KR101214789B1 - Method of mapping messages to points on elliptic curve over GF(3^m) and pairing-based cryptosystem using it - Google Patents

Abstract

에서의 메시지 매핑 방법에 관한 것으로서, 메시지의 해쉬 값을 (x,y)로 표현되는 타원곡선 위의 좌표 중 y좌표에 대입하고, x좌표에 관한 방정식을 풂으로써, 타원곡선 식을 만족하는 x좌표를 연산하되, 타원곡선 식에서 x로 표현되는 항들 각각에 세제곱을 하여 방정식을 푸는 것을 특징으로 하며, 메시지 매핑에 사용되는 행렬의 크기를 줄여 역행렬을 빠르게 계산할 수 있으며, 역행렬을 저장하는데 작은 메모리 공간이 필요하게 된다. The present invention

A method of mapping a message in, wherein a hash value of a message is substituted into the y coordinate among the coordinates on the elliptic curve represented by (x, y), and the equation of the x coordinate is solved to satisfy the elliptic curve expression. Calculate the coordinates, solve the equation by cubed each of the terms represented by x in the elliptic curve equation, it is possible to quickly calculate the inverse matrix by reducing the size of the matrix used for message mapping, and to save the inverse matrix This is necessary.

Description

Method of mapping messages to points on elliptic curve over GF (3 ^ m) and pairing-based cryptosystem using it}

(=GF(3^m))에서의 메시지 매핑 방법에 관한 것으로서, 더욱 상세하게는 메시지 매핑에 사용되는 행렬의 크기를 줄여 역행렬을 빠르게 계산할 수 있으며, 역행렬을 저장하기 위해 사용하는 메모리 역시 작은 공간을 사용하는

에서의 메시지 매핑 방법 및 이를 이용한 페어링 암호 시스템에 관한 것이다.The present invention

Message mapping method in (= GF (3 ^ m)). More specifically, it is possible to quickly calculate the inverse by reducing the size of the matrix used for the message mapping. The memory used to store the inverse is also small. Using

The present invention relates to a message mapping method and a pairing encryption system using the same.

A finite field is a field in which the number of elements is finite. A sieve is a set that can freely perform arithmetic operations (addition, subtraction, multiplication, division) except division by zero. Therefore, the set of natural numbers or integers cannot be sieve because the result of division is not always included in the original set. The rational numbers and real numbers are not finite because they are sieves but infinite sets.

Finite bodies are characterized by their characteristics. A surface number is a prime number that is used by law in the modular operations that finite bodies have. When the surface number is p, the number of elements of the finite body becomes the power of the surface water, and a finite body having q = p ^m ( ^m ≧ 1) elements is denoted by F _q .

The simplest form of finite field is when m = 1, which can be expressed as F _q = {0,1,2, ..., p-1}, and the arithmetic operation between the elements is a modular operation using p as the law. Use

If m> 1, the element is expressed as a polynomial when it cannot be expressed as an integer only. There is an equivalence between finite bodies and sets of polynomials:

는 다항식을 f(x)로 나눈 나머지를 대표원소로 하는 유한 집합이다. 그러면 위의 동치 관계에 따라서

의 원소는 m-1차 이하의 다항식과 일대일 관계에 있으며, 다항식으로 표현된 원소들 사이의 연산은 f(x)를 법으로 하는 모듈라 연산이다. 즉, m차 이상의 다항식은 f(x)로 나눈 나머지를 유한체의 원소로 간주한다. Where f (x) is the m-th order contracting polynomial having the elements of F _p as a coefficient, and F _p [x] refers to the infinite set of all polynomials whose coefficients are elements of F _p ,

Is a finite set whose representative elements are the remainder of the polynomial divided by f (x). Then, according to the above equivalence

The elements of have a one-to-one relationship with the polynomial below m-1 order, and the operation between the elements represented by the polynomial is a modular operation using f (x) as a method. That is, a polynomial of m or more orders considers the remainder divided by f (x) as a finite element.

Meanwhile, pairing-based cryptosystem is one of the most actively researched fields in recent years. Pairing-based cryptosystem has a pairing function with bilinearity that sends two points on an elliptic curve as a finite element. It is a cryptographic system that is configured based on.

Despite efforts to improve pairing cryptographic computation time, the implementation of pairing cryptography is the largest computational burden for implementing pairing based cryptographic systems.

The pairing function is a function of groups G ₁ and G ₂ of elliptic curve points with decimal order q to group G _T of finite element elements. When the P ₁ and P ₂ can grow each G ₁ and the creation of G _2, it is assumed G _1, G _2, and G _T difficulty of solving the discrete logarithm problem (DLP). Then, the function e: G ₁ × G ₁ → G _2, which satisfies the following two conditions, becomes a pairing function, which is a parallel function that can be used for cryptography.

(=GF(3^m))에서의 효율적인 페어링 암호 연산 및 이에 사용되는 유한체 연산에 대한 연구가 주목을 받고 있다. 페어링 암호 기반의 암호 프로토콜 구현을 위하여 embedding degree가 상대적으로 작은 초특이 타원곡선이 매우 적합한 것으로 연구되었고,

위의 페어링 연산을 위해서는 embedding degree가 6 이며, E^± : y²=x³-x±1로 정의된 초특이 타원곡선이 사용된다. 이 초특이 타원곡선을 이용하여 페어링 암호 연산을 수행하기 위해서는 먼저 주어진 메시지를 타원곡선 위의 점으로 작은 메모리를 이용하면서도 빠른 속도로 매핑하기 위한 과정이 필요하다.Unlike elliptic curves that use only elliptic curves over binary or decimal bodies, pairing ciphers also use elliptic curves over ternary numbers with a rank of 3. Because pairing ciphers on ternary are faster than on other finite bodies,

Efficient pairing cipher operations at (= GF (3 ^ m)) and finite field operations used in them are receiving attention. A super elliptic curve with a relatively small embedding degree is well suited to implement a cryptographic protocol based on pairing cryptography.

