JPH11282348A - Hyperelliptic curve enciphering method, and its decording - Google Patents

Abstract

PROBLEM TO BE SOLVED: To shorten cipher processing time. SOLUTION: Elements of a Jacobian variety are utilized as several kinds of pairs of points on a hyperelliptic curve for a disclosure key used in the case of enciphering an ordinary sentence in a hyperelliptic curve enciphering method using the Jacobian variety accompanied to the hyperelliptic curve, and for an operation of addition on the Jacobian variety used in the case of decording encipherment using the disclosure key. However, pairs of points replaced by a point at infinity are used if necessary not to come into a conjugated relation each other among the points which are not points at infinity out of the points on the hyperelliptic curve. Conjugated relations of the points constituting the elements and number of point at infinity thereof are marked to reduce calculation in the case of addition operation on the Jacobian variety. A cipher processing time is shortened thereby in the present invention compared with conventional one while securing difficulty for a discrete logarithm problem.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption method and a decryption method suitable for the field of communication of various data, and more particularly to a hyperelliptic curve encryption method and a decryption method using a Jacobi variety. In detail, when performing the addition on the Jacobi manifold, assuming that the representative elements (excluding the conjugate points other than ∞) of the elements of the Jacobi manifold are arranged as a set in which the X coordinates of the points on the curve are arranged in order. Properties of points on the curve (such as conjugate relations)
Is directly used, so that the addition operation on the Jacobi manifold at the time of the encryption and the decryption can be easily performed.

[0002]

2. Description of the Related Art An encryption and decryption method using an operation of a Jacobi variety associated with a hyperelliptic curve has been proposed as an encryption technology that can be expected to have higher security (for example, "Nea").
l Koblitz, Hyperelliptic Crypto systems, Journal o
f Cryptology, 1989, 139-150 ": Reference 1).

This hyperelliptic curve cryptography (Jacobi manifold cryptography)
Is an encryption method (decryption method) that uses the difficulty of the discrete logarithm problem as the basis of security, and its content is "Diffie-Hellm
an key distribution (W. Diffie and M. Hellman, New directions
in cryptography, IEEE Trans. Inform. Theory, 22 (1
976), 644-654): Reference 2 ”and“ ElGamal encryption method (T.
ElGamal, A Public key cryptosystem and a signature
scheme based on discretet log-arithms, IEEE Tran
s. Inform Theory, 31 (1985) 469-472): Reference 3 ”and other well-known materials.

[0004] This hyperelliptic curve encryption method using Jacobi varieties is additive as follows (addition on Jacobi varieties)
It is realized by.

First, let K be a finite field and its algebraic closure be K bars. When the genus g hyperelliptic curve defined on the finite field K is C: V ² + h (u) v = f (u), the K-factor with the number 0 on the hyperelliptic curve C is Let D ⁰ be the module formed by K and P be the module formed by all K-primary factors of the hyperelliptic curve C, the Jacobi variety J (K) is J (K bar) ＫJ (K) = D It is defined as ⁰ / P.

Here, the K- (main) factor is the K-bar
Invariant by automorphism σ: Refers to the (primary) factor such that Dσ = D. Jacobi variety J (K)
Has a modular structure naturally as a remainder group.

Then, the hyperelliptic curve cryptosystem uses a discrete logarithm problem on J (K), that is, “two elements D ₁ , An integer m that satisfies D ₁ = mD ₂ (if any) is obtained for D _2. ”

[0008] Among the encryption methods described above, for example, ElGamal encryption on a Jacobi variety, when a sender A sends a plaintext M to a receiver B, associates the plaintext M with an element of the Jacobi variety J (K). , The finite field K, the definition equation of the hyperelliptic curve C, and the element D ₀ of the Jacobi variety J (K), and publish them.

The outline of encryption and decryption on the Jacobi variety J (K) is as follows. (1A) Recipient B
Selects a natural number m _B and keeps it secret (m _B is a secret key). Next, on the Jacobi variety J (K), D _B = m _B D ₀
It was calculated (the public key D _B) to expose D _B.

