JPH06110386A - Signature, certification, and secret communication system using elliptical curve - Google Patents

Abstract

PURPOSE:To obtain a signature/certification/secret communication system using an elliptical curve capable of reducing data amount and computing amount compared with a conventional system. CONSTITUTION:A positive integer (d) is taken so as to decrease the class number of an imaginary quadratic field Q((-d)<1/2>). A prime number (p) is taken to be representable by p=db<2>+db+(d+1)/4. An elliptical curve E on a finite field GF (p) and a base are taken. A cryptographic system based on a discrete logarithmic problem can be comprised by using such elliptical curve and base point.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic technique as an information security technique, and more particularly to a signature, authentication and secret communication system realized by using an elliptic curve.

[0002]

2. Description of the Related Art A secret communication system is a system in which communication is carried out without leaking the contents of communication to anyone other than a specific communication partner.
The signature and authentication method is a communication method that shows the validity of the communication content to the communication partner or proves the identity of the person. This signature, authentication and secret communication system includes a communication system called public key cryptography. Public key cryptography is a method for easily managing a different encryption key for each communication partner when there are many communication partners, and is an essential basic technology for communicating with an unspecified number of communication partners. Briefly, this is a method in which the encryption key and the decryption key are different, and the decryption key is kept secret, but the encryption key is disclosed. Usually, the difficulty of the discrete logarithm problem on a finite field is used as the basis for the security of this public key cryptography. [Discrete logarithm problem on finite field] Let q be a prime power, and GF
Let (q) be a finite field, and the element g that divides the order of GF (q) by a large prime number be the base point. In this case, find the x the original y that given GF (q), if the integer x such that y = g ^x exists.

The above discrete logarithm problem on a finite field has been studied for a long time, and as a result, many attempts have been made to solve the problem, and the time taken for the solution is gradually shortened (in this regard, published by the Institute of Electronics, Communication and Communication). Nobuichi Ikeno and Kenji Koyama in "Modern Cryptography". Therefore,
In recent years, it has been proposed to use elliptic curves as an alternative to finite fields (this is written by Neil Kobritz, "Acous in Namba Theory and Cryptgrahy" (N
eal koblitz, "A Course in Number Theoryand Crypt
"ography", Springer-Verlag, 1987).) The proposed discrete logarithm problem on elliptic curves is described below.

[Discrete logarithm problem of elliptic curve] Let q be a prime power, GF (q) be a finite field, and let E (GF (q)) be the group generated by the elements of GF (q) of the elliptic curve E. And E (GF (q))
The base point is an element P whose order is divided by a large prime number. At this time, for an element Q given E (GF (q)), if there is an integer x such that Q = xP, find x.

Since the discrete logarithm problem on the elliptic curve described above does not have a solution that gives a sub-exponential algorithm, if it is as safe as the discrete logarithm problem on a finite field, it can be constructed with a much smaller definition field. Therefore, as an alternative to the discrete logarithm problem on the finite field, the application research to the signature, the authentication and the secret communication system including the public key cryptography was conducted. However, in 1991, a solution method was devised that reduced the discrete logarithm problem on an elliptic curve to the discrete logarithm problem on a finite field. This is A Menezes, S. Vernstone and Andy Okamoto, "Reducing Elliptic Curve Logarithm Tologarim in a Fine Nightfield" (A.Men
ezes, S.Vanstone and T.Okamoto, "Reducing Elliptic C
urve Logarithm to Logarithms in a Finite Field ", ST
OC 91)). What is MOV reduction method?
Let q be a prime power, E be an elliptic curve defined on a finite field GF (q), and E be a group consisting of elements of E on GF (q).
(GF (q)). At this time, the discrete logarithm problem on the elliptic curve based on E (GF (q)) ∋P is that the extension field GF of a finite field GF (q) when the order of P and q are relatively prime.
It can be solved by reducing it to the discrete logarithm problem on (q ^r ).
In particular, when E is an elliptic curve called supersingular, it can be solved by reducing it to a discrete logarithm problem on a finite field GF (q) at most 6th order extension field GF (q ⁶ ), so it has been conventionally considered. In addition, sufficient security cannot be maintained in the discrete logarithm problem on the supersingular elliptic curve having a size of about 97 bits.