For the above pairing operation, the embedding degree is 6 and the super elliptic curve defined by E ^± : y ² = x ^3- x ± 1 is used. In order to perform pairing encryption operation using this super elliptic curve, first, a process for mapping a given message to a point on the elliptic curve while using a small memory is required.

위에서의 타원곡선 암호에서는 메시지의 해쉬(Hash) 값을 x 좌표에 대입하고 타원곡선 식을 만족하는 y 좌표를 계산하는 것이 일반적이다.

위에서는 세제곱이 선형연산으로 비교적 가벼운 연산이므로 메시지의 해쉬 값을 y 좌표에 대입하고 타원곡선 식을 만족하는 x 좌표를 찾는 것이 연산량이 적다.

In the elliptic curve cipher above, it is common to substitute a hash value of a message in x coordinates and calculate a y coordinate satisfying an elliptic curve expression.

In the above, since the cube is a linear operation, it is less computational to substitute the hash value of the message for the y coordinate and find the x coordinate that satisfies the elliptic curve.

위에서의 삼차방정식을 풂으로써 해당 x 좌표를 찾을 수 있도록 하였다. 이 삼차방정식을 풀기 위해서는

의 원소로 이루어진 (m-1)×(m-1) 행렬의 역행렬이 필요하고 이 역행렬을 y²-b의 계수들과 행렬 곱셈을 수행하여 x 좌표를 찾을 수 있게 된다. 따라서 연산량은 역행렬을 구하는 과정과 이 역행렬의 행렬 곱셈을 하는 과정에서 결정된다. 일단 역행렬을 찾은 뒤에는 주어진 y 좌표에 따라 행렬 곱셈만으로 x 좌표를 계산할 수 있으므로 다른 메시지 스트링의 MapToPoint을 위해서 계산된 역행렬은 저장되는 것이 바람직하다.In Document 1

By solving the cubic equation above, we can find the corresponding x coordinate. To solve this cubic equation

An inverse of the matrix (m-1) × (m-1) consisting of the elements of is needed, and the matrix can be found by performing matrix multiplication with the coefficients of y ² -b. Therefore, the amount of calculation is determined in the process of finding the inverse matrix and performing the matrix multiplication of the inverse matrix. Once the inverse is found, the x-coordinate can be calculated by matrix multiplication according to the given y-coordinate, so the calculated inverse for the MapToPoint of another message string is preferably stored.

→?

라 할 때, Γ의 kernel이

이므로, Γ 의 랭크는 m-1이 된다. 문헌 1의 매핑방법은 알고리즘 1과 같다.Referring to Document 1, a mapping is defined as Γ (x) = x ³ -x Γ:

→?

In this case, the kernel of Γ

Therefore, the rank of Γ becomes m-1. The mapping method of Document 1 is the same as Algorithm 1.

으로 정의하고 마지막 스텝에서는 τ(⁰x)<τ(¹x)<τ(²x) 을 바탕으로 근을 선택한다.In Document 1

In the final step, root is selected based on τ ( ⁰ x) <τ ( ¹ x) <τ ( ² x).

의 trace

를 Tr(a)라 한다.Definition 1. a∈

Trace

Is called Tr (a).

와 선택된 x₀∈

으로 구한다.Step 4 of Algorithm 1 first determines whether there is a root by checking Tr (c) = 0 to solve the cubic equation. If there is a root, since the rank of Γ is m-1, a matrix A of size (m-1) × (m-1) is generated and the inverse A ^{- 1} of A is calculated. The root of the cubic equation

With x ₀ 선택된 selected

Obtain as

위에서와 동일한 방법을 사용하였기 때문에 MapToPoint의 연산량이 O(m³)으로 비교적 컸으나 문헌 1에서는 MapToPoint의 연산량을 O(m²)으로 줄였다. 그러나 타원곡선 위로 임의의 메시지를 매핑할 때, 메시지 매핑에 사용되는 행렬의 크기를 줄여 역행렬을 보다 더 빠르게 계산할 필요가 있다.In the BLS scheme

Since the same method was used as above, the computation amount of MapToPoint was relatively large as O (m ³ ), but in Document 1, the computation amount of MapToPoint was reduced to O (m ² ). However, when mapping an arbitrary message over an elliptic curve, we need to calculate the inverse faster than by reducing the size of the matrix used to map the message.

Document 1 P. Barreto and H.Y. Kim, “Fast hashing onto elliptic curves over fields of characteristic 3”, Cryptology ePrint Archive, Report 2001/098.

[Document 2] P. Barreto, “A note on efficient computation of cube roots in characteristic 3”, Cryptology ePrint Archive: Report 2004/305, 2004.

with Reduced Hamming weight”, submitted to Elsevier Discrete Applied Mathematics.[3] Young In Cho, Nam Su Chang, Chang Han Kim and Seokhie Hong, “Formulas for Cube roots in

with Reduced Hamming weight ”, submitted to Elsevier Discrete Applied Mathematics.

