JPH11316542A - Elliptic curve converting device, and device and system for utilization - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an elliptic curve converting device which converts an elliptic curve selected optionally as a safe elliptic curve suitable for ciphering into an elliptic curve having safety equivalent to that of the said elliptic curve and capable of decreasing the calculation quantity. SOLUTION: Relating to this converting device 200, a conversion coefficient acquisition part 220 uses parameters (a) and (b) and an element G of a received elliptic curve E to obtain a conversion coefficient (t) as an element on a finite body GF(p) so that t<4> ×a(mod p) is <=32 bits. A converted elliptic curve calculation part 230 calculates parameters a' and b' of an elliptic curve Et:y'<2> =x'<3> +a'×x'+b' constituted on the finite body GF(p) to calculate an element Gt on the elliptic curve Et. A parameter sending-out part 240 send out the calculated parameters a' and b' and element Gt(xt0, yt0).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption technology as an information security technology, and more particularly, to an encryption / decryption technology realized by using an elliptic curve, a digital signature / verification technology, and a key sharing technology.

[0002]

2. Description of the Related Art Public key encryption In recent years, data communication based on computer technology and communication technology has become widespread, and in this data communication, a secret communication method or a digital signature method is used. Here, the secret communication method is a method of performing communication without leaking communication contents to a person other than a specific communication partner. The digital signature system is a communication system that shows the validity of communication contents to a communication partner or proves the identity of a caller.

[0003] For these secret communication systems or digital signature systems, an encryption system called public key encryption is used. Public key cryptography is a method for easily managing different encryption keys for each communication partner when there are many communication partners, and is a fundamental technology indispensable for communicating with many communication partners. In secret communication using public key cryptography, the encryption key and the decryption key are different, and the decryption key is kept secret but the encryption key is made public.

[0004] The discrete logarithm problem is used as a basis for security of the public key cryptosystem. Typical discrete logarithmic problems include those defined on a finite field and those defined on an elliptic curve. For the discrete logarithm problem, see Neil Koblitz, "Acoustic in Nambaa Theory and Cryptography" (Neal Koblitz, "
A Course in Number theory and Cryptography ", Spri
nger-Verlag, 1987). 2. Discrete log problem on elliptic curve The discrete log problem on elliptic curve is described below.

The discrete logarithm problem on an elliptic curve is E (GF
(P)) is an elliptic curve defined on the finite field GF (p), and when the order of the elliptic curve E is divisible by a large prime number, an element G included in the elliptic curve E is set as a base point. At this time, if there is an integer x such that (Equation 1) Y = x * G with respect to a given element Y included in the elliptic curve E, the problem is to find x.

Here, p is a prime number, and GF (p) is a finite field having p elements. Further, in this specification, the symbol * indicates an operation of adding an element included in an elliptic curve a plurality of times, and x * G adds an element G included in an elliptic curve x times as shown in the following equation. Means that. x * G = G + G + G +... + G The security of public key cryptography is based on the discrete logarithm problem.
This is because the above problem is extremely difficult for a finite field GF (p) having many elements. 3. Elgamal Signature Applying Discrete Log Problem on Elliptic Curve A digital signature scheme based on Elgamal signature applying the discrete log problem on the elliptic curve will be described below with reference to FIG.

FIG. 1 is a sequence diagram showing a procedure of a digital signature scheme using the above-mentioned El Gamal signature. The user A 110, the management center 120, and the user B 130 are connected by a network. p is a prime number, finite field GF
(P) Let the upper elliptic curve be E. Let G be the base point of E and q be the order of E. That is, q is the smallest positive integer that satisfies (Equation 2) q * G = 0.

Note that (な お, ∞) in which both x and y coordinates are ∞ is called an infinity point and is represented by 0. When the elliptic curve is regarded as a group, the point at infinity serves as a "zero element" in addition. (1) Generation of Public Key by Management Center 120 The management center 120 sends the user A11
Using the secret key xA of 0, the user A11
A public key YA of 0 is generated (steps S141 to S14).
2). (Equation 3) YA = xA * G Thereafter, the management center 120 discloses the prime number p, the elliptic curve E, and the base point G as system parameters,
Further, the public key Y of the user A110 is given to another user B130.
A is made public (steps S143 to S144).

(2) Signature generation by user A110 User A110 generates a random number k (step S14).
5). Next, the user A110 calculates (Equation 4) R1 = (rx, ry) = k * G (Step S146), and calculates (s) from (Equation 5) s × k = m + rx × xA (mod q). (Step S147). Where m
Is a message transmitted from the user A110 to the user B130.

Further, the user A110 obtains the obtained (R
1, s) with the message m with the signature
130 (step S148). (3) Signature Verification by User B130 User B130 confirms the identity of user A110, which is the sender, by determining whether or not s * R1 = m * G + rx * YA (step S14).
9). This is expressed by the following equation (7): s * R1 = {((m + rx × xA) / k) × k} * G = (m + rx × xA) * G = m * G + (rx × xA) * G = m * G + rx * This is clear from the fact that YA is obtained. 4. Addition of points on an elliptic curve, computational complexity of doubling calculation In each of generation of a public key, signature generation, and signature verification in a digital signature scheme using Elgamal signature that applies the discrete logarithm problem on the elliptic curve described above. , A calculation of a power of a point on the elliptic curve is performed. For example, "xA * G" shown in Equation 3, "k * G" shown in Equation 4, "s * R1", "m * G", and "rx * YA" shown in Equation 6 are points on the elliptic curve. Is an operation of a power of.

For the calculation formula of the elliptic curve, see "Efficie
nt elliptic curve exponentiation "(Miyaji, Ono, an
d Cohen, Advances in cryptology-proceedings of I
CICS'97, Lecture notes incomputer science, 1997,
Springer-verlag, 282-290.).

The calculation formula of the elliptic curve will be described below. The equation of the elliptic curve is expressed as y ＾ 2 = x ＾ 3 + a ×
x + b, the coordinates of an arbitrary point P are (x1, y1), and the coordinates of an arbitrary point Q are (x2, y2). Here, the coordinates of the point R determined by R = P + Q are (x3, y3).

In this specification, the symbol ＾ indicates a power operation, for example, 2 ＾ 3 means 2 × 2 × 2. In the case of PＲQ, R = P + Q is an addition operation. The addition formula is shown below. x3 = {(y2-y1) / (x2-x1)} 2-x1
−x2 y3 = {(y2-y1) / (x2-x1)} (x1-x
3) When -y1 P = Q, R = P + Q = P + P = 2 × P, and R
= P + Q is a doubling operation. The doubling formula is shown below.

X3 = {(3x1 ＾ 2 + a) / 2y1｝ ＾ 2-2x1 y3 = {(3x1 ＾ 2 + a) / 2y1} (x1-x3)
-Y1 The above operation is an operation on a finite field where an elliptic curve is defined. As described above, when the addition operation on the elliptic curve is performed at the affine coordinates, which are binary coordinates, that is, the coordinates described above, the addition 1 on the elliptic curve is performed.
Each time, one reciprocal calculation on a finite field is required. In general, reciprocal calculation on a finite field requires about 10 times as much calculation as multiplication calculation on a finite field.

Therefore, for the purpose of reducing the amount of calculation, coordinates of a set of three terms called projective coordinates are used. The projective coordinates are coordinates composed of a set of three terms X, Y, and Z, and include coordinates (X, Y, Z) and coordinates (X ', Y', Z ').
, There exists a certain number n, and X ′ = nX, Y ′ =
If there is a relationship of nY, Z ′ = nZ, (X, Y,
Z) = (X ′, Y ′, Z ′).

Affine coordinates (x, y) and projective coordinates (X, y)
Y, Z) are (x, y) → (x, y, 1) (X, Y, Z) → (X / Y, Y / Z) (when Z ≠ 0) and correspond to each other doing. Here, the symbol →
It is used in the following sense. When one element of the set S2 corresponds to an arbitrary element of the set S1, it is described as S1 → S2.

In the following, it is assumed that all calculations of the elliptic curve are performed on the projective coordinates. Next, the addition formula of the elliptic curve on the projective coordinates and the double formula will be described. These formulas are, of course, consistent with the addition and doubling formulas in affine coordinates described above. The multiplication operation can be realized by repeating addition and doubling of points on the elliptic curve. Among the multiplication operations, the calculation amount of addition does not depend on the parameters of the elliptic curve, but the calculation amount of doubling depends on the parameters of the elliptic curve.

Here, p is a 160-bit prime number,
The elliptic curve on the finite field GF (p) is expressed as E: y ＾ 2 = x ＾
3 + ax + b, and the elements P and Q on the elliptic curve E are P = (X1, Y1, Z1), Q = (X2, Y
When expressed by (2, Z2), R = (X3, Y3, Z3) = P + Q is obtained as follows.

(I) When P ≠ Q In this case, an addition operation is performed. (step 1-1) Calculation of the intermediate value The following is calculated. (Equation 8) U1 = X1 × Z2 ＾ 2 (Equation 9) U2 = X2 × Z1 ＾ 2 (Equation 10) S1 = Y1 × Z2 ＾ 3 (Equation 11) S2 = Y2 × Z1 ＾ 3 (Equation 12) H = U2-U1 (Equation 13) r = S2-S1 (step 1-2) Calculation of R = (X3, Y3, Z3) The following is calculated. (Equation 14) X3 = −H {3-2 × U1 × H {2 + r}
2 (Equation 15) Y3 = −S1 × H {3 + r × (U1 × H}
2-X3) (Equation 16) Z3 = Z1 * Z2 * H (ii) When P = Q (that is, R = 2P) In this case, the doubling operation is performed.

(Step 2-1) Calculation of Intermediate Value The following is calculated. (Equation 17) S = 4 × X1 × Y1 ＾ 2 (Equation 18) M = 3 × X1 ＾ 2 + a × Z1 ＾ 4 (Equation 19) T = −2 × S + M ＾ 2 (step 2-2) R = (X3 , Y3, Z3) The following is calculated. (Equation 20) X3 = T (Equation 21) Y3 = −8 × Y1 ＾ 4 + M × (S−T) (Equation 22) Z3 = 2 × Y1 × Z1 Next, when adding and doubling elliptic curves is performed. The calculation amount of will be described. Here, the calculation amount by one multiplication on the finite field GF (p) is represented by 1Mul, and the calculation amount by one squaring is represented by 1Sq. In a general microprocessor, 1Sq ≒ 0.8Mul.

According to the above example, the calculation amount of addition on the elliptic curve shown in the case of P ≠ Q is obtained by counting the number of multiplications and the number of squaring in Equations 8 to 16. 12Mul + 4Sq. This means that the calculation amount of the addition in Expressions 8, 9, 10, 11, 14, 15, and 16 is 1Mul + 1Sq and 1Mul + 1, respectively.
Sq, 2Mul, 2Mul, 2Mul + 2Sq, 2Mu
It is clear from the fact that they are 1, 2 Mul.

Also, according to the above example, the calculation amount of the doubling on the elliptic curve shown when P = Q is given by the following equation (17).
In Expression 22, it is obtained by counting the number of times of multiplication and the number of times of squaring, which is 4Mul + 6Sq. This means that the calculation amount of the doubling in the equations 17, 18, 19, 21, and 22 is 1Mul + 1Sq and 1Mul +
This is apparent from 3Sq, 1Sq, 1Mul + 1Sq, and 1Mul.

In the counting of the number of times, for example, for H ＾ 3 in the expression 14, since H ＾ 3 = H ＾ 2 × H, the calculation amount of H ＾ 3 is 1Mul + 1S
q, and Z1 ＾ 4 in Equation 18 can be expanded as Z1 ＾ 4 = (Z1 ＾ 2) ＾ 2, so the calculation amount of Z1 ＾ 4 is 2Sq.

As for H ＾ 2 in Equation 14, since H ＾ 2 has been calculated in the process of calculating H プ ロ セ ス 3, the calculation amount of H ＾ 2 is not counted again. When counting the number of multiplications, the number of multiplications performed by multiplying a certain value by a small value is not counted. The reason will be described below. The small value here is a small fixed value to be multiplied in Expressions 8 to 22,
Specifically, it is a value such as 2, 3, 4, 8, or the like. These values can be represented by at most a 4-bit binary number. on the other hand,
Other variables typically have 160-bit values.

Generally, in a microprocessor, multiplication of a multiplier and a multiplicand is performed by repeatedly shifting and adding the multiplicand. That is, for each bit of the multiplier represented by the binary number, if this bit is 1, the multiplicand is set so that the least significant bit of the multiplicand represented by the binary number matches the position where the bit exists. Shift to 1
Get two bit strings. For all the bits of the multiplier, at least one bit string obtained in this way is added.

For example, in a multiplication of a 160-bit multiplier and a 160-bit multiplicand, the 160-bit multiplicand is shifted 160 times to obtain 160 bit strings, and the obtained 160 bit strings are added. On the other hand, in the multiplication of the 4-bit multiplier and the 160-bit multiplicand, 160
Shift the multiplicand of bits four times to obtain four bit strings,
The obtained four bit strings are added.

Since the multiplication is performed as described above, if the multiplication is performed by multiplying a certain value by a small value, the number of repetitions is reduced. Therefore, the calculation amount can be regarded as small, and is not counted in the number of multiplications. As described above, when doubling the elliptic curve is performed, Expression 18 includes the parameter a of the elliptic curve. For example, if a small value is adopted as the value of the parameter a, the calculation amount of the doubling on the elliptic curve becomes
The amount can be reduced by 1 Mul, which is 3 Mul + 6 Sq. In addition,
Regarding addition, the amount of calculation does not change even if the parameters of the elliptic curve are changed. 5. Selection of Elliptic Curve Suitable for Encryption Next, a method of selecting an elliptic curve suitable for encryption will be described. For details, see “IEEE P1363 Worki
ng draft "(published by IEEE on February 6, 1997).

An elliptic curve suitable for encryption can be obtained by repeating the following steps. (step 1) Selection of Arbitrary Elliptic Curves Arbitrary parameters a and b on the finite field GF (p) are selected.
Here, a and b satisfy Expression 23, and p is a prime number. (Equation 23) 4 × a ＾ 3 + 27 × b ＾ 2 ≠ 0 (mod p) Using the selected a and b, the elliptic curve is expressed as E: y ＾ 2
= X ＾ 3 + a × x + b.

(Step 2) Judgment as to whether or not the elliptic curve is suitable for cryptography The original number of elliptic curves E #E (GF (p))
(Condition 1) #E (GF (p)) is divisible by a large prime number, and (Condition 2) #E (GF (p)) − (p + 1) ≠
If the values are 0 and -1, the elliptic curve E is adopted. Condition 1
Or, when the condition 2 is not satisfied, the elliptic curve E is rejected,
Returning to step 1, selection of an arbitrary elliptic curve and determination are repeated again.

[0030]

As described above, if a fixed small value is selected as the parameter a of the elliptic curve, the amount of calculation in the operation of multiplying the elliptic curve can be reduced, but the parameter is fixed in advance. In this case, there is a problem that it is difficult to select a secure elliptic curve suitable for encryption.

Conversely, when a secure elliptic curve suitable for encryption is selected by using the above-described method for selecting an elliptic curve, a small value cannot always be selected as the parameter a of the elliptic curve. There is a problem that cannot be reduced. As described above, in order to select a secure elliptic curve suitable for cryptography and reduce the amount of computation in the elliptic curve, there are mutually contradictory and conflicting problems.

The present invention solves the above-described problems, and converts an elliptic curve arbitrarily selected as a secure elliptic curve suitable for cryptography into an elliptic curve having security equivalent to the elliptic curve and having a computational complexity of It is an object of the present invention to provide an elliptic curve conversion device, an elliptic curve conversion method, and a recording medium that stores an elliptic curve conversion program that converts an elliptic curve into an elliptic curve that can reduce the number of elliptic curves. In addition, a use device such as an encryption device, a decryption device, a digital signature device, a digital signature verification device, a key sharing device, and the like, which can perform operations safely and at a high speed, and a use device comprising the use device and the elliptic curve conversion device The purpose is to provide a system.

[0033]

In order to solve the above-mentioned problems, the present invention converts one elliptic curve E into another elliptic curve.
An elliptic curve conversion device for generating two elliptic curves Et, which is a means for externally receiving a prime number p, parameters a and b of the elliptic curve E, and an element G as a base point. E is a finite field GF (p)
Defined above, represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, and the receiving means represented by G = (x0, y0) and the finite field GF (p) Is a means for acquiring a conversion coefficient t existing in the following equation:
And t ＾ 4 × a (mod p) is a prime number p
A conversion coefficient obtaining unit that satisfies the condition that the number of digits is smaller than the above, and using the obtained conversion coefficient t, the parameters a ′ and b ′ of the elliptic curve Et and a new base point Means for calculating the element Gt,
a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2
× x0, yt0 = t ＾ 3 × y0, the elliptic curve Et is defined on a finite field GF (p), and y ′ ＾ 2 = x ′ ＾ 3
+ A ′ × x ′ + b ′, where xt0 and yt0 are elliptic curve calculation means that are the x coordinate value and y coordinate value of the element Gt, the calculated parameters a ′ and b ′, and the element Gt, respectively.
and output means for outputting t to the outside.

Here, p is a 160-bit prime number, and the transform coefficient obtaining means determines that t ＾ 4 × a (mod
The conversion coefficient t satisfying the condition that p) is a number of 32 bits or less may be obtained. here,
The conversion coefficient acquiring means is t ＾ 4 × a (mod p)
May be configured to acquire a conversion coefficient t that satisfies the condition that is -3.

Here, the conversion coefficient obtaining means includes a variable T
, The initial value is set to -3, and values other than the initial value are taken in order from the smaller number of digits to the larger value.
= T ＾ 4 × a (mod p) to determine whether or not the condition is satisfied, thereby obtaining the conversion coefficient t. Also, the present invention
An elliptic curve converter for converting one elliptic curve E to generate another elliptic curve Et, and a generated elliptic curve Et
An elliptic curve utilization system comprising: a utilization device that uses the first elliptic curve conversion device; a first output unit, a first reception unit, and a utilization unit; A coefficient obtaining unit, an elliptic curve calculating unit, and a second output unit, wherein the first output unit converts the prime number p, the parameters a and b of the elliptic curve E, and the element G as a base point into the elliptic curve. Output to the converter,
Here, the elliptic curve E is defined on a finite field GF (p) and is represented by y ＾ 2 = x ＾ 3 + ax + b. The element G exists on the elliptic curve E, and G = (x0, y0). The second receiving means receives a prime number p, a parameter a and a parameter b of an elliptic curve E, and an element G from the utilization device, and the transformation coefficient obtaining means obtains a finite field GF (p) Obtain the transform coefficient t present above, where the transform coefficient t is t
≠ 0, and t ＾ 4 × a (mod p) satisfies the condition that the number of digits is smaller than that of the prime number p, and the elliptic curve calculation unit calculates the obtained conversion coefficient t The parameters a ′ and b ′ of the elliptic curve Et and the element Gt as a new base point are calculated using the following equation, and a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t
＾ 2 × x0, yt0 = t ＾ 3 × y0, where the elliptic curve Et is defined on a finite field GF (p), and y ′ ＾ 2 =
x ′ ＾ 3 + a ′ × x ′ + b ′, xt0, yt
0 is an x coordinate value and ay coordinate value of the element Gt, respectively, and the second output means outputs the calculated parameters a ′ and b ′ and the element Gt to the utilization device, and Receiving means, the output parameters a ′ and b ′;
Receiving the element Gt, the utilization means comprises an elliptic curve defined by the prime number p and the received parameters a ′ and b ′,
Using the element Gt as the base point, the finite field GF
(P) Based on an operation on an elliptic curve defined above, encryption, decryption, digital signature, digital signature verification, or key sharing based on the discrete logarithm problem is performed.

Further, the present invention comprises a second receiving means, a transform coefficient obtaining means, an elliptic curve calculating means, and a second output means,
A usage device that receives and uses the generated elliptic curve Et from an elliptic curve conversion device that converts one elliptic curve E to generate another elliptic curve Et, wherein the usage device includes a 1 output means, first receiving means, and utilization means, wherein the first output means converts the prime number p, the parameters a and b of the elliptic curve E, and the element G as a base point into the elliptic curve conversion device. Where the elliptic curve E is defined on a finite field GF (p) and y ＾ 2 = x
元 3 + ax + b, the element G exists on the elliptic curve E, and is represented by G = (x0, y0), and the second receiving unit sends a prime number p and a parameter of the elliptic curve E from the utilization device. a and the parameter b and the element G are received, and the transform coefficient acquiring means acquires a transform coefficient t existing on the finite field GF (p), where the transform coefficient t is t ≠ 0. ,
In addition, t ＾ 4 × a (mod p) satisfies the condition that the number of digits is smaller than that of the prime number p, and the elliptic curve calculation means uses the obtained conversion coefficient t to obtain the following equation: , The parameters a ′ and b ′ of the elliptic curve Et and the element Gt
A ′ = a × t ＾ 4, b ′ = b × t ＾ 6, x
t0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, where
The elliptic curve Et is defined on a finite field GF (p), and y ′
＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, x
t0 and yt0 are the x coordinate value and the y coordinate value of the element Gt, respectively, and the second output means outputs the calculated parameters a ′ and b ′ and the element Gt to the use device,
The first receiving unit receives the output parameters a ′ and b ′ and the element Gt, and the using unit generates a prime p
And an elliptic curve defined by the received parameters a ′ and b ′ and an element Gt as a base point,
Based on an operation on an elliptic curve defined on a finite field GF (p), encryption, decryption, digital signature, digital signature verification, or key sharing based on the discrete logarithm problem is performed. .

[0037]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An elliptic curve conversion device 200 according to one embodiment of the present invention will be described with reference to the drawings. 1. Configuration of Elliptic Curve Converter 200 As shown in FIG. 2, the elliptic curve converter 200 includes a parameter receiving unit 210, a conversion coefficient acquiring unit 220, a converted elliptic curve calculating unit 230, and a parameter sending unit 240. (Parameter receiving unit 210) Parameter receiving unit 210
From the external device, the parameters a and b of the elliptic curve,
An element G on the elliptic curve and a prime number p are received. Here, p is a 160-bit prime number.

The external device includes an encryption device using public key encryption, a decryption device, a digital signature device, a digital signature verification device, a key sharing device, and the like. The external device uses the discrete logarithm problem on an elliptic curve as a basis for security of public key cryptography, and has the elliptic curve. Here, the elliptic curve arbitrarily configured on the finite field GF (p) is represented by E: y ＾ 2 = x ＾ 3 + ax + b, and the element G is arbitrarily configured of the elliptic curve; = (X0, y0). (Transform Coefficient Acquisition Unit 220) The transform coefficient acquisition unit 220 has a function T (i) as shown in FIG. Function T (i)
Is -3, when i = 0, 1, 2, 3, 4, respectively.
It has values of 1, -1, 2, and -2. Also, the function T (i)
Has values 3, 4, -4, 5, -5, 6, -6,... When i = 5, 6, 7, 8, 9, 10, 11,.

The conversion coefficient acquisition unit 220 satisfies (Equation 24) −2 ＾ 31 + 1 ≦ T (i) ≦ 2 ＾ 31-1 while adding the value of i one by one, starting from i = 0. (Equation 25) A conversion coefficient t that satisfies T (i) = t ＾ 4 × a (mod p) and is an element on the finite field GF (p) is calculated.

Here, equation 24 indicates that T (i) is taken to be 32 bits or less. Note that the function T (i) has a value of −3 when i = 0, and the conversion coefficient acquisition unit 220 starts from i = 0 and adds the value of i one by one to the function T (i). Since the value of T (i) is referred to, the value of -3 is referred first.

The function T (i) is given by
Except for having a value of -3, since the values have values in order from a small absolute value to a large value, they can be referred to in order from a value with a small absolute value. (Conversion Elliptic Curve Calculation Unit 230) The conversion elliptic curve calculation unit 230
Transformed elliptic curve Et: y ′ ＾ 2 constructed on F (p)
= X '＾ 3 + a' x x '+ b' parameter a ',
b ′ is calculated as follows. (Equation 26) a ′ = a × t ＾ 4 (Equation 27) b ′ = b × t ＾ 6 Further, the conversion elliptic curve calculation unit 230 calculates the element Gt = (xt0) on the conversion elliptic curve Et corresponding to the element G. , Yt0) is calculated as follows. (Equation 28) xt0 = t ＾ 2 × x0 (Equation 29) yt0 = t ＾ 3 × y0 Note that an arbitrary point on the elliptic curve E is determined by the parameters a ′ and b ′ generated as described above. Transformed elliptic curve E
Converted to one point on t. (Parameter Sending Unit 240) Parameter Sending Unit 240
Sends the calculated parameters a ′ and b ′ of the converted elliptic curve Et and the element Gt (xt0, yt0) to the external device. 2. Operation of Elliptic Curve Converter 200 (Overall Operation of Elliptic Curve Converter 200) The overall operation of the elliptic curve converter 200 will be described with reference to the flowchart shown in FIG.

The parameter receiving section 210 receives a prime number p and parameters a and b of the elliptic curve E from an external device (step S301), and receives an element G on the elliptic curve (step S302). Next, the conversion coefficient acquisition unit 2
20 calculates a conversion coefficient t (step S303), and the conversion elliptic curve calculation unit 230 calculates the conversion elliptic curve Et corresponding to the parameters a ′ and b ′ of the conversion elliptic curve Et formed on the finite field GF (p) and the element G. Gt = (xt0,
yt0) (step S304), and the parameter sending unit 240 sends the calculated parameters a ′ and b ′ of the converted elliptic curve Et and the original Gt (xt0, yt0) to the external device (step S304). Step S305). (Operation of Conversion Coefficient Acquisition Unit 220) Next, the operation of the conversion coefficient acquisition unit 220 will be described with reference to the flowchart shown in FIG.

The conversion coefficient obtaining unit 220 sets i to a value of 0 (step S311). Next, the conversion coefficient acquisition unit 2
20 determines whether the function T (i) satisfies −2 31 + 1 ≦ T (i) ≦ 2 ＾ 31−1, and if not (step S312), terminates the process. If it satisfies (step S312), a transform coefficient t that satisfies T (i) = t ＾ 4 × a (mod p) is calculated (step S313), and the calculated transform coefficient t is calculated on the finite field GF (p). It is determined whether or not the element is an element. If the element is an element on the finite field GF (p) (step S314), the process ends. Finite field GF (p)
If it is not the upper element (step S314), 1 is added to i (step S315), and control is returned to step S312 again. (Operation of Conversion Elliptic Curve Calculation Unit 230) Next, the operation of the conversion elliptic curve calculation unit 230 will be described with reference to the flowchart shown in FIG.

The conversion elliptic curve calculation unit 230 calculates the finite field GF
(P) Calculates the parameter a ′ = a × t 変 換 4 of the transformed elliptic curve Et (step S321), and calculates the parameter b ′ = b × t ＾ 6 (step S32).
2). Further, the conversion elliptic curve calculation unit 230 calculates the element Gt on the conversion elliptic curve Et corresponding to the element G = (xt0, yt0).
Xt0 = t ＾ 2 × x0 is calculated (step S3
23), yt0 = t ＾ 3 × y0 is calculated (step S)
324). 3. Proof that the transformed elliptic curve Et and the elliptic curve E are isomorphic. Here, the transformed elliptic curve Et: y ′ ＾ 2 = x ′ ＾ 3 + a
× t ＾ 4 × x ′ + b × t ＾ 6 and the elliptic curve E: y ＾ 2 =
Prove that x ＾ 3 + a × x + b is isomorphic. In the following, the calculation on the elliptic curve is performed on affine coordinates.

An arbitrary point P (x0, y0) on the elliptic curve E
I take the. At this time, since the point P is a point on E, (Equation 30) satisfies y0 ＾ 2 = x0 ＾ 3 + a × x0 + b. By this conversion, the point P becomes the point P ′ (x
0 ′, y0 ′) = (t ＾ 2 × x0, t ＾ 3 × y0).

Here, when t ＾ 6 is applied to both sides of Equation 30, t ＾ 6 × y0 ＾ 2 = t ＾ 6 × x0 ＾ 3 + t ＾ 6 × a × x
0 + t ＾ 6 × b is obtained. This equation can be modified as follows. (T ＾ 3 × y0) ＾ 2 = (t ＾ 2 × x0) ＾ 3 + a × t
{4 × (t ＾ 2 × x0) + b × t ＾ 6 This equation can be further modified as follows.

Y0 '＾ 2 = x0' ＾ 3 + a × t ＾ 4 × x
0 ′ + b × t ＾ 6 This indicates that the point P ′ is on the transformed elliptic curve Et. In addition, from the point on the elliptic curve E, the transformed elliptic curve E
Conversion to a point on t is (x, y) → (x ′, y ′) = (t ＾ 2 × x, t ＾ 3 ×
y) is indicated by Here, since t ≠ 0, it is easily understood that the following transformation of a point from the point on the transformed elliptic curve Et to the point on the elliptic curve E is an inverse transformation of the above transformation.

(X ′, y ′) → (x, y) = (x ′ /
(T ＾ 2), y ′ / (t ＾ 3)) From the above, the points on the elliptic curve E and the transformed elliptic curve Et
It can be seen that the above points correspond one-to-one. Next, any two different points P = (x1, y) on the elliptic curve E
1), Q = (x2, y2), R = P + Q, R
Are (x3, y3). At this time, as described above, x3 = {(y2-y1) / (x2-x1)} 2-x1
−x2 y3 = {(y2-y1) / (x2-x1)} (x1-x
3) -y1

Next, by the transformation of the elliptic curve used in the present invention, the points P, Q and R on the elliptic curve E are changed to the points P ′, Q ′ and R on the transformed elliptic curve Et, respectively. '. Here, the coordinates of point P ′, point Q ′, and point R ′ are (x1 ′, y1 ′), (x2 ′, y
2 ′) and (x3 ′, y3 ′). At this time, x1 ′ = t ＾ 2 × x1 y1 ′ = t ＾ 3 × y1 x2 ′ = t ＾ 2 × x2 y2 ′ = t ＾ 3 × y2 x3 ′ = t ＾ 2 × x3 y3 ′ = t ＾ 3 × y3 holds.

Also, R ″ = P ′ + Q ′, where
The addition operation here indicates addition on the transformed elliptic curve Et. Assuming that the coordinates of R ″ are (x3 ″, y3 ″), x3 ″ = {(y2′−y1 ′) / (x2′−x1 ′)}
{2-x1'-x2'y3 "= {(y2'-y1 ') / (x2'-x1')}
(X1'-x3 ')-y1'.

Here, x1 ′, y1 ′,
x2 ′ and y2 ′ are respectively defined as x1 and y as described above.
When expressed using 1, x2, y2, x3 ″ = {(t ＾ 3 × y2-t ＾ 3 × y1) / (t ＾ 2 × x2−t ＾ 2 × x1)｝ ＾ 2-t ＾ 2 × x1-t ＾ 2 × x2 = ｛t (y2-y1) / (x2-x1)｝ ＾ 2-t ＾ 2 × x1−t ＾ 2 × x2 = t ＾ 2 × ｛｛(y2-y1) / ( x2-x1) {2-x1-x2} = t {2 × x3 = x3′y3 ″ = {(t ＾ 3 × y2-t ＾ 3 × y1) / (t ＾ 2 × x2−t ＾ 2 × x1)｝ × (t ＾ 2 × x1-t ＾ 2 × x3) −t ＾ 3 × y1 = {t (y2-y1) / (x2-x1)} × t ＾ 2 (x1-x3) −t ＾ 3 × y1 = t {3 × {(y2-y1) / (x2-x1)} × (x1-x3) −y1} = t ＾ 3 × y3 = y3 ′ Therefore, it can be seen that R ′ and R ″ represent the same point.

From the above, it can be seen that the addition operation on the elliptic curve is preserved in this conversion as well. Next, Q =
The case of P, that is, the doubling formula, will be described. As before, for any point P on the elliptic curve E,
It is assumed that R = P + P, and the points P and R on the elliptic curve E are converted into points P ′ and R ′ on the converted elliptic curve Et, respectively, by the conversion of the elliptic curve used in the present invention. .
Here, the coordinates of the point P, the point R, the point P ′, and the point R ′ are (x1, y1), (x3, y3), (x1 ′, y
1 ′) and (x3 ′, y3 ′). At this time, x1 ′ = t ＾ 2 × x1 y1 ′ = t ＾ 3 × y1 x3 ′ = t ＾ 2 × x3 y3 ′ = t ＾ 3 × y3. Also, it is assumed that R ″ = P ′ + P ′.

However, the doubling operation here indicates a doubling operation on the transformed elliptic curve Et. The coordinates of point R ″ are (x
3 ″, y3 ″), x3 ″ = {(3x1 ′ ＾ 2 + a) / 2y1 ′｝ ＾ 2-2
x1′y3 ″ = {(3x1 ′ {2 + a) / 2y1 ′} (x1 ′
−x3 ′) − y1 ′. Here, x1 ′ and y1 ′ are respectively x1 and y
When expressed as above using 1, x3 ″ = {(t ＾ 2 × 3x1) ＾ 2 + a｝ / (2 × t ＾ 3 × y1)｝ ＾ 2−2 × t ＾ 2 × x1 = t ＾ 2 ｛(3x1 ＾ 2 + a) / y1｝ ＾ 2-t ＾ 2 × 2x1 = t ＾ 2 ｛｛(3x1 ＾ 2 + a) / y1｝ ＾ 2-2x1｝ = t ＾ 2 × x3 = ｛t (y2-y1 ) / (X2-x1) {2-t} 2 * x1-t {2 * x2 = t {2} (y2-y1) / (x2-x1) {2-x1-x2} = t} 2 × x3 = x3′y3 ″ = {(t ＾ 2 × 3x1) ＾ 2 + a} / (2 × t ＾ 3 × y1)｝ × (t ＾ 2 × x1-t ＾ 2 × x3) −t ＾ 3 × y1 = t ＾ 3 ｛(3x1 ＾ 2 + a) / 2y1｝ (x1−x3) −t ＾ 3 × y1 = t ＾ 3 ｛｛(3x1 ＾ 2 + a) / 2y1｝ (x1−x3) −y1｝ = t ＾ 3 × y3 = y3 ′. Therefore, it can be seen that R ′ and R ″ represent the same point.

From the above, it can be seen that the doubling operation on the elliptic curve is preserved in this conversion as well. As described above, it has been proved that the elliptic curve E and the transformed elliptic curve Et generated by the transformation used in the present invention have the same shape. 4. Evaluation of Calculation Amount When Using Conversion Elliptic Curve Et According to the above embodiment, the parameter a ′ of the conversion elliptic curve Et is taken to be 32 bits or less. Become. Therefore, the calculation amount of the addition on the elliptic curve is 12Mul + 4Sq, which is 2
The calculation amount of the multiplication is 3Mul + 6Sq. In this way, when compared with the case where the parameter a of the elliptic curve E is a value close to 160 bits, 1Mul
It can be seen that the amount of calculation for each minute can be reduced.

As described above, the function T (i) is i
When = 0, it has a value in order from a small absolute value to a large value except for having a value of -3,
Since you can refer to the values in ascending order of absolute value,
An appropriate conversion elliptic curve can be selected in order from the conversion elliptic curve with a smaller amount of calculation. According to the above embodiment, the parameter a ′ of the transformed elliptic curve Et is used.
Is −3, Expression 18 is expressed as follows: M = 3 × X1 ＾ 2 + a ′ × Z1 ＾ 4 = 3 × X1 ＾ 2-3 × Z1 ＾ 4 = 3 × (X1 + Z1 ＾ 2) × (X1−Z1 ＾ 2 ) And can be transformed.

In the last equation, the calculation amount is 1 Mul +
1Sq. Therefore, the computational complexity of the addition on the elliptic curve is
It becomes 12Mul + 4Sq, and the calculation amount of the doubling is 4Mu.
1 + 4Sq. As described above, it can be seen that the amount of calculation for 2Sq can be reduced in the doubling operation as compared with the related art. As described above, the function T (i) has a value of -3 when i = 0, and the function
Starts from i = 0 and adds the value of i one by one,
Since the value of the function T (i) is referred to, the value of -3 is referred first. Therefore, in the doubling operation, compared to the conventional case,
Since the case where the calculation amount for Sq can be reduced is verified first, there is a possibility that the most appropriate transformed elliptic curve can be detected at one time.

Therefore, by using the transformed elliptic curve shown in the present embodiment, the calculation on the elliptic curve can be speeded up. 5. Modification The conversion coefficient acquisition unit 220 calculates the conversion coefficient t as follows.
May be determined. The conversion coefficient acquisition unit 220 includes a random number generation unit, and the random number generation unit includes a finite field GF (p)
The above element u (u ≠ 0) is randomly generated. Next, the conversion coefficient acquisition unit 220 determines whether or not the element u satisfies (Equation 31) −2 ＾ 31 + 1 ≦ u ＾ 4 × a (mod p) ≦ 2 ＾ 31-1. When it is determined that the element u satisfies Equation 31, the element u is adopted as the conversion coefficient t.
If it is determined that the element u does not satisfy the expression 31, again,
The random number generation unit randomly generates an element u, and the transform coefficient acquisition unit 220 determines whether the element u satisfies Equation 31.

The transform coefficient acquiring section 220 repeats the generation of the element u by the random number generation section and the determination of whether or not the element 31 satisfies the equation 31 until an element u satisfying the equation 31 is found. Further, the transform coefficient acquisition unit 220 may use (Expression 32) u ＾ 4 × a (mod p) = − 3 instead of Expression 31. 6. Example of Application of Elliptic Curve Transformation Device 200 A key sharing system to which the above-described elliptic curve transformation device 200 is applied will be described with reference to a sequence diagram shown in FIG.

User A 450, management center 460, and user B 470 are connected via a network. (1) Selection of Elliptic Curve by Management Center 460 The management center 460 selects a prime number p and generates a finite field GF
(P) The upper elliptic curve E is selected, the base point of E is set to G, and the order of E is set to q (step S411). That is, q is the smallest positive integer that satisfies (Equation 2) q * G = 0.

Here, E: y ＾ 2 = x ＾ 3 + a
× x + b, and G = (x0, y0). next,
The management center 460 converts p, E, and G into the elliptic curve conversion device 2
00 (step S412).

(2) Generation of a Converted Elliptic Curve by the Elliptic Curve Converter 200 The elliptic curve converter 200 calculates a converted elliptic curve Et and calculates an element Gt (step S421). Here, Et: y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, Gt = (xt0, yt0), xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0.

Next, the elliptic curve conversion device 200 calculates Et,
Gt is sent to the management center 460 (step S42).
2). The management center 460 sends P, Et, and Gt to each user (step S413). (3) Setting of secret key and generation of public key by user User A450 sets secret key xA (step S4).
01), the user B470 sets the secret key xB (step S431).

The user A 450 obtains the public key Y from the following equation.
A is calculated (step S402), and the public key YA is sent to the user B470 (step S403). YA = xA * Gt Further, the user B 470 calculates the public key YB by the following equation (step S432), and transfers the public key YB to the user A45.
0 (step S433).

YB = xB * Gt (4) Generation of Shared Key by Each User The user A450 calculates a shared key using xA * YB (step S404). Further, the user B470 calculates the shared key by xB * YA (step S434).

Here, the shared key xA * YB calculated by the user A450 can be transformed as xA * YB = (xA × xB) * Gt. The shared key xB * YA calculated by the user B470 is Can be transformed as follows.

Therefore, it is clear that the shared key xA * YB calculated by the user A450 is the same as the shared key xB * YA calculated by the user B470. 7. Another embodiment of another modified example may be the elliptic curve conversion method described above. A computer-readable recording medium including an elliptic curve conversion program for causing a computer to execute the elliptic curve conversion method may be used. Further, the elliptic curve conversion program may be transmitted via a communication line.

The above-described elliptic curve conversion device may be applied to an encryption device, a decryption device, or an encryption system including an encryption device and a decryption device. In addition, the above-described elliptic curve conversion device may be applied to a digital signature device, a digital signature verification device, or a digital signature system including a digital signature device and a digital signature verification device.

Further, the encryption device, the decryption device, the digital signature device, the digital signature verification device, or the key sharing device previously stores the parameters a ′ and b ′ of the elliptic curve calculated by the elliptic curve conversion device and the element Gt. The encryption, decryption, digital signature, digital signature verification, or key sharing may be performed using the stored parameters a ′ and b ′ of the elliptic curve and the element Gt.

Further, the above-described embodiment and a plurality of modifications thereof may be combined.

[0070]

The present invention relates to an elliptic curve conversion apparatus for converting one elliptic curve E to generate another elliptic curve Et. The apparatus comprises a prime number p, a parameter a and a Means for receiving a parameter b and an element G as a base point, wherein the elliptic curve E is a finite field GF
(P), represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, and G = (x0, y
0) and a means for acquiring a transform coefficient t existing on the finite field GF (p), wherein the transform coefficient t
Is t ≠ 0 and t ＾ 4 × a (mod p)
Is a conversion coefficient obtaining unit that satisfies the condition that the number of digits is smaller than the prime number p, and using the obtained conversion coefficient t, the parameters a ′ and b ′ of the elliptic curve Et by the following equation: Means for calculating a new base point source Gt, wherein a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt
0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, elliptic curve E
t is defined on a finite field GF (p), and y ′ ＾ 2 =
x ′ ＾ 3 + a ′ × x ′ + b ′, xt0, yt
Numeral 0 includes an elliptic curve calculation unit that is an x coordinate value and a y coordinate value of the element Gt, and an output unit that outputs the calculated parameters a ′ and b ′ and the element Gt to the outside.

According to this configuration, it is possible to provide an elliptic curve having the same security as a randomly configured elliptic curve and enabling high-speed operation in a utilization device, and its practical value is very large. . Here, p is a 160-bit prime number, and the transform coefficient obtaining unit calculates t ＾ 4 × a
A conversion coefficient t that satisfies the condition that (mod p) is a number of 32 bits or less may be obtained.

When the elliptic curve converted by the elliptic curve converter is used in the utilization device, the parameter a of the elliptic curve before conversion is 16 in the doubling on the elliptic curve.
It can be seen that the amount of calculation for 1 Mul can be reduced as compared with the case where a value close to 0 bit is taken. Here, the conversion coefficient acquisition unit may acquire the conversion coefficient t that satisfies the condition that t ＾ 4 × a (mod p) becomes −3.

When the elliptic curve converted by the elliptic curve conversion device is used in the utilization device, it can be seen that, in the doubling on the elliptic curve, the calculation amount for 2Sq can be reduced as compared with the conventional case. Here, the conversion coefficient acquisition means sets the initial value as −3 as the variable T, and takes values other than the initial value in order from the smaller number of digits to the larger value, T = t ＾ 4 × a By repeatedly determining whether or not the condition (mod p) is satisfied,
The conversion coefficient t may be obtained.

According to this configuration, the function T (i) is obtained when i =
When it is 0, it has a value of -3, and the conversion coefficient acquisition unit 2
20 starts with i = 0 and refers to the value of the function T (i) while adding the value of i one by one, so the value of -3 is referred to first. Therefore, in the doubling operation, the case where the amount of calculation for 2Sq can be reduced compared to the conventional case is verified first, so that there is a possibility that the most appropriate transformed elliptic curve can be detected at one time. Also, the function T (i) has a value in order from a small absolute value to a large value, except that the function T (i) has a value of −3 when i = 0. Can be referred to in ascending order, so that an appropriate transformed elliptic curve can be selected in order from the transformed elliptic curve with a smaller amount of calculation.

Also, the present invention provides an elliptic curve conversion device that converts one elliptic curve E to generate another elliptic curve Et, and a utilization device that uses the generated elliptic curve Et. A utilization system, wherein the utilization device includes a first output unit, a first reception unit, and a utilization unit;
The elliptic curve conversion device includes a second receiving unit, a conversion coefficient obtaining unit, an elliptic curve calculation unit, and a second output unit, wherein the first output unit includes a prime number p and a parameter a of the elliptic curve E.
And the parameter b and the element G as a base point are output to the elliptic curve converter, where the elliptic curve E
Is defined on a finite field GF (p), and y ＾ 2 = x ＾ 3 +
ax + b, the element G exists on the elliptic curve E, and G
= (X0, y0), the second receiving means receives the prime number p, the parameters a and b of the elliptic curve E, and the element G from the utilization device, and the transform coefficient obtaining means , Obtain the transform coefficient t existing on the finite field GF (p), where the transform coefficient t is t ≠ 0 and t
＾ 4 × a (mod p) satisfies the condition that the number of digits is smaller than that of the prime number p.
Using the obtained transform coefficient t, the parameters a ′ and b ′ of the elliptic curve Et and the element Gt as a new base point are calculated by the following equation, and a ′ = a × t ＾ 4,
b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t
＾ 3 × y0, where the elliptic curve Et is a finite field GF
(P), defined as above, y ′ ＾ 2 = x ′ ＾ 3 + a ′ ×
xt + b ′, where xt0 and yt0 are elements G
t is the x-coordinate value and y-coordinate value, and the second output means is
The calculated parameters a ′ and b ′ and the original Gt are output to the use device, and the first receiving unit receives the output parameters a ′ and b ′ and the original Gt,
The use means uses an elliptic curve defined by the prime number p, the received parameters a ′ and b ′, and an element Gt as a base point to calculate an elliptic curve defined on a finite field GF (p). Performs encryption, decryption, digital signature, digital signature verification or key sharing based on the discrete logarithm problem as a basis for security.

According to this configuration, an elliptic curve having the same security as a randomly configured elliptic curve and enabling high-speed calculation can be used, and its practical value is very large. Here, p is a 160-bit prime number,
The conversion coefficient acquiring means is t ＾ 4 × a (mod p)
May be obtained as a conversion coefficient t that satisfies the condition that is less than or equal to 32 bits.

According to this configuration, since the converted elliptic curve is used, in the doubling on the elliptic curve, the parameter a of the elliptic curve before the conversion takes 1 Mul compared with the case where the parameter a of the elliptic curve takes a value close to 160 bits. It can be seen that the amount of calculation for each minute can be reduced. Here, the conversion coefficient acquiring means is t ＾ 4 ×
A conversion coefficient t that satisfies the condition that a (mod p) becomes −3 may be obtained.

According to this configuration, since the transformed elliptic curve is used, it can be seen that the calculation amount for 2Sq can be reduced in the doubling on the elliptic curve as compared with the conventional case. Here, the conversion coefficient acquisition means sets the initial value as −3 as the variable T, and takes values other than the initial value in order from the smaller number of digits to the larger value, T = t ＾ 4 × a
The determination of whether or not the condition (mod p) is satisfied may be repeated to obtain the conversion coefficient t.

According to this configuration, the function T (i) is obtained when i =
When it is 0, it has a value of -3, and the conversion coefficient acquisition unit 2
20 starts with i = 0 and refers to the value of the function T (i) while adding the value of i one by one, so the value of -3 is referred to first. Therefore, in the doubling operation, the case where the amount of calculation for 2Sq can be reduced compared to the conventional case is verified first, so that there is a possibility that the most appropriate transformed elliptic curve can be detected at one time. Also, the function T (i) has a value in order from a small absolute value to a large value, except that the function T (i) has a value of −3 when i = 0. Can be referred to in ascending order, so that an appropriate transformed elliptic curve can be selected in order from the transformed elliptic curve with a smaller amount of calculation.

Further, the present invention comprises a second receiving means, a transform coefficient obtaining means, an elliptic curve calculating means, and a second output means,
A usage device that receives and uses the generated elliptic curve Et from an elliptic curve conversion device that converts one elliptic curve E to generate another elliptic curve Et, wherein the usage device includes a 1 output means, first receiving means, and utilization means, wherein the first output means converts the prime number p, the parameters a and b of the elliptic curve E, and the element G as a base point into the elliptic curve conversion device. Where the elliptic curve E is defined on a finite field GF (p) and y ＾ 2 = x
元 3 + ax + b, the element G exists on the elliptic curve E, and is represented by G = (x0, y0), and the second receiving unit sends a prime number p and a parameter of the elliptic curve E from the utilization device. a and the parameter b and the element G are received, and the transform coefficient acquiring means acquires a transform coefficient t existing on the finite field GF (p), where the transform coefficient t is t ≠ 0. ,
In addition, t ＾ 4 × a (mod p) satisfies the condition that the number of digits is smaller than that of the prime number p, and the elliptic curve calculation means uses the obtained conversion coefficient t to obtain the following equation: , The parameters a ′ and b ′ of the elliptic curve Et and the element Gt
A ′ = a × t ＾ 4, b ′ = b × t ＾ 6, x
t0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, where
The elliptic curve Et is defined on a finite field GF (p), and y ′
＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, x
t0 and yt0 are the x coordinate value and the y coordinate value of the element Gt, respectively, and the second output means outputs the calculated parameters a ′ and b ′ and the element Gt to the use device,
The first receiving unit receives the output parameters a ′ and b ′ and the element Gt, and the using unit generates a prime p
And an elliptic curve defined by the received parameters a ′ and b ′ and an element Gt as a base point,
Based on an operation on an elliptic curve defined on a finite field GF (p), encryption, decryption, digital signature, digital signature verification, or key agreement based on the discrete logarithm problem is performed.

According to this configuration, an elliptic curve having the same security as a randomly configured elliptic curve and enabling high-speed calculation can be used, and its practical value is very large. In addition, the present invention is a use device that uses an elliptic curve Et generated by converting one elliptic curve E, wherein the use device includes parameters a ′ and b ′ of the elliptic curve Et and a base point. Finite element GF (p) using storage means for storing an element Gt of, an elliptic curve defined by the stored parameters a ′ and b ′, and an element Gt as a base point. And means for performing encryption, decryption, digital signature, digital signature verification or key agreement based on the discrete logarithm problem based on the operation on the elliptic curve defined above. a ′ and b ′ and the element Gt are generated by an elliptic curve conversion device, the elliptic curve conversion device includes a conversion coefficient acquisition unit and an elliptic curve calculation unit, p is a prime number, and the elliptic curve E is a finite Defined on the field GF (p) , Y ^ 2 =
x ＾ 3 + ax + b, an element G as a base point exists on the elliptic curve E, G = (x0, y0), and the transform coefficient obtaining means exists on a finite field GF (p). To obtain a conversion coefficient t, where
t ≠ 0 and t ＾ 4 × a (mod p)
The elliptic curve calculation unit satisfies the condition that the number of digits is smaller than the prime number p, and the elliptic curve calculation unit uses the acquired conversion coefficient t to calculate the parameters a ′ and b ′ of the elliptic curve Et according to the following equation. , An element Gt as a new base point, and a ′ = a × t ＾ 4, b ′ = b × t × 6, xt0 = t
＾ 2 × x0, yt0 = t ＾ 3 × y0, where the elliptic curve Et is defined on a finite field GF (p), and y ′ ＾ 2 =
x ′ ＾ 3 + a ′ × x ′ + b ′, xt0, y
t0 is the x coordinate value and the y coordinate value of the original Gt, respectively.

According to this configuration, an elliptic curve having the same security as a randomly configured elliptic curve and enabling high-speed calculation can be used, and its practical value is very large. The present invention also relates to an elliptic curve conversion method for converting one elliptic curve E to generate another elliptic curve Et. The method comprises the steps of: providing a prime number p, and parameters a and b of the elliptic curve E from the outside. , Ex-G as base ponto
Where the elliptic curve E is defined on the finite field GF (p) and is represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, and G = (X0,
y0) and a step of acquiring a transform coefficient t existing on the finite field GF (p), where the transform coefficient t is t ≠ 0 and t ＾ 4 × a ( mo
d p) is calculated by the following equation using the conversion coefficient calculation step satisfying the condition that the number of digits is smaller than the prime number p, and the obtained conversion coefficient t. And an element Gt as a new base point, wherein a ′ = a × t ＾
4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0
= T ＾ 3 × y0, the elliptic curve Et is defined on a finite field GF (p), and y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ +
b ′, xt0 and yt0 are respectively x of the original Gt
An elliptic curve calculation step of coordinate values and y-coordinate values; and an output step of outputting the calculated parameters a ′ and b ′ and the element Gt to the outside.

Using this method, it is possible to generate an elliptic curve having the same security as a randomly configured elliptic curve and enabling a high-speed operation in a utilization device, and its practical value is extremely high. large. Further, the present invention is a computer-readable recording medium which stores an elliptic curve conversion program for converting one elliptic curve E to generate another elliptic curve Et, wherein the program comprises:
Externally receiving a prime number p, parameters a and b of the elliptic curve E, and an element G as a base point, wherein the elliptic curve E is a finite field GF (p)
Defined above, represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, a receiving step represented by G = (x0, y0), and a finite field GF (p) Obtaining a conversion coefficient t existing in the conversion coefficient t
Is t ≠ 0 and t ＾ 4 × a (mod p)
Is a conversion coefficient calculating step that satisfies the condition that the number of digits is smaller than the prime number p, and the obtained conversion coefficient t
And the parameter a ′ of the elliptic curve Et by the following equation:
And b ′ and an element Gt as a new base point, wherein a ′ = a × t ＾ 4, b ′ =
b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 ×
y0 and the elliptic curve Et are defined on a finite field GF (p) and are represented by y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, where xt0 and yt0 are x coordinate values of the original Gt, respectively. , Y
An elliptic curve calculation step as a coordinate value, and an output step of outputting the calculated parameters a ′ and b ′ and the element Gt to the outside are included.

By executing a program recorded on this medium by a computer, an elliptic curve which has the same security as a randomly constructed elliptic curve and enables high-speed operation in a utilization apparatus is generated. And its practical value is very large.

[Brief description of the drawings]

FIG. 1 is a sequence diagram showing a procedure of a digital signature scheme using an ElGamal signature.

FIG. 2 is a block diagram of an elliptic curve conversion device as one embodiment according to the present invention.

FIG. 3 is a table illustrating a function T (i) used in the elliptic curve conversion device shown in FIG. 2;

4 is a flowchart showing the operation of the elliptic curve conversion device shown in FIG.

FIG. 5 is a flowchart showing an operation of a conversion coefficient acquisition unit of the elliptic curve conversion device shown in FIG.

6 is a flowchart showing the operation of a conversion elliptic curve calculation unit of the elliptic curve conversion device shown in FIG.

7 is a sequence diagram showing an operation procedure of a key sharing system to which the elliptic curve conversion device shown in FIG. 2 is applied.

[Explanation of symbols]

 Reference Signs List 200 Elliptic curve conversion device 210 Parameter reception unit 220 Conversion coefficient acquisition unit 230 Conversion elliptic curve calculation unit 240 Parameter transmission unit

Claims (12)

[Claims] 1. An elliptic curve conversion device for converting one elliptic curve E to generate another elliptic curve Et, comprising: a prime number p; a parameter a and a parameter b of the elliptic curve E; A means for receiving an element G as a base point, wherein an elliptic curve E is defined on a finite field GF (p), represented by y ＾ 2 = x ＾ 3 + ax + b, and the element G
Is a receiving means that exists on the elliptic curve E and is represented by G = (x0, y0), and a means for acquiring the transform coefficient t that exists on the finite field GF (p), and the transform coefficient t is , T ≠ 0, and t ＾
4 × a (mod p) is a conversion coefficient acquisition unit that satisfies the condition that the number of digits is smaller than the prime number p. Using the acquired conversion coefficient t, the parameter of the elliptic curve Et is calculated by the following equation. means for calculating a ′ and b ′ and a new base point source Gt, wherein a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, the elliptic curve Et is defined on a finite field GF (p), and y ′
＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, x
t0 and yt0 are provided with an elliptic curve calculation unit that is an x coordinate value and a y coordinate value of the element Gt, respectively, and an output unit that outputs the calculated parameters a ′ and b ′ and the element Gt to the outside. An elliptic curve conversion device characterized by the above-mentioned. 2. p is a 160-bit prime number, and said transform coefficient obtaining means is t ＾ 4 × a (mod p)
2. The elliptic curve conversion device according to claim 1, wherein a conversion coefficient t that satisfies a condition that is smaller than or equal to 32 bits is obtained. 3. The method according to claim 2, wherein the conversion coefficient acquiring unit is configured to be t ＾ 4 × a.
2. The elliptic curve conversion device according to claim 1, wherein a conversion coefficient t that satisfies a condition that (mod p) is -3 is obtained. 4. The transform coefficient obtaining means sets an initial value to -3 as a variable T, and takes values other than the initial value in order from a smaller number of digits to a larger value, T = t ＾ 4 The elliptic curve conversion device according to claim 1, wherein the conversion coefficient t is obtained by repeating determination of whether or not a condition of × a (mod p) is satisfied. 5. An elliptic curve utilization system comprising: an elliptic curve conversion device that converts one elliptic curve E to generate another elliptic curve Et; and a utilization device that uses the generated elliptic curve Et. The utilization device includes a first output unit, a first reception unit, and a utilization unit, and the elliptic curve conversion device includes a second reception unit, a conversion coefficient acquisition unit, an elliptic curve calculation unit, a second output unit, The first output means includes a prime number p, a parameter a and a parameter b of the elliptic curve E, and an element G as a base point.
Is output to the elliptic curve conversion device, where the elliptic curve E is defined on a finite field GF (p), represented by y ＾ 2 = x ＾ 3 + ax + b. Exists and is represented by G = (x0, y0), wherein the second receiving means receives a prime number p, a parameter a and a parameter b of an elliptic curve E, and an element G from the use device; The coefficient obtaining means obtains a conversion coefficient t existing on the finite field GF (p), where the conversion coefficient t is t ≠ 0 and t ＾ 4 ×
a (mod p) satisfies the condition that the number of digits is smaller than the prime number p, and the elliptic curve calculation means uses the obtained conversion coefficient t to calculate the elliptic curve Et by the following equation: Calculate parameters a ′ and b ′ and an element Gt as a new base point, a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, where the elliptic curve Et is defined on a finite field GF (p) and is represented by y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′. Xt0 and yt0 are respectively The x-coordinate value and the y-coordinate value of the element Gt, the second output means outputs the calculated parameters a ′ and b ′ and the element Gt to the use device, and the first receiving means Receiving the output parameters a ′ and b ′ and the element Gt, the use unit outputs a prime p and the received parameter Using the elliptic curve defined by the parameters a ′ and b ′ and the element Gt as a base point, the discrete logarithm problem is security based on an operation on the elliptic curve defined on the finite field GF (p). An elliptic curve utilization system characterized by performing encryption, decryption, digital signature, digital signature verification, or key sharing based on the above. 6. p is a 160-bit prime number, and the transform coefficient obtaining means is t ＾ 4 × a (mod p).
The elliptic curve utilization system according to claim 5, wherein a conversion coefficient t that satisfies a condition that が is a number of 32 bits or less is obtained. 7. The method according to claim 1, wherein the conversion coefficient acquiring means is t ＾ 4 × a
The elliptic curve utilization system according to claim 5, wherein a conversion coefficient t that satisfies a condition that (mod p) is -3 is acquired. 8. The transform coefficient obtaining means sets an initial value as -3 as a variable T, and takes values other than the initial value in order from a smaller number of digits to a larger value, T = t ＾ 4 The elliptic curve utilization system according to claim 5, wherein the conversion coefficient t is obtained by repeatedly determining whether or not the condition of xa (mod p) is satisfied. 9. An elliptic curve conversion, comprising: a second receiving means, a conversion coefficient obtaining means, an elliptic curve calculating means, and a second output means, for converting one elliptic curve E to generate another elliptic curve Et. A utilization device that receives and uses the generated elliptic curve Et from a device, wherein the utilization device includes a first output unit, a first reception unit, and a utilization unit, wherein the first output unit includes: The prime number p, the parameters a and b of the elliptic curve E, and the element G as a base point
Is output to the elliptic curve conversion device, where the elliptic curve E is defined on a finite field GF (p), represented by y ＾ 2 = x ＾ 3 + ax + b. Exists and is represented by G = (x0, y0), wherein the second receiving means receives a prime number p, a parameter a and a parameter b of an elliptic curve E, and an element G from the use device; The coefficient obtaining means obtains a conversion coefficient t existing on the finite field GF (p), where the conversion coefficient t is t ≠ 0 and t ＾ 4 ×
a (mod p) satisfies the condition that the number of digits is smaller than the prime number p, and the elliptic curve calculation means uses the obtained conversion coefficient t to calculate the elliptic curve Et by the following equation: The parameters a ′ and b ′ and the element Gt are calculated, a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, where Where the elliptic curve Et is defined on a finite field GF (p) and is represented by y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, where xt0 and yt0 are the x coordinate values of the element Gt, respectively. , Y coordinate values, the second output means outputs the calculated parameters a ′ and b ′ and the original Gt to the use device, and the first receiving means outputs the output parameter a 'And b' and the element Gt, and the use means determines an ellipse defined by the prime number p and the received parameters a 'and b' Using a line and an element Gt as a base point, an encryption, decryption, and digital signature based on a discrete logarithm problem based on an operation on an elliptic curve defined on a finite field GF (p) A verification device for performing digital signature verification or key sharing. 10. A utilization device using an elliptic curve Et generated by converting one elliptic curve E, wherein the utilization device comprises: parameters a ′ and b ′ of the elliptic curve Et; A finite field GF (p) is obtained by using storage means for storing the element Gt, p, an elliptic curve defined by the stored parameters a 'and b', and the element Gt as a base point. A means for performing encryption, decryption, digital signature, digital signature verification or key sharing based on the discrete logarithm problem based on the operation on the elliptic curve defined above, wherein the parameter a 'And b' and the element Gt are generated by an elliptic curve converter, the elliptic curve converter includes a conversion coefficient acquisition unit and an elliptic curve calculation unit, p is a prime number, and the elliptic curve E is a finite field. Defined on GF (p) Is, y ^ 2
= X ＾ 3 + ax + b, an element G as a base point exists on the elliptic curve E, and is represented by G = (x0, y0). Obtain the existing conversion coefficient t, where the conversion coefficient t is t ≠ 0
And t ＾ 4 × a (mod p) is a prime number p
The elliptic curve calculation means satisfies the condition that the number of digits is smaller than the above, and the parameters a ′ and b ′ of the elliptic curve Et and the new And an element Gt as a base point is calculated as follows: a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, where ellipse The curve Et is defined on a finite field GF (p) and is represented by y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′. Xt0 and yt0 are the x coordinate value and y coordinate of the original Gt, respectively. Use device characterized by being a value. 11. An elliptic curve conversion method for converting one elliptic curve E to generate another elliptic curve Et, comprising: a prime number p; a parameter a and a parameter b of the elliptic curve E; Receiving an element G as a base point, wherein the elliptic curve E is a finite field GF (p)
Defined above, represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, and a receiving step represented by G = (x0, y0), and a finite field GF (p) Obtaining a conversion coefficient t existing in the following equation, wherein the conversion coefficient t is t ≠ 0, and
t ＾ 4 × a (mod p) is a conversion coefficient calculation step that satisfies the condition that the number of digits is smaller than the prime number p, and an elliptic curve Et is obtained by the following equation using the obtained conversion coefficient t. Calculating the parameters a ′ and b ′ and the original Gt as a new base point, where a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, elliptic curve Et is defined on a finite field GF (p), and is represented by y ′ ＾ 2 = x ′ ＾ 3 + a ′ × x ′ + b ′, and xt0, yt0 are , The x coordinate value of the original Gt, y
An elliptic curve conversion method, comprising: an elliptic curve calculation step as coordinate values; and an output step of outputting the calculated parameters a ′ and b ′ and an element Gt to the outside. 12. A computer-readable recording medium recording an elliptic curve conversion program for converting one elliptic curve E to generate another elliptic curve Et, wherein the program is: Receiving a prime number p, parameters a and b of the elliptic curve E, and an element G as a base point, wherein the elliptic curve E has a finite field GF (p)
Defined above, represented by y ＾ 2 = x ＾ 3 + ax + b, the element G exists on the elliptic curve E, and a receiving step represented by G = (x0, y0), and a finite field GF (p) Obtaining a conversion coefficient t existing in the following equation, wherein the conversion coefficient t is t ≠ 0, and
t ＾ 4 × a (mod p) is a conversion coefficient calculation step that satisfies the condition that the number of digits is smaller than the prime number p, and an elliptic curve Et is obtained by the following equation using the obtained conversion coefficient t. Calculating the parameters a ′ and b ′ and the original Gt as a new base point, where a ′ = a × t ＾ 4, b ′ = b × t ＾ 6, xt0 = t ＾ 2 × x0, yt0 = t ＾ 3 × y0, the elliptic curve Et is a finite field GF
(P), defined as above, y ′ ＾ 2 = x ′ ＾ 3 + a ′
× x ′ + b ′, where xt0 and yt0 are elliptic curve calculation steps that are the x-coordinate value and y-coordinate value of the element Gt, respectively, and the calculated parameters a ′ and b ′ and the element Gt An output step of outputting to a recording medium.