Therefore, studies have been conducted to construct an elliptic curve so as to avoid the MOV reduction method of the above solution. There are many ways to do this, for example, Beth and Chaefer, "Non-Super Cingular Elliptic Curve for Public Key Crypto Systems".
(T.Beth, F.Schaefer "Non Supersingular Elliptic Cu
rves for Public Key Cryptosystems ", Eurocrypt 91,19
91), or “On Ordinary Elliptic Curves Crypto Systems” by Mitsuko Miyaji (“On ordina
ry elliptic curve cryptosystems ", abstract of Asiac
rypto'92). And so on. If constructed using these methods, there is no solution method that gives a sub-exponential algorithm at the present time, so if it is as safe as a discrete logarithm problem on a finite field, it can be constructed with a much smaller definition field. In addition, the amount of communication and the amount of data can be reduced.

Next, one of the conventional techniques relating to the encryption using the elliptic curve constructed by the above method will be described.
This is described in detail in the patent of the "Head 3-318816" application by the same applicant.

[First Conventional Example / Schnoer's Signature by Elliptic Curve] FIG. 3 shows the configuration of an elliptic curve signature, authentication and secret communication system in the first conventional example.

The procedure of the conventional example will be described below with reference to FIG. (1) Key Generation The elliptic curve E E: y ² = x ³ + ax + b defined on the finite fields GF (p) and GF (p) is converted to the above-mentioned "non-super singular elliptic curve for public key cryptosystems" or " On Odenali Elliptic
MOVs using the Curves Crypto Systems "method
Choose to avoid the reduction method. Here, p is a prime number of 97 bits or more. Further, let E (GF (p)) be the group consisting of elements of this elliptic curve E on GF (p), and E (GF (p))
Let F be the element that is divided by a prime number with a large order of. The order of F is o (F). Therefore, o (F) = d
* J (d is the maximum prime factor of o (F) and is 97 bits)
And P = j * F. Let P be the base point. At this time, the order o (P) of P becomes d. Further, let h be a one-way hash function for {0,1, ...., 2 ^t -1} defined on the direct product of GF (p) and an integer ring. At this time, P, E, GF (p) and the hash function h are the public information of this signature, authentication and secret communication method.

For any user t of this system, 0 <s
_t <select an arbitrary integer which is o (P), to calculate the _{L t = -s t * P ...} [13].

[0011] Then, the user t holds a s _t as a secret key, inform all users of the L _t as a public key. (2) Generation of Signature Consider a case where a signature of plaintext m is communicated from the user t to the user u. Here, the plaintext m is an integer.

T secretly generates a random number k which is an integer,
The next element R is calculated using this random number k which only the user knows.

R = k * P [14] Here, the x coordinate of R is represented by x (R) and the y coordinate thereof is represented by y (R). That is, R = (x (R), y (R)) Next, t is the secret key s _t known only to himself, the random number k, the hash function h, and the x coordinate x of R obtained by the equation [14]. Using (R), s that satisfies the following equation is calculated and used as a signature.

E = h (x (R), m) s ≡ k + s _t * e (mod o (P)) ... [15] Then, t sends plain text m and signature texts e and s to u. (3) Verification u obtains R ₁ = s * P + e * L _t = (x (R ₁ ), y (R ₁ )) using the public key L _t of _t, and determines whether the following equation holds. inspect.

It is inspected whether e = h (x (R ₁ ), m) ... [16].

In fact, if it came from t, then R ₁ is R ₁ = s * P + e * L _t = (k + s _t * e) * P + e * (-s _t * P) = k Since * P = R, the right side of equation [16] is the right side of [16] = h (x (R ₁ ), m) = h (x (R), m) = e and equation [16] becomes It holds.

Here, the conditions of the public key and the secret key of the first conventional example are summarized, and the data amount and calculation amount are shown. the base point P;; number-position of the base point d; (s-2) 1 ≦ a private key and a public key secret key s _t subscriber t parameter a of the elliptic curve; (s-1) public key prime number p of the system L _t = s _t , where s _t ≦ d−1
Calculate P and use this as the public key.

The amount of data and the amount of calculation at this time are as follows. Here, m (97) represents a calculation amount required for multiplication in a finite field having a size of 97 bits. Typically, signatures are often used on media such as smart cards that have limited memory and CPU power. In this case, the total amount of data stored in the smart card is 5 including the system key and secret key.
With 82 bits, the amount of calculation performed by the smart card is 1565 m (97) for signature generation, but due to the above-mentioned reason, reduction of the amount of data stored in the smart card and the amount of calculation performed by the smart card becomes a problem. .

On the other hand, with respect to the public key L _t of each user, in the case of an elliptic curve, since the original is composed of two elements of x coordinate and y coordinate, the data amount thereof is twice as large as the definition field.
However, since there is one public key data amount for each subscriber, the total data amount becomes very large, so it is necessary to reduce the data amount of each individual public key. Therefore, there is the following second conventional example as an example of reducing the public key and system key of each user.