[4] K. Harrison, D. Page and N. Smart, “Software implementation of finite fields of characteristic three, for use in pairing-based cryptosystems”, LMS Journal of Computation and Mathematics, vol. 5, pp. 181-193, 2002.

[Reference 5] IEEE P1363. Standard specifications for public key cryptography, 2000. http://grouper.ieee.org/groups/1363/index.html.

에서의 메시지 매핑 방법을 제공하는 것이다.Therefore, the first problem to be solved by the present invention is to reduce the size of the matrix used for message mapping to quickly calculate the inverse matrix

To provide a message mapping method.

에서의 페어링 암호 시스템을 제공하는 것이다.The second problem to be solved by the present invention is to reduce the size of the matrix used for message mapping to quickly calculate the inverse matrix

To provide a pairing password system.

Further, the present invention provides a computer-readable recording medium having recorded thereon a program for executing the above method on a computer.

에서의 메시지 매핑 방법을 제공한다.The present invention comprises the steps of substituting the hash value of the message to the y coordinate of the coordinates on the elliptic curve represented by (x, y) to achieve the first object; And substituting the hash value into the y-coordinate, and then subtracting an equation relating to the x-coordinate to calculate an x-coordinate that satisfies the elliptic curve, wherein each term represented by x in the elliptic curve equation is calculated. The cube is solved by solving the equation

Provides a message mapping method in.

According to an embodiment of the present invention, the calculating of the x coordinate comprises: generating a coefficient of x from a polynomial and a ternary polynomial for x of the elliptic curve equation; Generating a matrix for calculating the x-coordinate by using the coefficients of x except for expressing the polynomial by using the coefficient of x as the smallest by referring to the coefficient distribution of the generated polynomial; And calculating the coordinates of the x from the generated matrix.

The computing of the coordinates of x may include generating an inverse of the generated matrix; And calculating coordinates of the x using the generated inverse matrix.

Further, it is preferable that the coefficients of the excluded x are added to the calculated coefficients of x.

According to another embodiment of the present invention, the generated inverse matrix is preferably stored and used for the calculation of the x coordinate corresponding to the input y coordinate.

에서의 페어링 암호 시스템을 제공한다. The present invention to achieve the second object, the message receiving unit for receiving an arbitrary message string; A conversion unit encoding the received message string; A hashing unit hashing the coded message string; And a mapping unit that maps the hashed value to a point on an elliptic curve, wherein the mapping unit substitutes the hashed value into a y coordinate among coordinates on an elliptic curve expressed by (x, y) and attaches to the x coordinate. By computing the equations, the x coordinates satisfying the elliptic curve equation are calculated, and the cube is solved by performing a cube on each of the terms represented by x in the elliptic curve equation.

Provides a pairing password system.

에서의 메시지 매핑 방법을 컴퓨터에서 실행시키기 위한 프로그램을 기록한 컴퓨터로 읽을 수 있는 기록 매체를 제공한다. In order to solve the other technical problem, the present invention described above

A computer readable recording medium having recorded thereon a program for executing a message mapping method in a computer is provided.

According to the present invention, an inverse matrix can be quickly calculated by reducing the size of a matrix used for message mapping, and a small memory space is required to store the inverse matrix.

에서의 페어링 암호 시스템의 구성도이다.
도 2는 본 발명의 바람직한 일 실시예에 따른

에서의 메시지 매핑 방법의 흐름도이다.
도 3은 수학식 3의 차수에 따른 Γ'(x)의 도표이다.
도 3은 m ≡ k ≡ 1(mod 3)일 때의 차수에 따른 Γ'(x)(=x-x^1/3)의 도표를 도시한 것이다.
도 4는 m ≡ k ≡ 2(mod 3)일 때의 차수에 따른 Γ'(x)(=x-x^1/3)의 도표를 도시한 것이다.1 is in accordance with a preferred embodiment of the present invention

Is a schematic diagram of a pairing encryption system.
2 is in accordance with a preferred embodiment of the present invention

Flowchart of message mapping method in.
3 is a diagram of Γ '(x) according to the order of Equation (3).
FIG. 3 shows a plot of Γ '(x) (= xx ^1/3 ) according to order when m ≡ k ≡ 1 (mod 3).
FIG. 4 shows a plot of Γ '(x) (= xx ^1/3 ) according to order when m ≡ k ≡ 2 (mod 3).

Prior to the description of the specific contents of the present invention, for the convenience of understanding, the outline of the solution of the problem to be solved by the present invention or the core of the technical idea will be presented first.

에서의 메시지 매핑 방법은 메시지의 해쉬 값을 (x,y)로 표현되는 타원곡선 위의 좌표 중 y좌표에 대입하는 단계; 및 상기 해쉬 값을 상기 y좌표에 대입한 후, x좌표에 관한 방정식을 풂으로써, 상기 타원곡선 식을 만족하는 x좌표를 연산하는 단계를 포함하고, 상기 타원곡선 식에서 x로 표현되는 항들 각각에 세제곱을 하여 상기 방정식을 푸는 것을 특징으로 한다.According to one embodiment of the present invention

Message mapping method in the step of assigning a hash value of the message to the y coordinate of the coordinates on the elliptic curve represented by (x, y); And substituting the hash value into the y-coordinate, and then subtracting an equation relating to the x-coordinate to calculate an x-coordinate that satisfies the elliptic curve, wherein each term represented by x in the elliptic curve equation is calculated. It is characterized by solving the equation by cubes.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, these examples are intended to illustrate the present invention in more detail, it will be apparent to those skilled in the art that the scope of the present invention is not limited thereby.