(1B) Sender A selects random number r, and J
(K) on _{E 1 = rD 0, E 2} = M + rD B was respectively calculated by,
The calculation result (E ₁ , E ₂ ) is sent to the receiver B as cipher text (encryption processing).

(1C) The recipient B uses the secret key m _B to
E ₂ -m _B E ₁ = Request M (decoding processing).

As described above, in the hyperelliptic curve cryptography, when performing encryption or decryption, it is necessary to calculate n times the factor D in the Jacobi variety J (K): nD = D +... + D. .

That is, in the above description, m _B D ₀ , rD _0, rD _B,
It must be performed calculation of factor D such as m _B E _1.

As a specific example of such an addition algorithm of the factor D on the Jacobi variety J (K), reference 1 or 4 (G. Cantor, Computing in the J
acobian of a Hyperelliptic Curve, Math.Comp., 48,
1987, 95-101). The outline of this addition algorithm is as follows. The conventionally known addition algorithm of this factor (element) is based on the premise that the following two facts hold.

(1) The element D of the Jacobi variety J (K) is
It can be uniquely expressed as a reduced factor (as a representative element of factors).

(2) The semi-reduced factor (and therefore the reduced factor) is the greatest common reduction of the main factors of the polynomials a (u) (deg a <g) and b (u) -v on the two hyperelliptic curves C. Factor: can be expressed as div (a, b).

On such a premise, the additive algorithm Aa according to the prior art is described as follows.

A conventional addition algorithm Aa: div
(a ₁ , b ₁ ) + div (a ₂ , b ₂ ) = div (a, b)

[0019]

(Equation 1)

[0020]

(Equation 2)

Therefore, the above-described encryption step (1)
A), calculation of m _B D ₀ , rD ₀ , rD _B in (1B),
Further calculation of m _B E ₁ in the decoding step (1C) will be processed in accordance with the above additive algorithm Aa.

[0022]

In the above-described addition algorithm Aa, when calculating the sum of two elements (factors) D of the Jacobi variety J (K), a curve defining each factor D is obtained. They do not actively use the properties of points.

Therefore, the present invention uses this point relationship positively, and the element of the Jacobi manifold is used as a set of points on the hyperelliptic curve (in some cases, a certain relation In addition, when performing addition on a Jacobi manifold with the addition of an algorithm that directly uses the properties of the points of the hyperelliptic curve, under certain conditions, The addition operation is greatly simplified so that the addition operation processing time and the like can be reduced.

[0024]

In order to solve the above-mentioned problem, in the hyperelliptic curve encryption method according to the present invention, a hyperelliptic curve cryptosystem using a Jacobian variety accompanying the hyperelliptic curve is provided. In the method, as a public key used to encrypt a plaintext, or as an addition operation on the Jacobi manifold used when encrypting and decrypting using the public key, the element of the Jacobi manifold Is used as a set of genus of points of the hyperelliptic curve, among points on the hyperelliptic curve that are not infinity, so that they do not have a conjugate relationship with each other, and infinite if necessary. It is characterized in that it is used as a set of points replaced with far points.

According to a fifth aspect of the present invention, in the hyperelliptic curve decoding method using a Jacobi variety accompanying a hyperelliptic curve, the elements of the Jacobi variety are constructed. By using the set of points of the hyperelliptic curve as a genus of points, and replacing points between the points on the hyperelliptic curve that are not at infinity with infinite points if necessary. While using the ciphertext obtained by performing the addition operation on the Jacobi manifold while using it as a set of points that do not have a conjugate relationship with each other, The plaintext is decrypted by performing an addition operation on the body.

In the present invention, when performing the addition operation on the Jacobi variety, the points constituting the elements of the Jacobi variety are used as a set of the number of points of the hyperelliptic curve. And
Between points on the hyperelliptic curve that are not at infinity, by replacing them with infinity if necessary,
It is used as a set of points that do not have a conjugate relationship with each other.

By using a set of points having a conjugate relationship and a point at which the point at infinity is blown, if the sum of the points at infinity is greater than the genus g, two points on the hyperelliptic curve are obtained. The addition of the sets P and Q can be obtained by immediately adding them.

