ₁
2. T ← ψ ₃ (T) + T ₁
3. Return T
That is, in step 1, [2 (λ ₃ +1) / 3] multiplication of the rational point T ₁ is executed and substituted for T. In step 2, the T automorphism map ψ ₃ obtained in step 1 is executed, and a rational point T ₁ is added and substituted into T. In step 3, the return value is T and the process returns.

To restore rational points in the third-order case, the following algorithm is specifically executed.
[Table 4] Rational point restoration algorithm input in case of third order: λ ₃ , R = P + Q, P∈G ₁ , Q∈G ₂
Output: P, Q
1. T ₁ ← ψ ₃ (R)
2. T ₂ ← 2T ₁ + R
3. T ₂ ← [λ ₃ ] T ₂
4. T ₁ ← T ₂ + T ₁ -R
5. P ←-[3 ^-1 ] T ₁
6. Q ← RP
7. Return P, Q
That is, in step 1, the automorphism map ψ ₃ of the rational point R is performed and substituted for T ₁ . In step 2, the rational point T ₁ is doubled, and then R is elliptically added and substituted for T ₂ . In step 3, the rational point T ₂ is multiplied by [λ ₃ ] and assigned to T ₂ . In Step 4, T ₂ , T ₁ , -R are elliptically added and substituted for T ₁ . In step 5, the algorithm shown in [Table 3] is executed to obtain P with a minus sign. In step 6, R and -P are elliptically added to obtain Q. In step 7, P and Q are returned as return values.

Next, the sixth case will be described.
Specifically, the 3 ^-1 multiplication in the sixth order executes the following algorithm.
[Table 5] 3 ^-1 multiplication algorithm input in case of 6th order: λ ₆ , T ₁ ∈G ₁
Output: [3 ^-1 ] T ₁
1. T ← [2 (λ ₆ -1) / 3] T ₁
2. T ← ψ ₆ (T) + T ₁
3. Return T
That is, in step 1, [2 (λ ₆ −1) / 3] multiplication of the rational point T ₁ is executed and substituted for T. In step 2, the self-homogeneous map ψ ₆ of T obtained in step 1 is executed, and a rational point T ₁ is added and substituted into T. In step 3, the return value is T and the process returns.

To restore rational points in the sixth order, specifically, the following algorithm is executed.
[Table 6] Rational point restoration algorithm input for the 6th order: λ ₆ , R = P + Q, P∈G ₁ , Q∈G ₂
Output: P, Q
1. T ₁ ← ψ ₆ (R)
2. T ₂ ← 2T ₁ -R
3. T ₂ ← [λ ₆ ] T ₂
4. T ₁ ← T ₂ -T ₁ -R
5. P ←-[3 ^-1 ] T ₁
6. Q ← RP
7. Return P, Q
That is, in step 1, the automorphism map ψ ₆ of the rational point R is executed and substituted for T ₁ . In step 2, the rational point T ₁ is doubled, and then -R is elliptically added and substituted for T ₂ . In step 3, the rational point T ₂ is multiplied by [λ ₆ ] and substituted into T ₂ . In step 4, T ₂ , -T ₁ , -R are elliptically added and substituted for T ₁ . In step 5, the algorithm of [Table 5] is executed to obtain P with a minus sign. In step 6, R and -P are elliptically added to obtain Q. In step 7, P and Q are returned as return values.

10 Electronic calculator
11 CPU
12 Storage device
13 Memory device
14 Bus
15 Input / output section
20 Telecommunications line
30 client devices
100 Rational point information compressor
110 Rational point subgroup identification part
111 Rational point input part
112 Constant operation part
113 Auto-homogeneous mapping operation unit
114 Rational point calculator
115 Judgment part
119 registers
120 Authentication data generator
130 Rational point information compression part
140 I / O section
200 Rational point information compressor
210 Input / output section
220 Rational point information restoration part
221 Parameter input section
222 Constant operation part
223 2 ^-1 arithmetic unit
224 Self-Homomorphic Map Operation Unit
225 Rational point calculator
229 registers
230 Authentication processing section
240 Authentication result data generator
250 Rational point information compression part
260 I / O section

Claims (12)