The configuration of the invention for clarifying the solution to the problem to be solved by the present invention will be described in detail with reference to the accompanying drawings based on the preferred embodiment of the present invention, the operation principle for the preferred embodiment of the present invention in detail In the description, when it is determined that the detailed description of the known function or configuration and other matters unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, throughout the specification, when a part is 'connected' to another part, it is not only 'directly connected' but also 'indirectly connected' with another element in between. Include. In addition, the term 'comprising' a certain component means that the component may be further included, without excluding the other component unless specifically stated otherwise.

에서의 페어링 암호 시스템의 구성도이다.1 is in accordance with a preferred embodiment of the present invention

Is a schematic diagram of a pairing encryption system.

Referring to FIG. 1, the pairing encryption system according to the present embodiment includes a message receiver 100, a converter 110, a hashing unit 120, and a mapping unit 130.

The message receiver 100 receives an arbitrary message string to be encrypted.

The conversion unit 110 converts the received message string into a number so as to be input as a coordinate value of an elliptic curve.

The hashing unit 120 generates a hash value by substituting the converted number into a hash function.

The mapping unit 130 assigns the hash value to the y-coordinate of the coordinates on the elliptic curve represented by (x, y) and calculates the x-coordinate that satisfies the elliptic curve equation by solving the equation of the x-coordinate. . In this case, it is preferable to solve the equation by performing a cube on each of the terms represented by x in the elliptic curve equation. As a result, the mapping unit 130 generates a coordinate value on the elliptic curve corresponding to the message string received by the message receiving unit 100.

위에서 메시지 스트링을 G₁의 원소로 매핑하는 과정을 MapToPoint이라 하고 이를 효율적으로 수행할 수 있는 방법을 설명하기로 한다.Hereinafter, the mapping unit 130 for pairing operation

The process of mapping a message string to an element of G ₁ is called MapToPoint, and a method of efficiently doing this will be described.

에서의 메시지 매핑 방법의 흐름도이다.2 is in accordance with a preferred embodiment of the present invention

Flowchart of message mapping method in.

에서의 페어링 암호 시스템에서 시계열적으로 처리되는 단계들로 구성된다. 따라서, 이하 생략된 내용이라 하더라도 도 1에 도시된 페어링 암호 시스템에 관하여 이상에서 기술된 내용은 본 실시예에 따른

에서의 메시지 매핑 방법에도 적용된다. Referring to FIG. 2, the message mapping method according to the present embodiment is illustrated in FIG. 1.

It consists of the steps that are processed in a time series in a pairing cryptosystem. Therefore, even if omitted below, the contents described above with respect to the pairing encryption system shown in FIG. 1 are according to the present embodiment.

The same applies to the message mapping method in.

In step 200, the pairing encryption system substitutes the hash value of the message into the y coordinate of the coordinates on the elliptic curve represented by (x, y).

In step 210, the paired cryptographic system cubes each of the terms represented by x in the elliptic curve equation. In this case, the term expressed by y and the constant term are calculated together, and then cubed over the whole. That is, when the elliptic curve is represented by y ² = x ³ -x + b, (y ² -b) ^1/3 = (x ³ -x) ^1/3 = xx ^1/3 .

In step 220, the pairing cryptosystem generates coefficients of x from the polynomial and the ternary polynomial for x of the elliptic curve equation.

In operation 230, the pairing encryption system generates a matrix for calculating the x-coordinate by using the coefficients of x except for expressing the polynomial using the smallest coefficient of x by referring to the coefficient distribution of the generated polynomial.

In operation 240, the pairing encryption system generates an inverse of the generated matrix.

In operation 250, the pairing encryption system calculates coordinates of x corresponding to the received y-coordinates using the generated inverse matrix.

Looking at step 210 in more detail as follows.

→?

을 이용한다.

에서는 a

a³ 으로의 매핑이 permutation이므로 모든 원소는 유일한 세제곱근을 갖는다. 따라서 (y²-b)^1/3=(x³-x)^1/3=x-x^1/3을 만족하는 d=(y²-b)^1/3를 계산할 수 있으며 d=Γ'(x)을 풂으로써 x 좌표를 얻게 된다.Unlike the method of Algorithm 1, in step 210, the cube root of x is used to generate the matrix A in step 230. That is, in Document 1, the cube of x is used for Γ (x) (= x ³ -x), but in step 210 the function Γ 'is defined as Γ' (x) = xx ^1/3 :

→?

.

In a

Since the mapping to a ³ is a permutation, every element has a unique cube root. Therefore, we can calculate d = (y ² -b) ^1/3 , which satisfies (y ² -b) ^1/3 = (x ³ -x) ^1/3 = xx ^1/3 , and d = Γ '(x) By knowing x we get the x coordinate.

일 때, x의 세제곱을 계산할 때는 m과 k의 값에 따라 x의 계수가 서로 다르게 분포되지만 x의 세제곱근을 계산할 때는 m≡k(mod 3) 인 경우에 같은 패턴으로 x의 계수가 분포되기 때문이다. 이로 인해 Γ'(x)의 행렬 표현 A를 보다 편리하게 축소시킬 수 있게 된다.
The reason for using the cube root rather than the cube of x for Γ '(x) is that the resulting ternary polynomial polynomial

Since the coefficients of x are distributed differently according to the values of m and k when calculating the cube of x, but the coefficients of x are distributed in the same pattern when m≡k (mod 3) when calculating the cube root of x. to be. This makes it possible to more conveniently reduce the matrix representation A of Γ '(x).