Further, in the present invention, even when decrypting a ciphertext obtained by performing the conditional addition operation on the Jacobi manifold as described above, the addition operation on the Jacobi manifold used for decryption is performed. Can be simplified.

[0029]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, an embodiment of a hyperelliptic curve encryption method and a decryption method according to the present invention will be described in detail with reference to the drawings.

FIG. 1 shows an encryption and decryption system to which the present invention is applied, which is an example of encryption and decryption by the public key method as described above. Plaintext M is supplied to the ciphertext generating unit 12 together with the private key m _B, the generator 12
Is encrypted according to the encryption algorithm according to the present invention in the ROM 14 provided in the ROM.

That is, using the element D ₀ on the Jacobi variety J (K) and the secret key m _B , an addition operation of D _B = m _B D ₀ is performed on the Jacobi variety J (K). Operation result D _B is published as the public key.

The transmitter A chooses a random number r, also on the Jacobian variety _{J (K), E 1 =} rD 0 E 2 = M + rD B becomes performs the operation of addition, the operation result (E _1, E ₂₎ To the recipient B as a ciphertext.

Here, as the addition operation on the Jacobi variety J (K) described above, in the present invention, as will be described in detail later, the points constituting the elements of the Jacobi variety are replaced by the points of the hyperelliptic curve. In addition to using as a set of genus, between points on the hyperelliptic curve that are not at infinity, if necessary, by replacing them with infinity, x Used as a set arranged in the order of coordinates.

The received ciphertext (E ₁ , E ₂ ) is supplied to the decryption processing means 22, and the decryption processing of E ₂ −m _B E ₁ = M is performed using the secret key m _B , and the Jacobi variety J (K) is performed by calculating the addition, and is decoded into plaintext M.

Subsequently, the Jacobi variety J according to the present invention
(K) The addition operation will be described. First, a hyperelliptic curve of genus g: v ² + h (u) v = f (u) f (u), h (u) ∈K [u], degf (u) = 2g + 1, deg h
Let J (K) be the Jacobi variety associated with (u) ≦ g.

The Jacobi variety J (K) is a set of points (P ₁ , P ₂ ,..., Pg) composed of {(K bar-rational) points} (infinity points) on the curve. In addition, 1. 1. An order (for example, a lexicographic order with an order) is determined for the x coordinate, and arranged as x (P _i ) <x (P _j ) (i ≦ j) (P1,..., Pg). When P bar _i is a conjugate point of P _i (≠ ∞), P bar
_i ≠ P _j (j = 1,..., g, j ≠ i) can be regarded as a set P (K) including the relation In fact,

[0037]

(Equation 3)

And gr in the point set P _i
If (r ≦ g) points at infinity ∞, Jacobi variety J
(K) supports the following.

[0039]

(Equation 4)

[0040] In addition, the zero element 0 of this time Jacobian variety J (K) is, 0 = (∞, ···, ∞) (P 1, ···, P g) on the inverse element - (P _1,・ ・ ・, P _g )
Can be expressed as-(P ₁ ,..., P _g ) = (P bar ₁ ,..., P bar _g ). This identification

[0041]

(Equation 5)

Under the same hyperelliptic curve C, a set of different points P _i , Q _i is (P ₁ ,..., P _g ) + (Q ₁ ,..., Q _g ) = (T ₁ , ...
·, T _g ), then:

[0043]

(Equation 6)

At this time, the addition on the Jacobi variety J (K) is performed as follows. Now, let r and s denote the number of pairs of points P _i and Q _i such that P _i = ∞ and Q _i = ∞, respectively.
The point sets P _i and Q _i that are not equal to each other are as follows.

[0045]

(Equation 7)

In general, the sum of two points in a commensurate relationship is equal to 2∞ (as an element of the Jacobi variety). Therefore,
Do the following:

[0047]

(Equation 8)

Then, under the condition of R _i (1 ≦ i ≦ 2 (g−v) −rs), the following calculation can be performed while dividing the conditions, and the following calculation can be performed.