[Second Conventional Example] In the second conventional example, the signature of the first conventional example is used as the public key of each user, and the x-coordinate x (L _t ) and y-coordinate y (L) of the original L _t are used. _This is a method in which only 1 bit c (L _t ) for restoring _t ) is disclosed, and similarly, the base point, which is the system key, is also disclosed by disclosing only 1 bit of the x coordinate and y coordinate information. In this method, x (L _t )
In order to restore L _t from 1 bit y (L _t ) of the y and y coordinate information, exponentiation on GF (p) is required. (s-1)
System public key prime p; elliptic curve parameters a, b; base point x coordinate and 1 bit x (P), c
(P); order of base point d; (s-2) secret key and public key of subscriber t secret key s _t is an integer satisfying 1 ≦ s _t ≦ d−1, and L _t = s _t
P is calculated and x (L _t ) and c (L _t ) are used as public keys.

The amount of data and the amount of calculation at this time are as follows. At this time, the amount of data stored in the smart card is a total of 583 bits of the system key and the secret key, and the amount of calculation performed by the smart card is 1714 m (97) for signature generation. This is larger than that of Conventional Example 1. this is,
This is because the exponentiation operation is required to restore the y coordinate from the x coordinate and 1-bit information as described above. That is, in the second conventional example, it can be seen that the data amount of the public key can be reduced, but this causes a drawback that the calculation amount in the smart card increases.

[0022]

In public key cryptography based on the security of the discrete logarithm problem on an elliptic curve, the elliptic curve element serving as a public key requires two pieces of information of x coordinate and y coordinate. Therefore, the amount of data is twice that of the definition field. However, since there is one public key data amount for each subscriber, the total data amount becomes very large, so it is necessary to reduce the data amount of each individual public key. Therefore, in order to reduce the amount of data, only the 1-bit information necessary for restoring the original x-coordinate and y-coordinate is disclosed to make the amount of data equal to the size of the definition field. There is a problem that a power operation is required to restore the coordinates. In particular, when the signature or authentication is realized by a smart card, the power calculation is added to the calculation by the smart card, which causes a problem that the calculation amount increases.

Further, in the conventional examples 1 and 2, the amount of data stored in the smart card is almost the same, and in particular, the amount of data corresponding to the system key is five times that of the secret key. However, on a medium such as a smart card that has a limited amount of memory, how to reduce the amount of stored data becomes a problem.

Further, since the CPU capacity of the medium is also limited, the amount of calculation in the smart card is also a problem how to reduce the amount of calculation in the conventional example 1.

The present invention has been made in view of the problems in these conventional examples, and it is possible to reduce the calculation of k times the frequently required base point, and further reduce the data amount without increasing the calculation amount. It is an object of the present invention to provide a signature, authentication, and secret communication scheme that constitutes a feasible elliptic curve and a base point, and has a security basis for the discrete logarithm problem on this elliptic curve.

[0026]

In order to solve the above-mentioned problems, the present invention adopts a signature, authentication and secret communication system according to claim 1 in which q is a prime power and finite field GF.
Let E (GF (q)) be the group formed by the elements on GF (q) of the elliptic curve E having (q) as the definition field, and let the element P of E (GF (q)) be a prime number with a large order. It is characterized in that it is cracked at and the absolute value of the x coordinate x (P) or y (P) of P becomes small.

In the signature, authentication and secret communication system according to claim 2, a group constituted by elements on GF (p) of an elliptic curve E having p as a prime number and finite field GF (p) as a definition field. E
(GF (p)), the elliptic curve E is taken so that the original number of E (GF (p)) is p, and E (GF
The feature is that the element P of (p)) is set so that the x coordinate x (P) = 0.

In the signature, authentication and secret communication system according to claim 3, p is 3b ^ 2 + 3b by a certain positive integer b.
Let the prime number represented by +1 be E, and let E be the group consisting of the elements on GF (p) of the elliptic curve E having the finite field GF (p) as the definition field.
(GF (p)), the elliptic curve E is taken so that the original number of E (GF (p)) is p, and E (GF
The feature is that the element P of (p)) is taken so that the x coordinate x (P) becomes smaller.

In the signature, authentication and secret communication system according to claim 4, the elliptic curve E is such that the positive integer d is set so that the imaginary quadratic field Q ((-d) ^1/2 ) has a small class number. For a prime number p, a prime factor of 4 * p−1 is d * square, and a finite field having a solution of p of a class polynomial H _d (x) = 0 determined by _d as a j invariant A signature, authentication and secret communication system according to claim 2, characterized in that the child is obtained by having GF (p) in the definition field.