Looking at step 220 to step 240 in more detail.

In particular, in step 230, the process of reducing the matrix A is performed.

가

의 생성 삼항기약다항식이라고 할 때,

라 하자.

에서의 세제곱근 연산을 살펴보면, 우선 임의의 자연수 u에 대하여 m=3u라 하자. (m ≡±1 (mod 3)인 경우도 유사하게 적용할 수 있다.) 그러면 x∈

에 대하여 다음의 수학식 1과 같이 표현되고,

end

When we say that the ternary polynomial polynomial of

Let's say.

Looking at the cube root operation at, let m = 3 u for any natural number u. (The same applies to the case of m ≡ ± 1 (mod 3).) Then x∈

With respect to Equation 1,

The cube of x using this equation is the same as the following equation (2).

The ¹ s ^{/ 3} s and ^2/3 if the pre-computation, we can calculate the cube root of only just two polynomial multiplication by using the equation (2). When the polynomial multiplication, s, if having a ^1/3 and s ^2/3, wherein the polynomial expression is of a small number is made more efficient operation. If the m≡k (mod 3), so ¹ s ^{/ 3} and a polynomial representation of s ^2/3, wherein the two kinds of very small number may be the cubic operation most efficiently.

위의 페어링 암호 연산 연구에서 이 cube root-friendly trinomial을 고려하고 있다. 이를 이용할 경우, 같은 값에 대하여 세제곱 보다 세제곱근 연산이 더 적은 덧셈 연산을 필요로 하게 된다. 본 발명에서는 세제곱근 연산에 유리한 cube root-friendly trinomial을 대상으로 MapToPoint를 전개하나 이에 한정되지 아니하며, non-cube root friendly irreducible trinomial에 대해서도 MapToPoint 방법을 이용할 수 있다.
Ternary polynomials of the form m≡k (mod 3) are called cube root-friendly trinomial

The cube root-friendly trinomial is considered in the pairing cryptographic study above. Using this, the addition of fewer cube root operations than the cube of the same value requires. In the present invention, MapToPoint is developed for a cube root-friendly trinomial, which is advantageous for cube root calculation, but the present invention is not limited thereto. The MapToPoint method may be used for non-cube root friendly irreducible trinomial.

First, we look at how to reduce the matrix representation A of Γ '(x) and find its inverse using Cube root friendly irreducible trinomials (m 과 k mod 3).

를 구한다.Matrix representation of reduced Γ '(x) for each case of m≡1 (mod 3) or m≡2 (mod 3)

.

m ≡ k ≡ 1? ( mod  3)

If m ≡ 1? (mod 3) and k ≡ 1 (mod 3), let m = 3u + 1 and k = 3v + 1 for any positive u and v (u> v).

에서 x^3u+1+ax^{3v +1}+b=0이므로, 문헌 2에 의하여

X ^{3u + 1} + ax ^{3v +1} + b = 0,

¹ s ^{/ 3} s = ^{2u u + v +1} -αs ^{+ 1} + ^{2v +1} s and ^{s 2/3 = -βs u +1} -αβs v ^{+ 1} can be determined. Therefore, Γ '(x) is expressed as Equation 3 below.

,

,

,

이다.Where,

,

,

,

to be.

를 생성하기 위한 사전계산과정을 설명하기로 한다.By example

The precomputation process for generating the data will be described.

이라 하면 u=4, v=1이고, s^{1 /3}=s⁹-s⁶+s³과 s^{2 /3}=s⁵+s²를 구할 수 있다. Ternary polynomial

As when u = 4, v = 1, and can obtain the ^{s 1/3 = s 9 -s} 6 + s 3 and ^{s 2/3 = s 5 +} s 2.

일 때, d=Γ'(x)=x-x^1/3의 다항식 표현을 나타낸 것이다.Table 1

, The polynomial representation of d = Γ '(x) = xx ^1/3 .

In Table 1, d ₀ = 0, and each of d ₁ , d ₁₀ , d ₁₁ , and d ₁₂ consisted of the subtraction of two elements of the coefficient of x. Now let's take a look at the process of shrinking matrix A by removing them.

x ₁ appears in d ₁ , d ₃ , d ₆ , d ₉ and calculates d ₃ '= d ₃ + d ₁ , d ₆ ' = d ₆ -d ₁ , and d ₉ '= d ₉ + d ₁ , By replacing (d ₃ , d ₆ , d ₉ ) with (d ₃ ′, d ₆ ′, d ₉ ′), x ₁ can be deleted from Table 1 and d ₁ can be removed. Next, x ₁₀ appears in d ₆ , d ₉ , d ₁₀ , d ₁₂ and d ₆ '= d ₆ ' + d ₁₀ , d ₉ '= d ₉ ' -d ₁₀ , d ₁₂ '= to delete x ₁₀ . Calculate d ₁₂ + d ₁₀ . And replace d ₁₂ with d ₁₂ ′. Performing a similar process on x ₁₁ and x ₁₂ yields

=

을 만족하는 축소된 행렬

을 구할 수 있고 아래의 수학식 5와 같은 행렬 곱셈을 통하여

을 구할 수 있다.therefore

=

Reduced matrix satisfying

Can be obtained through matrix multiplication as shown in Equation 5 below.

Can be obtained.

을 복원하기 위하여 단지 x₁=d₁+x₃, x₁₀=d₁₀+x₄, x₁₁=d₁₁+x₇, x₁₂=d₁₂+x₁₀만을 계산하면 된다. 여기서 크기가 12×12인 A 대신에 크기가 8×8인

을 사용함으로써 역행렬 연산 시간 및 저장 공간과 행렬 곱셈 연산량을 줄일 수 있게 된다.
Finally

To reconstruct, only x ₁ = d ₁ + x ₃ , x ₁₀ = d ₁₀ + x ₄ , x ₁₁ = d ₁₁ + x ₇ , x ₁₂ = d ₁₂ + x ₁₀ . Where the size is 8x8 instead of the 12x12 A

By using, the inverse matrix operation time, storage space, and matrix multiplication computation can be reduced.

Now let's look at how to reduce the matrix A for the general case.

FIG. 3 is a diagram of Γ '(x) (= xx ^1/3 ) according to the order when m ≡ k ≡ 1 (mod 3), and Γ' (x) according to the order of Equation 3 It is a chart.

Referring to FIG. 3, each of d _i of Part 1 and Part 2 consists of the subtraction of two elements of the coefficient of x.

In other words, in Part 1 d _i = x _i -x _3i (i = 0, ...., v) and in Part 2 d _{2u + v + j} = x _{2u + v + j} -x _{3v + 3j + 1} ( j = 1, ...., uv).

을 생성하기 위한 사전 계산은 Γ'(x)의 행렬 표현인 A에서 Part 1과 Part 2를 제거하는 것이다. 예를 들어 Part 1의 d₁=x₁-x₃이고 x₁은 d_{2v +1}, d_{u +v+1}, 그리고 d_{2u +1}에 존재한다.Reduced matrix as in the previous example

The precomputation to generate is to remove Part 1 and Part 2 from A, the matrix representation of Γ '(x). For example, in Part 1 d ₁ = x ₁ -x ₃ and x ₁ is present in d _{2v +1} , d _{u + v + 1} , and d _{2u +1} .

_Calculate d _{2v +1} '= d _{2v +1} + d ₁ , d _{u + v + 1} ' = d _{u + v + 1} -α · d ₁ , and d _{2u +1} '= d _{2u +1} + d ₁ By deleting x ₁ , d ₁ can be removed. Repeat this process for (d ₂ , ..., d _v , d _{2u + v + 1} , ..., d _3u ), and (d ₂ , ..., d _v , d _{2u + v + 1} , ..., d _3u ) is replaced by (d ₂ ', ..., d _v ', d _{2u + v + 1} ', ..., d _3u '). Algorithm 2 is an algorithm that describes the process of removing Part 1. Part 2 removal is very similar.

There is an additional operation may be required before pre-calculated above, if the d ₁ = x ₁ -x ₃ and d ₃ = x ₃ -x ₉ x ₃ are both in the process of deleting the x ₁ if belonging to Part 1 d _{2u + It} is added to or subtracted from ₁ , d _{u + v + 1} , and d _{2v +1} . Thus, x ₃ is created in an unexpected position, which complicates the deletion of x ₃ in the process of removing d ₃ . To avoid this situation, calculate d ₁ '= d ₁ + d ₃ = x ₁ -x ₉ , replace d ₁ and d ₁ ′ and start precalculation. These additional operations before precomputation correspond to steps 2 through 6 in Algorithm 2.

과 이들의 해당 x 좌표 계수를 얻어

를 생성한다. 다음으로

을 계산함으로써 (x_{v +1},..., x_2u+v)을 구한다. 마지막으로 알고리즘 3의 step 8 ~ 13에서처럼 (x₁,...,x_v,x_2u+v+1,...x_3u)을 복원함으로써 x 좌표의 전체 계수를 구한다. 이어서 m ≡ k ≡ 2 (mod 3)인 경우에 대해서도 d=Γ'(x)의 근을 찾도록 한다. 이는 앞서 설명한 과정과 유사하다.After precomputation

And their corresponding x coordinate coefficients

. to the next

_Find (x _{v +1} , ..., x _{2u + v} ) by calculating. Finally, we compute the total coefficient of x coordinate by restoring (x ₁ , ..., x _v , x _{2u + v + 1} , ... x _3u ) as in steps 8 to 13 of Algorithm 3. Subsequently, the root of d = Γ ′ (x) is also found for the case of m ≡ k ≡ 2 (mod 3). This is similar to the process described above.

m ≡ k ≡ 2? ( mod  3)

에서 x^3u+2+ax^{3v +2}+b=0이므로, 문헌 2에 의하여 s^{1 /3}=-βs^{u +1}-αβs^{v +1}과 s^{2 /3}=s^{2u +2}-αs^{u +v+2}+s^{2v +2}를 구할 수 있다. 따라서 Γ'(x)는 다음의 수학식 6과 같이 표현된다.If m ≡ 2? (mod 3) and k ≡ 2 (mod 3), then m = 3u + 2 and k = 3v + 2 for any positive u and v (u> v).

In ^{x 3u + 2 + ax 3v +2} + b = 0 , so, by literature ^{2 s 1/3 = -βs u} +1 -αβs v +1 and ^{s 2/3 = s 2u +2} -αs u + v ⁺² + s ^{2v +2} Therefore, Γ '(x) is expressed as in Equation 6 below.