The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In a rational point information compression device comprising a CPU and storage means for transmitting and receiving information on rational point P∈G ₁ and rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
CPU of the rational point information compression device ,
An input means for inputting a rational point P ′ and storing it in the storage means;
Before SL 'reads, the rational point P read' the rational point P from the storage means the identify rational point P and Q using, by endomorphism [psi,
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Rational point subgroup identification means,
Reading the rational point P or Q from the storage means, calculating the self-homogeneous map ψ (P) or ψ (Q), and storing the rational point of the result in the storage means;
A first computing means for computing a rational point R = P + Q from the rational point P and the rational point Q;
A second computing means for computing a rational point P and a rational point Q from the rational point R;
Rational point information compression apparatus having The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compression apparatus according to claim 1, which is performed using [λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compression apparatus according to claim 1, wherein [2λ ₁ +1] [ψ + λ ₁ +1] R = [-3] P, Q = RP is used. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² −λ ₁ + 1≡0 (mod r), λ ₂ ² −λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compressing apparatus according to claim 1, wherein [2λ ₁ -1] [ψ + λ ₁ -1] R = [-3] P, Q = RP is used. The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In the information compression method performed by an electronic computer equipped with a CPU and storage means when transmitting and receiving information on the rational point P∈G ₁ and the rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
An input step of causing the CPU of the electronic computer to function as an input means, inputting a rational point P ′ and storing it in the storage means,
The CPU of the electronic computer is caused to function as a rational point subgroup specifying unit, the rational point P ′ is read from the storage unit, the rational points P and Q are specified using the read rational point P ′, and self By the homomorphic map ψ
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Steps,
The CPU of the electronic computer is made to function as a self-homogeneous mapping calculation means, the rational point P or Q is read from the storage means, the self-homogeneous mapping ψ (P) or ψ (Q) is calculated, and the result A self-homogeneous mapping operation step of storing a rational point in the storage means;
A first calculation step of causing the CPU of the electronic computer to function as a first calculation means, and calculating a rational point R = P + Q from the rational point P and the rational point Q;
A second calculation step of calculating the rational point P and the rational point Q from the rational point R by causing the CPU of the electronic computer to function as a second calculation means;
A rational point information compression method comprising: The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
6. The rational point information compression method according to claim 5, which is performed using [λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
6. The rational point information compression method according to claim 5, which is performed using [2λ ₁ +1] [ψ + λ ₁ +1] R = [− 3] P, Q = RP. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation step calculates the rational point P and the rational point Q, respectively.
The rational point information compression method according to claim 5, which is performed using [2λ ₁ -1] [ψ + λ ₁ -1] R = [-3] P, Q = RP. The additive group formed by the rational points on an elliptic curve defined on a finite field F _p of characteristic p and E (F _p), a set i.e. subgroup of the additive group of rational points with synthetic number digit numbers r G ₁ = E (F _p ) [r], G ₂ = E (F _p ) [r]
In the rational point information compression program to be performed by an electronic computer equipped with a CPU and storage means when sending and receiving information on the rational point P∈G ₁ and the rational point Q∈G ₂ ,
The additive group E (F _p ) has an embedding degree of 1,
Input means for inputting a rational point P ′ to the CPU of the electronic computer and storing it in the storage means;
Read the rational point P ′ from the storage means, identify the rational points P and Q using the read rational point P ′, by the self-homogeneous map ψ,
Identify the subgroups G ₁ and G ₂ that are sets of the rational points P and Q that satisfy λ ₁ P = ψ (P), λ ₂ Q = ψ (Q) (λ ₁ ≠ λ ₂ is an integer) Rational point subgroup identification means,
Self-homogeneous mapping calculation means for reading the rational point P or Q from the storage means, calculating the self-homogeneous map ψ (P) or ψ (Q), and storing the resulting rational points in the storage means,
A first computing means for computing a rational point R = P + Q from the rational point P and the rational point Q;
A second computing means for computing a rational point P and a rational point Q from the rational point R;
Rational point information compression program to function as. The elliptic curve is E: y ² = x ³ + ax, a∈F _p , 4 | (p-1)
The composite order r satisfies r | #E (F _p ), 4 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + 1≡0 (mod r), λ ₂ ² + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (-x, ζy), ζ ⁴ = 1, ζ, ζ ² (≠ 1) ∈F _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ ) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compression program according to claim 9, which is performed using [λ ₁ ] [ψ + λ ₁ ] R = [− 2] P, Q = RP. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 3 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ +1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compression program according to claim 9, which is performed using [2λ ₁ +1] [ψ + λ ₁ +1] R = [− 3] P, Q = RP. The elliptic curve is E: y ² = x ³ + b, b∈F _p , 6 | (p-1)
The composite order r satisfies r | #E (F _p ), 3 | (r-1),
The integers λ ₁ and λ ₂ satisfy λ ₁ ² + λ ₁ + 1≡0 (mod r), λ ₂ ² + λ ₂ + 1≡0 (mod r),
The automorphism map is ψ: E (F _p ) [r] → E (F _p ) [r],
(x, y) → (εx, -y), ε ³ = 1, ε (≠ 1) εF _p ,
The rational point P and the rational point Q are P = (ψ + λ ₁ −1) P ′ and Q = (ψ−λ ₁ ) P ′, respectively.
The second calculation means calculates the rational point P and the rational point Q, respectively.
The rational point information compression program according to claim 9, which is performed using [2λ ₁ -1] [ψ + λ ₁ -1] R = [-3] P, Q = RP.

Images