[0030]

With the above construction, in the invention according to claim 1, a group constituted by elements of GF (q) of an elliptic curve E having q as a power of prime and finite field GF (q) as a definition field. E
(GF (q)), the element P of E (GF (q)) is divided by a prime number having a large order, and the x coordinate of P is x (P) or y (P).
With a discrete logarithm problem defined on the E (GF (p)) with the element P as a base point as a basis for security, encryption using an elliptic curve and a base point The scheme is configured.

In the invention according to claim 2, p is a prime number, and GF of an elliptic curve E having a finite field GF (p) as a definition field.
When the group consisting of the elements on (p) is E (GF (p)),
The elliptic curve E is taken so that the number of elements of E (GF (p)) is p, and the element P of E (GF (p)) is x-coordinate x
A signature, authentication, and secret communication method are performed using an elliptic curve and a base point, which are characterized in that (P) = 0.

In the invention according to claim 3, p is a prime number represented by 3b ^ 2 + 3b + 1 by a positive integer b, and GF of an elliptic curve E having a finite field GF (p) as a definition field.
When the group consisting of the elements on (p) is E (GF (p)),
The elliptic curve E is taken so that the number of elements of E (GF (p)) is p, and the element P of E (GF (p)) is x-coordinate x
A signature, authentication, and secret communication method are performed using an elliptic curve and a base point characterized by making (P) small.

In the invention according to claim 4, the elliptic curve E has a positive integer d such that the imaginary quadratic field Q ((-d) ^1/2 ) has a small class number, and the prime number p is 4 * The finite field GF (p) having the solution of modulo p of the class polynomial H _d (x) = 0 defined by d as the prime factor of d−1 is a square The elliptic curve according to claim 2, on which the signature, authentication, and secret communication system according to claim 2 is performed.

[0034]

【Example】

(First Embodiment) FIG. 1 shows the configuration of a signature, authentication and secret communication system on an elliptic curve in the first embodiment of the present invention. The procedure of the embodiment will be described below with reference to FIG. (1) Determination of positive integer d The positive integer d is set so that the class number of the imaginary quadratic field Q ((-d) ^1/2 ) becomes small. Here, d = 11. For the imaginary quadratic field Q ((-d) ^1/2 ) and the number of classes, see Silberman.
The Alicematic Of Elliptic Curves “” (JH Silverman, "The arithmetic of ellip
tic curves ", Springer-Verlag, 1986). (2) Generation of prime number p The prime number p is expressed as p = 11b ² + 11b + 3 and 21
Is a square non-residue with p.

Here, p = 10000 00000 00069 78450 06142 01619 is taken. (3) Determination of elliptic curve E and base point P An elliptic curve E having a finite field GF (p) as a definition field and having exactly p original elements is given by the following.

E: y ² = x ³ + 12a ⁴ x + 16a ³ a = 1669 75881 26171 20705 94717 59082 At this time, the one in which the x coordinate is 0 in E (GF (p)) P = (0,4a ² ) exists.

The amount of data and the amount of calculation required when the elliptic curve E and the base point P configured as described above are used for the Schnoer signature on the elliptic curve of Conventional Example 2 are as follows. (s-1) public information system p = 10000 00000 00069 78450 06142 01619 a = 1669 75881 26171 20705 94717 59082 (s-2) secret key and a public key secret key s _t a 1 ≦ s _t ≦ p of subscriber t Let -1 be an integer, s _t P is calculated, and 1 bit representing the code of this x coordinate and y coordinate is used as the public key. The amount of data and the amount of calculation at this time are as follows. Therefore, it can be seen that the total amount of data stored in the smart card is 291 bits, which can be reduced to 1/2 of the conventional examples 1 and 2. Further, it can be seen that the calculation amount of the smart card, that is, the calculation amount of signature generation can be reduced by 6% in the conventional example 1 and by 14% in the conventional example 2.

In the above-mentioned embodiment, the positive integer d is set to 11. However, this is of course a positive integer if the imaginary quadratic field Q ((-d) ^1/2 ) has a small class number. Anything is fine. Also,
The prime number p satisfying the condition for d is not limited to the above-described embodiment, but may be any prime number satisfying the condition for p shown in (2).