[0049]

(Equation 9)

[0050]

(Equation 10)

Where deg (3g−2v−rs) ∞ = 3g−2v−rs ≧ 2
Since g ≧ 2g−2, it can be expressed as follows from the Riemann-Roch theorem.

[0052]

[Equation 11]

R _i and T _i are L ((3g−2v−rs))
It should be the zero of a rational function of a certain K coefficient included in ∞). By the way, this rational function is a curve (normalized by a certain coefficient)

[0054]

(Equation 12)

Where R _i (1 ≦ i ≦ 2 (g−v) −rs)
｛2 (g−v) −r− obtained from the condition that
It can be obtained by solving an s｝ -element linear simultaneous equation.

[0056]

(Equation 13)

When an intersection S bar _i (i = 1,..., G) other than R _i = (x _Ri , y _Ri ) is determined, the intersection S
Bar _i can be calculated as (T ₁ ,..., T _g ) = (S ₁ ,..., S _g ).

Thus, the Jacobi variety J according to the invention
(K) The additive algorithm above can be written as:

Addition (P ₁ ,..., P _g ) + (Q ₁ ,..., Q _g ) =
Algorithm of (T ₁ , ..., T _g )

[0060]

[Equation 14]

[0061]

(Equation 15)

[0062]

(Equation 16)

The above is the addition algorithm.

Next, a specific hyperelliptic curve C, for example, a genus 2 hyperelliptic curve C ₁ C ₁ : v ² = u ⁵ +1 on the finite field vector F3

[0065]

[Equation 17]

[0066]

(Equation 18)

As the order of the X coordinate, for example, a lexicographic order with an order is entered. That is, x ₁ + y ₁ α <x ₂ + y ₂ α⇔ (i) x ₁ + y ₁ <x ₂ + y ₂ or (ii) = x ₁ + y ₁ = x ₂ + y ₂ , X ₁ ≦ X ₂ or x ₁ = x ₂ , y ₁ <y ₂

(A) The sum of ((0,1), (2,0)) + ((0,1), (2,0))
Calculation (Calculation example of D ₀ + D ₀ = 2D ₀ , m _B = 2) The number of ∞ = 0. Since 2.2 = 2 & 0 + 0 = 0, (2,0) and (2,0) have a conjugate relationship. Since 3.2 ≧ genus, the algorithm step (3-
From (a), ((0, 1), (0, 1)) (= 2D ₀ )

(B) Total of ((0,1), (0,1)) + ((0,1), (2,0))
Calculation (Example of calculation of 2D ₀ + D ₀ = 3D ₀ ) The number of ∞ = 0. 2. There is no conjugate point set. Since 3.0 <genus, the algorithm step (3-
Proceed to b).

Step 3 (b-1): v = C ₀ + C ₁ u + C
^₂ u ₂ + C ^₃ u ₃ is (0,1) (0,1), C ₀ so as to pass (0,1) (2,0),
Find C ₁ , C ₂ , C ₃ . The calculation algorithm for obtaining this is shown below.

Calculation algorithm of step 3 (b-1)

[0072]

[Equation 19]

[0073]

(Equation 20)

[0074] becomes equation (here, d ⁱ v / du ⁱ is determined by using a derivative of the shadow function from the definition equation of the curve) is also solving the simultaneous equations in addition.

Actually, in each calculation module, a module having a derivative up to the (number of coincident points−1) floor is further prepared, and the module is assigned to the module according to the number of coincident points. It will be branched.

The simultaneous linear equations of C _{0 to} C ₃ in step 3 (b-1) are solved as follows.

[0077]

(Equation 21)

[0078]

(Equation 22)

(C) ((0, 2), ∞) + ((1 + α, 2 + 2α), (1+
Calculation of 2α, 2 + α)) The number of ∞ = 1. 2. There is no conjugate relationship. Since 3.1 <genus, the algorithm step (3-
Proceed to b).

[0080]

(Equation 23)

[0081]

(Equation 24)

[0082]

(Equation 25)

(D) ((0,1), (2,0) + ((1 + α, 1 + α), (1
+ 2α, 1 + 2α)) Calculation 1. The number of ∞ = 0. 2. There is no conjugate relationship. Since 3.0 <genus, the algorithm step (3-
Proceed to b).