,

,

,

이다.Where,

,

,

,

to be.

FIG. 4 shows a plot of Γ '(x) (= xx ^1/3 ) according to order when m ≡ k ≡ 2 (mod 3). Algorithm 4 represents the Part1 removal process and Algorithm 5 represents MapToPoint.

를 구하는 과정에 대하여 살펴보았다.
The matrix representation of reduced Γ '(x) for each case of m≡1 (mod 3) or m≡2 (mod 3).

We looked at the process of obtaining.

Hereinafter, the method of reducing the matrix representation A of Γ '(x) will be described in general when the generated ternary polynomial is not a cube root-friendly trinomial.

를 얻는 것이 매우 복잡하기 때문에 세제곱을 이용한 방법을 이용하는 것이 유리하다는 것을 의미한다. 세제곱을 이용한다고 하면 생성 삼항 기약다항식에 따라 사전계산이 달라져야 하는 단점이 있으나 마찬가지로 행렬을 축소할 수 있을 것이다.
That is, in the case of using the remaining Irreducible Trinomials (m ≠ k (mod 3)), and m ≠ ± k (mod 3), in Document 3, cube root-friendly trinomial was used on the shifted polynomial basis (SPB). We proposed a method to find the cube root with the same amount of computation. According to Document 3, such as when using ^{cube root-friendly trinomial s 1/} 3 and s ^{2 /} in ³ of a polynomial expression to express in terms of the extremely small number can be applied as a matrix generation and reduction methods discussed above have. -k ≡ m (mod 3) in this case, since the polynomial expression of the ¹ s ^{/ 3} s and ^2/3 have a wherein a large number of the cube root calculation amount is relatively large. From matrix A

Since it is very complicated to obtain, it is advantageous to use the method using the cube. The use of cubes has the disadvantage that the precomputation has to be changed according to the generated ternary term polynomial, but the matrix can be reduced as well.

Embodiments of the present invention propose a method of efficiently performing MapToPoint by reducing a matrix representation of Γ '(x).

의 역행렬 계산과

의 행렬 곱셈에서 결정된다. 문헌 4에서는

에서의 유한체 연산을 구현하기 적합한 원소 표현 방법 두 가지를 제안하였다. 이중 Type Ⅱ 표현은

에서의 원소 표현과 유사하며 각 a_i∈

을 a_i=

를 만족하는 (

,

) 두 비트로 유일하게 표현하였다. 여기서

과

는 동시에 1이 아니다. 본 발명의 실시예에서는 이 Type Ⅱ 표현 방법을 이용하여 MapToPoint 방법을 구현하였다.

과

위의 초특이 타원곡선 E^- : y²=x³-x-1,

위의 초특이 타원곡선 E⁺ : y²=x³-x+1과 cube root-friendly trinomial :

,

,

을 이용하였다. 역행렬 연산은 일반적인 가우스 소거법보다 약 m/4배 빠른 LU 분해 방법을 사용하였다. 문헌 1의 결과와 비교했을 때, 역행렬은 3~5배 가량 빨리 연산 할 수 있으며 이 역행렬을 저장하기 위해서는 4/9(44%)의 메모리만이 필요하였다. 또한 역행렬이 주어졌을 때 MapToPoint를 위한 행렬 곱셈은 2~3배 정도 빠르다. 이들의 구현 결과는 표 3에 주어졌으며 각 연산 시간은 표 2의 연산이 수행되는 동안 측정되었다.In this case, addition to remove Part 1 and Part 2 and addition to restore a part of the x coordinate are very light calculations.

With inverse matrix

Is determined from the matrix multiplication. In Document 4

We propose two element representation methods suitable for implementing finite field operations in. Type II expression is

Similar to the elemental representation of at each a _i ∈

A _i =

To satisfy (

,

) Only two bits. here

and

Is not 1 at the same time. In the embodiment of the present invention, the MapToPoint method is implemented using this Type II representation method.

and

Second specific elliptic curve of the above ^{E -: y 2 = x 3} -x-1,

The super elliptic curve E ^{+ above} : y ² = x ³ -x + 1 and the cube root-friendly trinomial:

,

,

Was used. The inverse matrix operation used LU decomposition method about m / 4 times faster than general Gaussian elimination method. Compared with the results of Literature 1, the inverse matrix can be calculated three to five times faster and only 4/9 (44%) of memory is needed to store the inverse matrix. Also given the inverse, matrix multiplication for MapToPoint is two to three times faster. The results of their implementation are given in Table 3, and each calculation time was measured while the calculations in Table 2 were performed.

위의 타원곡선 암호에서는 수신자에게 160 비트 이상의 x 좌표와 1 비트의 y 좌표 부호가 주어지고 수신자는 타원곡선 이차식을 만족하는 y좌표를 구하게 된다.

위에서는 x 좌표와 1 비트의 y'=y(mod 2)가 주어진다.

과

에서의 point compression 방법은 문헌 5에 자세하게 설명되어있다. 본 발명의 실시예에 따른 MapToPoint 방법을

에서의 point compression에 효과적으로 적용할 수 있는데 이때는 y 좌표와 x₀ 및 복원할 x 좌표의 부호까지 모두 3 비트가 추가로 주어져야 하며, point decompression시에 적합한 x 좌표를 연산하는데 있어 가장 빠른 알고리즘을 제공할 수 있다.Meanwhile, instead of transmitting all of the (x, y) coordinates in order to save bandwidth when transmitting a point on an elliptic curve, a method of restoring the other by the receiver is called Point Compression.

In the above elliptic curve cipher, the receiver is given more than 160 bits of x coordinate and 1 bit of y coordinate code, and the receiver finds the y coordinate satisfying the elliptic curve quadratic.

This gives the x coordinate and one bit y '= y (mod 2).

and

The method of point compression in is described in detail in Literature 5. MapToPoint method according to an embodiment of the present invention

It can be effectively applied to the point compression at. In this case, additional 3 bits should be given to the y coordinate, x ₀ and the sign of the x coordinate to be restored, which will provide the fastest algorithm for calculating the appropriate x coordinate during point decompression. Can be.

위의 타원곡선 점으로 보다 효율적으로 매핑하는 방법을 제시하고 있다. 덧셈 연산이 다른 연산에 비해 훨씬 가벼우므로 그 횟수를 늘려 MapToPoint을 위한 행렬의 크기를 줄였다. In the present invention, any message string

We present a more efficient mapping method to the elliptic curve points above. Since the addition operation is much lighter than other operations, we increased the number of times to reduce the size of the matrix for MapToPoint.

으로 줄임으로써, 역행렬을 3 ~ 5배 빠르게 계산할 수 있으며 역행렬의 크기가 기존에 비해 44%로 작아졌으므로 이를 저장하기 위한 메모리 또한 기존의 44%만 필요하게 된다. 또한 역행렬과 y²-b의 계수의 행렬 곱셈 연산량도 줄어들게 되므로 결과적으로 역행렬이 주어졌을 때 MapToPoint를 2 ~ 3배 정도 빠르게 할 수 있다. 따라서 본 발명에 따른 MapToPoint 방법은 유비쿼터스 환경 등의 제한된 저장 공간과 컴퓨팅 파워를 갖는 장비에 효과적으로 적용가능하다.Specifically, the matrix size used in Document 1 is represented by (m-1) × (m-1)

By reducing the, the inverse matrix can be calculated 3 to 5 times faster, and since the size of the inverse matrix is 44% smaller than before, only 44% of the memory is required to store the inverse matrix. In addition, the matrix multiplication of the inverse and the coefficient of y ² -b is also reduced, resulting in a 2 to 3 times faster MapToPoint given the inverse. Therefore, the MapToPoint method according to the present invention can be effectively applied to equipment having limited storage space and computing power, such as a ubiquitous environment.

Embodiments of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

It can be used for public key cryptosystem, pairing cryptosystem, etc.

Claims (11)

(a) assigning a hash value of the message to a y coordinate of coordinates on an elliptic curve represented by (x, y); And
(b) assigning the hash value to the y-coordinate, and then calculating an x-coordinate on the elliptic curve corresponding to the y-coordinate,
Step (b) is a cube of each of the terms represented by x in the equation of the elliptic curve represented by the (x, y) is characterized in that the equation is solved with respect to x

How messages are mapped. The method of claim 1,
The step (b)
(b1) generating a coefficient of x from a polynomial and a ternary polynomial with respect to x in the elliptic curve;
(b2) generating a matrix for calculating the x-coordinate by using the remaining coefficients of x except for expressing the polynomial using the smallest coefficient of x with reference to the generated coefficient distribution of the polynomial; And
(b3) further comprising calculating coordinates of the x from the generated matrix.

How messages are mapped. The method of claim 2,
Step (b3),
(b31) generating an inverse of the generated matrix; And
(b32) calculating the coordinates of the x using the generated inverse matrix;

How messages are mapped. The method of claim 2,
And the coefficients of the excluded x are added to the calculated coefficients of x.

How messages are mapped. The method of claim 3, wherein
The generated inverse matrix is stored and used to calculate the x coordinate corresponding to the input y coordinate.

How messages are mapped. A message receiver for receiving an arbitrary message string;
A conversion unit encoding the received message string;
A hashing unit hashing the coded message string; And
A mapping unit for mapping the hashed value to a point on an elliptic curve,
The mapping unit substitutes the hashed value into y coordinates among the coordinates on the elliptic curve represented by (x, y), and calculates the x coordinate on the elliptic curve corresponding to the y coordinate, wherein (x, y In the equation of the elliptic curve expressed by), a cube is applied to each of the terms represented by x to solve the equation with respect to x to calculate the x coordinate.

Pairing password system on. The method according to claim 6,
The mapping unit,
Except for generating a coefficient of x from a polynomial and a ternary polynomial of x of the elliptic curve formula, and referring to the coefficient distribution of the generated polynomial, the coefficient of x is used to represent the polynomial with the smallest x. After generating a matrix for calculating the x-coordinate using the coefficient of, and calculates the coordinate of the x from the generated matrix

Pairing password system on. The method of claim 7, wherein
Computing the coordinates of x generates an inverse of the generated matrix, and calculates the coordinates of the x using the generated inverse matrix.

Pairing password system on. The method of claim 7, wherein
And the coefficients of the excluded x are added to the calculated coefficients of x.

Pairing password system on. The method of claim 8,
The generated inverse matrix is stored and used to calculate the x coordinate corresponding to the input y coordinate.

Pairing password system on. A computer-readable recording medium storing a program for causing a computer to execute the method according to any one of claims 1 to 5.

Images