(Second Embodiment) FIG. 2 shows the configuration of the signature, authentication and secret communication system on the elliptic curve in the second embodiment of the present invention. The procedure of the embodiment will be described below with reference to FIG. (1) Generation of prime number p The prime number p is expressed as p = 3b ² + 3b + 1, and with small numbers x ₀ and ζ, (ζ / p) ₆ = −ω and y ₀ = x ₀ ³ + ζ is GF (p) Take so that there is a quadratic residue. Here, (ζ / p) ₆ is a modular exponentiation symbol, and ω =
(-1 + (-3) ^1/2 ) / 2. Regarding the 6th power remainder symbol, Rosen, Ireland “A classical introduction to modern number seoli” (K. Ireland, M. Rosen “A classical introductio
n to modann number theory ", Springer-Verlag, 1972).

Here, if p = 10000 00000 00010 74947 68291 05687, then ζ = 3 and x ₀ = 1. (3) Determination of elliptic curve E and base point P An elliptic curve E having a finite field GF (p) as a definition field and having exactly p original elements is given by the following.

E: y ² = x ³ + ζy ₀ ³ At this time, the one in which the x coordinate is 1 in E (GF (p)) P = (x ₀ y ₀ , y ₀ ² ) = (4, 16 ) Exists.

The amount of data and the amount of calculation required when the elliptic curve E and the base point P configured as described above are used for the Schnoer signature on the elliptic curve of Conventional Example 2 are as follows. (s-1) public information system p = 10000 00000 00010 74947 68291 05687 ζ = 3, x 0 = 1 (s-2) secret key and a public key secret key s _t a 1 ≦ s _t ≦ p of subscriber t Let -1 be an integer, s _t P is calculated, and 1 bit representing the code of this x coordinate and y coordinate is used as the public key. Therefore, the amount of data stored in the smart card can be reduced to 1/3 of the conventional examples 1 and 2, and the amount of calculation of the smart card, that is, the amount of signature generation can be reduced by 20% of the conventional example 1.
It can be seen that the conventional example 2 can be reduced by 26%.

The prime number p is not limited to the above-mentioned embodiment, but can be similarly applied to other prime numbers satisfying the condition (2). Further, the elliptic curve and the base point of the present invention are not limited to the Schnoor signature, and can be similarly applied to any other discrete logarithm problem based cryptosystem.

[0044]

As described above, the present invention has a problem that the amount of calculation increases if the amount of data is reduced in the case of an elliptic curve formed by the conventional technique. However, the amount of data is reduced and the amount of calculation is reduced. It is possible to construct elliptic curves that can be reduced,
It is possible to realize high-speed signature, authentication, and secret communication method with high security, and its practical value is great.

[Brief description of drawings]

FIG. 1 is a configuration diagram of an elliptic curve according to an embodiment of the present invention.

FIG. 2 is a configuration diagram of an elliptic curve according to an embodiment of the present invention.

FIG. 3 is a configuration diagram of an elliptic curve of a first conventional example.

FIG. 4 is a configuration diagram of an elliptic curve of a second conventional example.

Claims (4)

[Claims] 1. A group constituted by elements on GF (q) of an elliptic curve E having q as a power of prime and finite field GF (q) as a definition field is defined as E (GF (q)), and E The element P of (GF (q)) is divided by a prime number with a large order, and the x coordinate x (P) or y of P is divided.
An elliptic curve characterized by using the discrete logarithm problem defined on the E (GF (p)) with the element P as a base point as the basis of security is set so that the absolute value of (P) becomes small. Signature, authentication and secret communication method used. 2. A group consisting of elements on GF (p) of an elliptic curve E having a finite field GF (p) as a definition field, where p is a prime number, is E.
(GF (p)), the elliptic curve E is taken so that the original number of E (GF (p)) is p, and E (GF
The signature, authentication and secret communication system using an elliptic curve according to claim 1, wherein the element P of (p) is taken as x coordinate x (P) = 0. 3. A value of 3b ^ 2 + 3b + where p is a positive integer b.
Let E (G be a prime number represented by 1 and be a group consisting of elements on GF (p) of an elliptic curve E having a finite field GF (p) as a definition field.
When F (p)), the original number of E (GF (p)) is p
The elliptic curve E is taken to be
The signature, authentication and secret communication system using an elliptic curve according to claim 1, wherein the element P of (p)) is taken so that the x coordinate x (P) becomes small. 4. A positive integer d is set so that the class number of the imaginary quadratic field Q ((-d) ^1/2 ) becomes small, and the prime number p is 4 * p-1 prime factor d * square number. Then, the elliptic curve E having a finite field GF (p) having a solution of modulo p of the class polynomial H _d (x) = 0 determined by _d as a j-invariant is defined as A signature, authentication and secret communication method using the elliptic curve according to claim 2.