[0084]

(Equation 26)

[0085]

[Equation 27]

The calculation algorithm in step 3 (b-2) is shown below.

In step 3 (b-2), using (Gröbner basis)
Calculation algorithm

[0088]

[Equation 28]

[0089]

(Equation 29)

[0090]

[Equation 30]

From this, u = 0 is obtained. Step 3 (b-3) ((0, 2), ∞) The four arithmetic operations and the solution of the equations (factorization) in the above algorithm are all operations on the finite field. It is.

[0092]

(Equation 31)

In this case, multiplication and division can be performed by, for example, a method using a linear shift register, a method using a normal basis, or factorization using a Berlekamp algorithm. Therefore, the operation processing time can be reduced as compared with the conventional case.

A method using a normal basis is described in reference 5 (Wang, C.
C etal, VLSI Architectures for Computing Multiplic
ations and Inverse in GF (2 ^m ), IEEE Trans on Compu
t., 1990, C-34, 8, pp. 709-716). Reference 6 describing the Berlekamp algorithm includes (Berlekam
p, E.R, Algebraic Coding Theory, MacGraw-Hill, 196
8) are known.

[0095]

As described above, in the hyperelliptic curve encryption and decryption method according to the present invention, the element of the Jacobi variety is represented as a set of points satisfying a certain property, and the calculation of the public key (the encryption key) is performed. Processing) Calculation of decrypted text (decoding processing) is performed. For this reason, when performing addition on a Jacobi variety for performing these calculations, the calculations can be reduced by focusing on the conjugate relation of the points constituting the elements and the number of infinite differences. As a result, the present invention has a feature that the cryptographic operation processing time can be reduced as compared with the related art while securing the difficulty of the discrete logarithm problem.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram of an encryption and decryption system according to the present invention.

[Explanation of symbols]

10: encryption device, 20: decryption device, A: sender, B: recipient

Claims (5)

[Claims] 1. A hyperelliptic curve cryptosystem using a Jacobi variety associated with a hyperelliptic curve, wherein a public key used for encrypting plaintext, and a public key used for encrypting and decrypting using the public key. As an operation of addition on the Jacobi manifold used, in using the elements of the Jacobi manifold as a set of genus of points of the hyperelliptic curve, the points on the hyperelliptic curve at infinity A hyperelliptic curve encryption method characterized by using a set of points replaced by points at infinity, if necessary, so that points that are not points do not have a conjugate relationship with each other. 2. When the elements of the Jacobi variety are expressed as a set of genus of points of a hyperelliptic curve and the addition is performed, the added 2
When there is a point of an element that has a conjugate relation among points that are not infinity points included in one set, replace the point with the conjugate relation with the point at infinity and execute the addition on the Jacobi manifold 2. The hyperelliptic curve encryption method according to claim 1, wherein: 3. When the sum of the number of points at infinity is equal to or greater than the genus of points on the hyperelliptic curve, a set of points and the number of points at infinity from points on the hyperelliptic curve 3. The hyperelliptic curve encryption method according to claim 2, wherein a set of points excluding points that have a conjugate relationship when expressed is used as a result of addition on the Jacobi manifold. 4. When performing the addition according to claim 3,
4. The method according to claim 3, wherein the processing is performed by calculating an intersection of a curve and a hyperelliptic curve that pass through points other than the point at infinity included in the set of points. The described hyperelliptic curve encryption method. 5. A hyperelliptic curve decoding method using a Jacobi manifold associated with a hyperelliptic curve, wherein the points constituting the elements of the Jacobian manifold are used as a set of genus of points of the hyperelliptic curve. At the same time, the points on the hyperelliptic curve that are not at infinity are replaced by infinity if necessary, thereby using the Jacobi points as a set of points that do not have a conjugate relationship with each other. The ciphertext obtained by performing the addition operation on the manifold is decrypted by performing the addition operation on the Jacobi manifold while using the ciphertext and the secret key. A hyperelliptic curve decoding method, characterized in that: