KR102184189B1 - Method for computing 4-isogeny on twisted edwards curves - Google Patents

Abstract

The present invention relates to a quaternary iso Jenny calculation method for the twisted Edwards curve, More specifically, the _"iso Jenny between (isogeny,: E _d → E _d Edwards curves (E _d and E _d), a method) calculated , (1) Converting the twisted Edwards curve (E _a,d ) to the Montgomery curve (M _A,B ), and isoseni ( ₁ :M _A ) between the Montgomery curves (M _A,B and M _A′,B′ ) _,B →M _A′,B′ ) and isomorphism to derive a fourth-order isogene between twisted Edwards curves; (2) Assuming that the twisted Edwards curve has a 4-torsion point, and using that the twisted Edwards curve with a 4-torsion point is homogeneous with the Edwards curve, the fourth order Isogeny between the Edwards curves is calculated. Deriving; And (3) from the curve point (Q=(Y:Z)) on the Edwards curve (E _d ) and the 4-torsion point (P=(Y ₄ :Z ₄ )) on the image Edwards curve (E _d′ ) Computing the curve points (Q=(Y′:Z′)) and the projected curve coefficients (C′ and D′), and calculating the fourth-order Isogeny between the Edwards curve derived in step (2). It is characterized by its construction.
According to the fourth-order Isogeny calculation method for the twisted Edwards curve proposed in the present invention, the Edwards curve is proposed by proposing and optimizing the fourth-order Isogeny formula for the twisted Edwards curve, and proposing an efficient calculation method of the proposed formula. It is possible to efficiently calculate Isogeny for, and develop a new encryption technique by applying this to Isogeny-based encryption.

Description

How to Calculate 4th Order Isogeny for Twisted Edwards Curves {METHOD FOR COMPUTING 4-ISOGENY ON TWISTED EDWARDS CURVES}

The present invention relates to a method of calculating Isogeny, and more particularly, to a method of calculating a fourth order Isogeny for a twisted Edwards curve.

As the possibility of quantum communication and quantum computing becomes visible, changes are required in encryption technology. Public-key cryptography, which is widely used today, may no longer be secure in quantum computers, and cryptographers believe that asymmetric cryptographic algorithms are vulnerable to quantum computing.

Accordingly, NIST announced'Reports on Post-Quantum Cryptography' NISTIR 8105 in April 2016. Since public key cryptography is no longer secure when quantum computers are developed, a standard for Post-Quantum Cryptography has been prepared for this. It also announced a public offering for this.

Meanwhile, Suite B Cryptography of the US NSA is a set of cryptographic algorithms established as part of a cryptographic modernization program. Suite B was established in February 2005 and is used for encryption of foreign releasable information, US-Only information, and Sensitive Compartmented information (SCI). Suite B consists of AES with 128/256 bit key length, ECDH using P-384, ECDSA, SHA-384 and RSA-3072. However, as quantum computer development became visible, the NSA announced in August 2015 that it would revise all of Suite B's cryptographic algorithms to Post-Quantum Cryptography (PQC).

As described above, in order to strengthen the public key cryptosystem, which is threatened by the development of quantum computers, it is necessary to develop a technology for implementing a quantum-resistant cryptography.

Meanwhile, Elliptic Curve Cryptography (ECC) has been developed as an encryption method using an elliptic curve. However, ECC is known to be vulnerable to quantum computing environments. This is because the Elliptic Curve Discrete Logarithm Problem (ECDLP), which ECC is based on, is capable of polynomial time attack by a quantum algorithm, and thus Post-Quantum Cryptography cannot be created using this.

In general, the problem of obtaining an isogeny between two given elliptic curves is known as an extremely difficult problem, and this difficulty can be used for encryption. This is a path search problem on an elliptic curve isogeny graph defined on a finite field, which is completely different from the conventional method using ECDLP. While the existing ECDLP-based encryption has been weakened by quantum algorithms, the Isogeny-based encryption has the potential to provide quantum resistant encryption that is not vulnerable to quantum algorithms.

As a prior art related to the present invention, registered patent No. 10-1098701 (name of the invention: use of Isozini for designing a cryptosystem, date of announcement: December 23, 2011), and registered patent No. 10-1153085 ( Title of the invention: System and method for the generation and validation of isogeny-based signatures, date of announcement: June 04, 2012) and the like have been disclosed.

The present invention is proposed to solve the above problems of the previously proposed methods, by proposing and optimizing the fourth-order Isogeny formula for the twisted Edwards curve, and by proposing an efficient calculation method of the proposed formula, Edwards Its purpose is to provide a fourth-order Isogeny calculation method for a twisted Edwards curve that can efficiently calculate Isogeny for a curve and develop a new encryption technique by applying it to Isogeny-based encryption.

The fourth-order Isogeny calculation method for a twisted Edwards curve according to a feature of the present invention for achieving the above object,

As a method of calculating isogeny (:E _d →E _d′ ) between Edwards curves (E _d and E _d′ ),

(1) twisted Edwards curves (E _{a, d)} the Montgomery curve (M _{A, B)} to convert, and Montgomery curve (M _{A, B} and M _{A ', B')} iso Jenny (φ ₁ between: M _{A ,B} →M _A′,B′ ) and isomorphism to derive a fourth-order isogene between twisted Edwards curves;

(2) Assuming that the twisted Edwards curve has a 4-torsion point, and using that the twisted Edwards curve with a 4-torsion point is homogeneous with the Edwards curve, the fourth order Isogeny between the Edwards curves is calculated. Deriving; And

(3) From the curve point (Q=(Y:Z)) on the Edwards curve (E _d ) and the 4-torsion point (P=(Y ₄ :Z ₄ )), the curve on the image Edwards curve (E _d′ ) Computing the point (Q=(Y′:Z′)) and the projected curve coefficients (C′ and D′), and calculating the fourth-order Isogeny between the Edwards curve derived in step (2). It is characterized by its construction.

Preferably, the step (1),

(1-1) deriving a first birational map from the twisted Edwards curve to the Montgomery curve;

(1-2) synthesizing quaternary isogeny and isomorphic events in the Montgomery curve;

(1-3) deriving a second pair of glass thoughts returning from the Montgomery curve to the twisted Edwards curve; And

(1-4) synthesizing the first paired glass image, the fourth order isogene in the Montgomery curve, and the second twin glassed image, and deriving the isogenes between the twisted Edwards curves. .

More preferably, in the step (1-2),

You can use the even-order Isogeny, which is calculated by Bellue's formula.

More preferably,

The fourth-order isogenes between the twisted Edwards curves derived in step (1-4), Y′=(Z ² Y ₄ ² +Y ² Z ₄ ² )YZ(Y ₄ +Z ₄ ) ² and Z′= (Z ² Y ₄ ² +Y ² Z ₄ ² ) ² +2Y ² Z ² Y ₄ Z ₄ (Y ₄ ² +Z ₄ ² ).

More preferably, after step (1-4),

(1-5) further comprising the step of deriving the image twist curve coefficient,

The curve coefficients derived in step (1-5) are, for the curve coefficients a=A/C and d=D/C of the twisted Edwards curve (E _a,d ), the image twisted Edwards curve (E _{a′,d When} the curve coefficients a′=A′/C′ and d′=D′/C′ of ′ ), the projective curve coefficient of the twisted Edwards curve is A′=A(Y ₄ +Z ₄ ) ⁴ , D′= 8AY ₄ Z ₄ (Y ₄ ² +Z ₄ ² ) and C′=CY ₄ ⁴ .

Preferably, in step (2),

Assuming that the twisted Edwards curve has 4-torsion points, and using that the twisted Edwards curve with 4-torsion points is homogeneous with the Edwards curve, and applying it to the projective coordinate system, derive the projective curve coefficient of the image Edwards curve in the projective coordinate system. can do.

More preferably, the projective curve coefficient derived in step (2) is,

It may be D′=8AY ₄ Z ₄ (Y ₄ ² +Z ₄ ² ) and C′=(Y ₄ +Z ₄ ) ⁴ .

Preferably, in step (3),

Given the curve point (Q=(Y:Z)) on the Edwards curve (E _d ) and the 4-torsion point (P=(Y ₄ :Z ₄ )), the curve point on the image Edwards curve (E _d′ ) ( Q′=(Y′:Z′)) and curve coefficients (C′, D′, and d′=D′/C′) are calculated to calculate Isogeny.

Preferably, in step (3),

F′=(YZ(Y ₄ ² +Z ₄ ² )+(Y ² Z ₄ ² +Z ² Y ₄ ² ))(ZY ₄ +YZ ₄ ) ² and G′=(YZ(Y ₄ ² +Z ₄ ² )-(Y ² Z ₄ ² +Z ² Y ₄ ² ))(ZY ₄ -YZ ₄ ) ² is calculated and the curve point (Q′=(Y′:Z) on the Edwards curve (E _d′ ) in the image ′)) and projective curve coefficients can be calculated.

According to the fourth-order Isogeny calculation method for the twisted Edwards curve proposed in the present invention, the Edwards curve is proposed by proposing and optimizing the fourth-order Isogeny formula for the twisted Edwards curve, and proposing an efficient calculation method of the proposed formula. It is possible to efficiently calculate Isogeny for, and develop a new encryption technique by applying this to Isogeny-based encryption.

1 is a diagram illustrating a flow of a method for calculating a fourth-order isogene for a twisted Edwards curve according to an embodiment of the present invention.
FIG. 2 is a diagram showing a detailed flow of step S100 in a method for calculating a fourth-order Isogenie for a twisted Edwards curve according to an embodiment of the present invention.
FIG. 3 is a diagram showing an efficient algorithm for calculating a fourth order Isogeny and a curve coefficient corresponding thereto in a method for calculating a fourth order Isogeny for a twisted Edwards curve according to an embodiment of the present invention.

Hereinafter, preferred embodiments will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. However, in describing a preferred embodiment of the present invention in detail, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, the same reference numerals are used throughout the drawings for portions having similar functions and functions.

In addition, in the entire specification, when a part is said to be'connected' with another part, it is not only'directly connected', but also'indirectly connected' with another element in the middle. Include. In addition, "including" a certain component means that other components may be further included rather than excluding other components unless otherwise stated.

The elliptic curve is a smooth projective plane curve, genus 1 defined on the finite field K, and has a distinguished point. Assume that K is a finite field whose number of faces is not 2 and 3.

Given two elliptic curves E ₁ and E ₂ , finding one isogeny φ: E ₁ → E ₂ is called the isogeny problem. Until now, no sub-exponential algorithm has been proposed that can solve the isogeny problem between supersingular elliptic curves.

Isogeny-based encryption is the most recently proposed category in the field of quantum resistant encryption. However, in the practical implementation of Isogeny-based encryption, there are difficulties in calculating Isogeny and calculating points. More specifically, because the cryptosystem moves along the Isogeny graph, the isogeny formula cannot be optimized for certain coefficients of the elliptic curve. Therefore, in the conventional literature, Montgomery curves are used because of effective point calculation in arbitrary elliptic curves. In the present invention, a fourth-order Isogeny formula in a twisted Edwards curve, not a Montgomery curve, was proposed and optimized.

From the Edwards curve to the Weierstrass curve, there is a birational map. Let the transformation from the twisted Edwards curve to the Bayerstras curve W be denoted as ψ, and the isozeni from W to another Bayerstras curve W'. Let ψ ^{-1 be the} inverse transformation from the Bayerstras curve W'to the twisted Edwards curve. An intuitive approach to calculating the Isogeny between twisted Edwards curves is to synthesize these maps. However, the transformation from the Bayerstras curve to the twisted Edwards curve becomes complicated when the Bayerstras curve is not of a specific shape. In addition, square root calculation is required for the transformation to return to the twisted Edwards shape.

In the present invention, the efficiency of the calculation of a birational map between the twisted Edwards curve and the Montgomery curve is used for the calculation of the even-order Isogeny. That is, the quaternary isozeni in the twisted Edwards curve can be obtained by synthesizing the twin glass idea and the isogene in the Montgomery curve.

First, the twisted Edwards curve can be expressed as in Equation 1 below.

Here, a, d∈K, and a, d are different and not zero.

To derive the fourth-order Isogeny formula from the twisted Edwards curve, let's first look at Bellru's formula (V's formula) and the third-order Isogeny formula.

Bellue's formula in the Montgomery curve

The Montgomery curve defined in finite field K is defined as in Equation 2 below.

을 가지며, 또는 2차 확장(quadratic extension) 상에서 [2]P₄=P₂로 정의된다. <P₂>를 커널로 가진 2차의 아이소제니 및 P₄를 (0,0)으로 보내는 사상은 다음 수학식 3과 같이 정의된다.The Montgomery curve defined in Equation 2 is a 2-torsion point P ₂ =(0,0) and a 4-torsion point

Is defined as [2]P ₄ =P ₂ on the quadratic extension. The second-order isogeny with <P ₂ > as the kernel and the idea of sending P ₄ as (0,0) is defined as in Equation 3 below.

Here, for (x,y)∈M _A,B , x=X/Z, y=Y/Z. The corresponding image curve is given by Equation 4 below.

Since the image curve is not in Montgomery shape, the calculation of the square root cannot be avoided to convert F back to Montgomery shape. In order to overcome this problem, consider Isogeny ψ having <(0,0)> as a kernel given as in Equation 5 below.

Here, X'=-X(AZ+X+2Z)(X+4Z), Y'=Y(4AZ ² -X ² +8Z ² ), Z'=(A-1)X ² Z. The equation of this image curve is given in Montgomery's form as in Equation 6 below.

Then, φ ₁ =ψ is the fourth order isogeny from M _A,B to M _A',B' =/M _A,B <P ₄ >. However, this formula cannot be applied twice to obtain an isogeny of 4 ^2nd order. Instead, only when φ ₁ is calculated twice, a multiplication-by-4-isogeny can be induced. For the 4 ^lth order Isogeny, in order to successfully apply the 4th order Isogeny, φ ₁ must be synthesized with the isomorphism of the Montgomery curves that map the 4-torsion point to several specific coordinate systems. This is already evident when calculating with a point P ₄ of a certain form. Let P≠±P ₄ be the point of the fourth order in M _A,B . Let P=(X _M :Y _M :Z _M ) and [2]P=(X ₀ :Y ₀ :Z ₀ ) be projected coordinate systems of P and [2]P, respectively. [2] The isomorphic idea ι, which is an mapping from P to (0,0) and P to (1,...)-type points, is defined as in Equation 7 below.

The corresponding curve equation is shown in Equation 8 below.

By synthesizing φ ₁ and ι, we can successfully calculate the quaternary isogeny.

Hereinafter, in order to help understand the derivation of the fourth-order Isogeny formula, the derivation of the third-order Isogeny formula from the twisted Edwards curve will be described.

The third-order Isogeny formula in a twisted Edwards curve

Let P=(α, β) be the 3-torsion point in the twisted Edwards curve E _a,d defined in Equation 1.

Let us be a cubic Isozeni with a kernel <P> from the twisted Edwards curve E _a,d to E _a′,d′ (where E _a′,d′ =E _a,d /<P>). Then, φ is as shown in Equation 9 below.

The curve coefficients a'and d'are as shown in Equation 10 below.

및

로 각각 표현될 수 있다. x² 및 α²를 수학식 2의 y좌표에 대입하면, 다음 수학식 11과 같다.From the curve equation (Equation 1), x ² and α ² are

And

Each can be expressed as Substituting x ² and α ² into the y-coordinate of Equation 2 is as shown in Equation 11 below.

Third-order isogenes between twisted Edwards curves can be applied to projective coordinates. More specifically, by substituting the projective coordinate system in Equation 11, the equation can be simplified.

Projection coordinates and projection curve coefficients can be used to prevent inversion when calculating Isogeny and curve coefficients. Let P=(X ₃ :Y ₃ :Z ₃ ) denote the projected P with α=X ₃ /Z ₃ and β=Y ₃ /Z ₃ . Let (Y:Z) be an additional input, and (Y':Z') be the corresponding image. That is, if the curve point on the Edwards curve E _d is Q(Y:Z), the curve point on the image Edwards curve E _d′ corresponding thereto is Q(Y':Z'). If Equation 11 is substituted for the projective coordinate system and the equation is simplified, the following Equation 12 can be obtained.

의 근이므로, d를

로 표현할 수 있다. 이때, ψ는 꼬인 에드워즈 곡선으로부터 바이어슈트라스 곡선으로의 변환(transformation)이다. 그러면, 다음과 같은 수학식 13을 얻을 수 있다.Third-order division polynomials can be applied to third-order isogenies in the projective coordinate system. More specifically, y=Y ₃ /Z ₃ is a third-order division polynomials

Is the root of, so d

It can be expressed as In this case, ψ is a transformation from a twisted Edwards curve to a Bayerstras curve. Then, Equation 13 as follows can be obtained.

In summary, from the additional input (Y:Z), the projective version of Equation 11 is as Equation 14 below.

It is possible to derive the projective curve coefficients of the Edwards curve twisted in the projected coordinate system. That is, the curve coefficient of Equation 10 can be derived from the projective coordinate system.

및

를 대입하여 이미지 곡선의 곡선 계수를 사영 좌표계에서 표현하면 다음 수학식 15와 같다.Specifically, first, let a'and d'be the curve coefficients of the image curve. To Equation 10

And

Substituting for and expressing the curve coefficient of the image curve in the projective coordinate system is shown in Equation 15 below.

In order to avoid inverse calculation, the projected version of Equation 15 can be expressed as Equation 16 below.

Quadratic Isogeny Formula in Twisted Edwards Curve

In the twisted Edwards curve, the calculation of the fourth-order Isogeny is more complicated than that of the odd-order Isogeny. There are two approaches to calculating the fourth-order Isogeny from the twisted Edwards curve. The first method is to transform the twisted Edwards curve into the corresponding Weierstrass form and apply Bellü's formula (V's formula). However, the transformation from the Bayerstras form to the twisted Edwards form is complicated because square root calculations may be required. Another approach is to use the bi-rational equivalence relationship between the twisted Edwards curve and the Montgomery curve. Since the transformation between the twisted Edwards curve and the Montgomery curve requires only two additions, you can calculate the fourth-order Isogeny from the Montgomery curve and then convert it back to the twisted Edwards curve.

In the present invention, as a method for calculating the even-order isogenies in the Montgomery curve, Jao and De Feo (Jao, D., De Feo, L.: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In: International Workshop on Post-Quantum Cryptography.pp. 19-34.Springer (2011)), Costello et al. (Costello, C., Longa, P., Naehrig, M.: Ecient algorithms for supersingular isogeny diffie-hellman) In: Annual Cryptology Conference. pp. 572-601. A method optimized later by Springer (2016)) was used. The main processes for deriving the fourth isogeny were described in the projective coordinate system.

1 is a diagram showing a flow of a method for calculating a fourth-order isogene for a twisted Edwards curve according to an embodiment of the present invention. As shown in Figure 1, the fourth-order Isogeny calculation method for a twisted Edwards curve according to an embodiment of the present invention converts a twisted Edwards curve into a Montgomery curve, and synthesizes the isogenes and isomorphic thoughts between the Montgomery curves. Thus, the step of deriving the fourth-order isojeny between the twisted Edwards curves (S100), assuming that the twisted Edwards curve has a 4-twist point, and using that the twisted Edwards curve having a 4-twist point is homogeneous with the Edwards curve , Deriving a fourth-order isogene between the Edwards curves (S200) and calculating a point on the Edwards curve, a 4-torsion point, and a projective curve coefficient, and calculating the fourth-order isogene between the Edwards curves (S300). It can be implemented including.

In step S100, the twisted Edwards curve (E _a,d ) is converted into a Montgomery curve (M _A,B ), and isojeny (φ ₁ :M) between the Montgomery curves (M _A,B and M _A′,B′ ). _A,B →M _A′,B′ ) and isomorphism can be synthesized to derive the fourth-order isogene between twisted Edwards curves. FIG. 2 is a diagram showing a detailed flow of step S100 in a method for calculating a fourth-order isogeny for a twisted Edwards curve according to an embodiment of the present invention. As shown in FIG. 2, step S100 of the fourth-order Isogeny calculation method for a twisted Edwards curve according to an embodiment of the present invention is a step of deriving a first pair of glass ideas from the twisted Edwards curve to the Montgomery curve ( S110), synthesizing the quadratic isogenes and isomorphic thoughts in the Montgomery curve (S120), deriving a second paired glass thought that returns to the Edwards curve twisted from the Montgomery curve (S130) and the first double glass thought, Montgomery It may be implemented including the step (S140) of deriving the Isogeny between the twisted Edwards curves by synthesizing the fourth order Isogeny and the second pair of glass thoughts in the curve, and the step of deriving the image twisted curve coefficient (S150 ) May be further included. Hereinafter, step S100 will be described in detail using an equation.

When applying the fourth-order Isogeny formula in the Montgomery curve, proposed by Jao and De Feo, an isomorphism ι that maps a 4-torsion point to a specific point is used to continuously calculate the fourth-order Isogeny. It must be synthesized. Therefore, after transforming the twisted Edwards curve into a Montgomery curve, the isomorphic idea must be synthesized with the fourth order Isogeny.

In summary, the configuration used in the present invention is shown in Equation 17 below.

Here, ψ and ψ′ ^-1 are the twin-glass events, and φ ₁ is the Isogeny obtained using Bellü's formula.

In step S110, a first birational map from the twisted Edwards curve to the Montgomery curve may be derived.

Let P=(X ₄ :Y ₄ :Z ₄ ) in the projection coordinates be the 4-torsion point in the twisted Edwards curve E _a,d . The twin-glass idea ψ, which is a map from the twisted Edwards curve E _a,d to the Montgomery curve M _A,B , sends P as shown in Equation 18 below.

Here, A and B are as shown in Equation 19 below.

In step S120, it is possible to synthesize the quaternary Isogeny and the isomorphic idea in the Montgomery curve. At this time, in step S120, an even-order Isogeny calculated by Bellru's formula may be used.

P'=(X _M :Z _M ) is the corresponding 4-torsion point in M _A,B . The calculation of the fourth-order _Isogeny φ = φ _1˚ ι with the kernel <P′> can be defined in the same manner as in Equation 14 (following Equation 20).

Since this formula is already synthesized with the isomorphic idea ι, no additional transformation is necessary.

In step S130, it is possible to derive a second pair of glass thoughts returning from the Montgomery curve to the twisted Edwards curve. In other words, the double rational idea ψ ^-1 , which returns to the Edwards curve E _a',d' twisted from the Montgomery curve, is defined as in Equation 21 below.

The curve coefficients a'and _{d'of the} image curves E _a'and d'are as shown in Equation 22 below.

In step S140, by synthesizing the first paired glass thought, the fourth order isogene in the Montgomery curve, and the second double glassed thought, an isogene between twisted Edwards curves may be derived. That is, it is possible to derive the fourth-order isogeny from the twisted Edwards curve E _a,d to E _a′,d′ by the synthesis of the three events ψ and ψ ^-1 . Equation 23 below is a calculation of the fourth-order Isogeny by calculating (Y':Z') when an additional point (Y:Z) is given in E _{a and d} .

Simplifying Equation 23 by substituting X _M =Y ₄ +Z ₄ and Z _M =Z ₄ -Y ₄ is as shown in Equation 24 below.

Now, the calculation of the curve coefficient of the image curve will be described.

In step S150, an image twist curve coefficient may be derived. More specifically, the curve coefficient derived in step S150 is, for the curve coefficients a=A/C and d=D/C of the twisted Edwards curve (E _a,d ), the image twisted Edwards curve (E _{a′, d′)} ), when the curve coefficients a′=A′/C′ and d′=D′/C′, the projected curve coefficient of the twisted Edwards curve is A′=A(Y ₄ +Z ₄ ) ⁴ , D′=8AY _{It may be 4} Z ₄ (Y ₄ ² +Z ₄ ² ) and C′=CY ₄ ⁴ .

In detail _, for the 4-torsion point P = (X ₄ : Y ₄ : Z ₄ ) in the twisted Edwards curve E _a,d , the double glass thought has been used for the transformation into the Montgomery type M _{A and B.} The image and curve coefficients of P and [2]P are given by Equation 25 below.

In Equation 25 above, X _M =Y ₄ +Z ₄ , Z _M =Z ₄ -Y ₄ , X ₀ =(X _M +Z _M ) ² (X _M -Z _M ) ² and Z ₀ =4X _M Z _M ((X _M -Z _M ) ² +((A+2)/4)(4X _M Z _M )).

Then, the isomorphic idea ι sends ψ(P) to a point of the form (1,...), and sends ψ([2]P) to (0,0). The coefficients of the corresponding image curves M _{A and B} are as shown in Equation 26 below.

Then, by synthesizing Isogeny ₁ , the coefficient of the image curve is as shown in Equation 27 and Equation 28 below.

Finally, if we apply the double glass idea to return to the twisted Edwards curve, we can obtain the coefficient of the twisted Edwards curve of the fourth order Isogeny. Let E _a',d' =/E _a,d <P> be the image curve. Then, the following Equation 29 and Equation 30 can be obtained.

X _M /Z _M is the root of the 4th division polynomials φ ₁ =x ⁴ +2Ax ³ +6x ² +2Ax+1 of the Montgomery curve M _A,B , so A can be expressed as X _M and Z _M have. Simplifying the above equation and expressed as Y ₄ and Z ₄ , it is as shown in Equation 31 below.

Optimization of the Edwards curve by the fourth-order Isogeny formula

In step S200, it is assumed that the twisted Edwards curve has a 4-torsion point, and using that the twisted Edwards curve having a 4-torsion point is homogeneous with the Edwards curve, the fourth order isogene between the Edwards curves. Can be derived. More specifically, it is assumed that the twisted Edwards curve has a 4-torsion point, and using that the twisted Edwards curve with 4-torsion points is homogeneous to the Edwards curve, and applied to the projective coordinate system, the image of the Edwards curve in the projective coordinate system Projective curve coefficients can be derived.

The quadratic isogenes from the twisted Edwards curve require square root calculations when converting back to the twisted Edwards curve. Therefore, in the present invention, it is assumed that the Edwards curve twisted by limiting the order of the finite field has a 4-torsion point. However, all elliptic curves with 4-torsion points are birationally equivalent to the Edwards curve. Thus, a twisted Edwards curve with a 4-torsion point is actually an Edwards curve and has a curve coefficient a=1. Since the number of curve coefficients is thus reduced, the proposed Isogeny formula can be further optimized.

Let P=(α, β) be the 3-torsion point in Edwards curve E _d when β=Y ₃ /Z ₃ . If φ:E _d →E _d' is a cubic isozeni with kernel <P>, then E _d' =E _d /<P>. Therefore, Equation 14 is independent of the curve coefficient, and the third-order Isogeny formula for the Edwards curve is the same as the third-order Isogeny formula for the twisted Edwards curve. Since it is the same in the fourth order Isogeny, a = 1 and starting from Equation 19, the following Equation 32 can be obtained.

It should be noted that all formulas of the present invention are of the form in the projective YZ coordinate system. Point operations such as 2x and 3x in the Edwards curve can be performed by the YZ coordinate system, and the formula derived from the present invention can be optimized for an Isogeny-based encryption system.

Fourth-order Isogeny's Calculation Algorithm in Edwards Curve

In step S300, from the curve point (Q=(Y:Z)) on the Edwards curve (E _d ) and the 4-torsion point (P=(Y ₄ :Z ₄ )), the curve on the image Edwards curve (E _d′ ) By calculating the point (Q=(Y':Z')) and the projected curve coefficients (C' and D'), the fourth-order Isogeny between the Edwards curve derived in step S200 may be calculated. More specifically, in step S300, a curve point (Q=(Y:Z)) and a 4-torsion point (P=(Y ₄ :Z ₄ )) on the Edwards curve E _d are given, and the image Edwards curve Isogeny can be calculated by calculating the curve points (Q′=(Y′:Z′)) on (E _d′ ) and the curve coefficients (C′, D′, and d′=D′/C′).

That is, in the fourth-order Isogeny calculation method for a twisted Edwards curve according to an embodiment of the present invention, an effective method for calculating the fourth-order Isogeny in the Edwards curve can be proposed. In order to calculate the quaternary isogeny efficiently, the difference between the Y and Z coordinate systems can be considered. That is, when Y'and Z'are the same as in Equation 24, let F'=Y'+Z' and G'=Y'-Z'. Then, F'and G'are given as in Equation 33 below.

Therefore, in step S300, by calculating F'and G'of Equation 26, the curve point Q(Y':Z') on the image Edwards curve E _d' and the projective curve coefficient may be calculated. More specifically, Y'and Z'can be obtained by calculating Y'=F+G and Z'=FG. In addition, for calculating the coefficients of the image curve, Equation 32 may be expressed as Equation 34 below.

Therefore, the coefficient of the image curve can be more efficiently calculated through Equation 34.

FIG. 3 is a diagram showing an efficient algorithm for calculating a fourth order Isogeny and a curve coefficient corresponding thereto in a method for calculating a fourth order Isogeny for a twisted Edwards curve according to an embodiment of the present invention. As shown in FIG. 3, in step S300 of the fourth-order Isogeny calculation method for a twisted Edwards curve according to an embodiment of the present invention, the curve point Q=(Y:Z) and 4-torsion on the Edwards curve E _d Given the point P=(Y ₄ :Z ₄ ), the curve point Q=(Y′:Z′) on the image Edwards curve E _d′ and the curve coefficients C′, D′, d′=D′/C′ By calculating, it is possible to calculate Isogeny. The total computational cost of this algorithm is 7M+5S. Here, M is a finite field multiplication (field multiplication), and S is a finite field square (field squaring).

Experiment

In order to evaluate the performance of the proposed formula, an algorithm as shown in FIG. 3 was implemented in C language. The Isogeny formula implemented in version 3.0 of the SIDH library was used to calculate Isogeny in the Montgomery curve. In order to accurately compare the quaternary Isogeny calculation method for a twisted Edwards curve according to an embodiment of the present invention and the Isogeny calculation in the Montgomery curve, the field operations implemented in the SIDH library were performed using the Montgomery curve and Used for both Edwards curves. The finite field operation implemented in the SIDH library was written in x64 assembly. As a result, the difference in performance may be purely due to Isogeny's calculation. All cycle counts were obtained on one core of the Intel Core i7-7600 (Skylake) of 3.40 GHz, and were obtained by running Ubuntu 16.06 LTS.

로 고정되며,

이다. 소수 p에 대해서 503-비트 소수 p₅₀₃=2²⁵⁰3¹⁵⁹-1이고, 751-비트 소수 p₇₅₁=2³⁷²3²³⁹-1이다. 기본 유한체 연산(base field operations)은 유한체 연산 사이의 비를 시각화하기 위해 테스트되었다. 이것을 위하여, 각 유한체 연산을 각 소수 유한체에 대하여 10⁸번 반복하였다. 다음 표 1은

상에서 유한체 연산들의 평균 사이클 수를 요약한 것이다.When p is prime, the finite field K is

Is fixed with

to be. For prime p, 503-bit prime p ₅₀₃ =2 ²⁵⁰ 3 ¹⁵⁹ -1 and _751- bit prime p ₇₅₁ =2 ³⁷² 3 ²³⁹ -1. Base field operations were tested to visualize the ratio between finite field operations. For this, each finite field operation was repeated 10 ⁸ times for each fractional finite field. Table 1 below

Summarizes the average number of cycles of finite field operations in phase.

As can be seen in Table 1, for both 503-bit and 751-bit primes, 1S approximately corresponds to 0.8M.

Based on the above results, Table 2 below shows the computational cost and the number of cycles corresponding to the fourth Isogeny when using the Montgomery curve and the Edwards curve. In Table 2, 10 ⁸ average cycles were calculated for each Isogeny calculation. In order to more accurately represent the result, field additions and field subtractions were also counted. In Table 2, a and s represent finite field addition and finite field subtraction, respectively, and cc represents the number of clock cycles.

As can be seen in Table 2, basic finite field operations are processed within a constant time to protect against timing attacks, and finite field addition requires more cycles than finite field subtraction. Therefore, the 4th order Isogeny in the Edwards curve is as fast as the Montgomery curve. Overall, the difference in performance between the algorithm according to the invention using the Montgomery curve and the Edwards curve is small.

In the present invention, a fourth-order Isogeny formula in a twisted Edwards curve that can be applied to an Isogeny-based encryption is proposed. For even-order Isogenies, the bilinear thought between the twisted Edwards and Montgomery curves and the Isogenes in the Montgomery curve were synthesized and optimized by applying them to the projective coordinate system, projective curve coefficients, and division polynomials. In addition, the fourth-order Isogeny formula was further optimized using the Edwards curve. The cost of calculating the fourth order Isogeny in the Edwards curve was 7M+5S, and through experiments, it was confirmed that the Isogeny calculation for the Edwards curve according to the present invention is as efficient as the Isogeny calculation for the Montgomery curve. By applying such an Isogeny formula to Isogeny-based encryption, a new encryption technique can be developed.

The present invention described above can be modified or applied in various ways by those of ordinary skill in the technical field to which the present invention belongs, and the scope of the technical idea according to the present invention should be determined by the following claims.

S100: Converting the twisted Edwards curve into a Montgomery curve, synthesizing the isogenes and isomorphic thoughts between the Montgomery curves, and deriving the fourth order isogenes between the twisted Edwards curves
S110: Deriving a first pair of glass ideas from the twisted Edwards curve to the Montgomery curve
S120: synthesizing the quaternary isogeny and isomorphic idea in the Montgomery curve
S130: Step of deriving a second pair of glass thoughts returning from the Montgomery curve to the twisted Edwards curve
S140: synthesizing the first double glass thought, the fourth order isogene in the Montgomery curve, and the second double glass thought to derive the isozeni between twisted Edwards curves
S150: Deriving image twist curve coefficient
S200: Assuming that the twisted Edwards curve has 4-torsion points, and using that the twisted Edwards curve with 4-torsion points is homogeneous with the Edwards curve, deriving a fourth-order isogene between the Edwards curves
S300: Calculating a point on the Edwards curve, a 4-torsion point, and a projective curve coefficient, and calculating a fourth order isogene between the Edwards curves

Claims (8)

As a method of calculating isogeny (φ:E _d →E _d′ ) between Edwards curves (E _d and E _d′ ),
(1) twisted Edwards curves (E _{a, d)} the Montgomery curve (M _{A, B)} to convert, and Montgomery curve (M _{A, B} and M _{A ', B')} iso Jenny (φ ₁ between: M _{A ,B} →M _A′,B′ ) and isomorphism to derive a fourth-order isogene between twisted Edwards curves;
(2) Assuming that the twisted Edwards curve has a 4-torsion point, and using that the twisted Edwards curve with a 4-torsion point is homogeneous with the Edwards curve, the fourth order Isogeny between the Edwards curves is calculated. Deriving; And
(3) From the curve point (Q=(Y:Z)) on the Edwards curve (E _d ) and the 4-torsion point (P=(Y ₄ :Z ₄ )), the curve on the image Edwards curve (E _d′ ) Computing the point (Q=(Y′:Z′)) and the projected curve coefficients (C′ and D′), and calculating the fourth-order Isogeny between the Edwards curve derived in step (2). Characterized in that, the fourth-order Isogeny calculation method for a twisted Edwards curve.
The method of claim 1, wherein the step (1),
(1-1) deriving a first birational map from the twisted Edwards curve to the Montgomery curve;
(1-2) synthesizing quaternary isogeny and isomorphic events in the Montgomery curve;
(1-3) deriving a second pair of glass thoughts returning from the Montgomery curve to the twisted Edwards curve; And
(1-4) synthesizing the first paired glass image, the fourth order isogene in the Montgomery curve, and the second twin glassed image, and deriving the isogenes between the twisted Edwards curves. How to calculate the fourth-order Isogeny for a twisted Edwards curve.
The method of claim 2,
The fourth-order isogenes between the twisted Edwards curves derived in step (1-4), Y′=(Z ² Y ₄ ² +Y ² Z ₄ ² )YZ(Y ₄ +Z ₄ ) ² and Z′= (Z ² Y ₄ ² +Y ² Z ₄ ² ) ² +2Y ² Z ² Y ₄ Z ₄ (Y ₄ ² +Z ₄ ² ), characterized in that, the fourth-order Isogeny calculation method for a twisted Edwards curve.
The method of claim 2, wherein after the step (1-4),
(1-5) further comprising the step of deriving the image twist curve coefficient,
The curve coefficient derived in step (1-5) is,
For the curve coefficients a=A/C and d=D/C of the twisted Edwards curve (E _a,d ), the curve coefficient a`=A`/C` of the image twisted Edwards curve (E <sub>a`,</sub> d`) and When d`=D`/C`, the projective curve coefficients of the twisted Edwards curve are A`=A(Y <sub>4</sub> +Z <sub>4</sub> ) <sup>4</sup> , D`=8AY ₄ Z ₄ (Y ₄ ² +Z ₄ ² ) and C`=CY <sub>4</sub> <sup>4</sup> <sub>Fourth order</sub> isogeneic calculation method for a twisted Edwards curve, characterized in that.
The method of claim 1, wherein in the step (2),
Assuming that the twisted Edwards curve has 4-torsion points, and using that the twisted Edwards curve with 4-torsion points is homogeneous with the Edwards curve, and applying it to the projective coordinate system, derive the projective curve coefficient of the image Edwards curve in the projective coordinate system. A method for calculating a fourth-order Isogeny for a twisted Edwards curve, comprising the step of.
The method of claim 5, wherein the projective curve coefficient derived in step (2) is
D`=8AY ₄ Z ₄ (Y ₄ ² +Z ₄ ² ) and C`=(Y <sub>4</sub> +Z <sub>4</sub> ) <sup>4</sup> , characterized in that, the fourth-order Isogeny calculation method for a twisted Edwards curve.
The method of claim 1, wherein in the step (3),
Given a curve point (Q=(Y:Z)) and a 4-torsion point (P=(Y <sub>4</sub> :Z <sub>4</sub> )) on the Edwards curve (E <sub>d</sub> ), and the curve point on the image Edwards curve (E <sub>d`</sub> ) ( Q`=(Y`:Z`)) and curve coefficients (C`, D` and d`=D`/C`) are calculated to calculate Isogeny. 4 for a twisted Edwards curve How to calculate tea isogeni.
The method of claim 1, wherein in the step (3),
F`=(YZ(Y <sub>4</sub> <sup>2</sup> +Z <sub>4</sub> <sup>2</sup> )+(Y <sup>2</sup> Z <sub>4</sub> <sup>2</sup> +Z <sup>2</sup> Y <sub>4</sub> <sup>2</sup> ))(ZY <sub>4</sub> +YZ <sub>4</sub> ) <sup>2</sup> and G`=(YZ(Y ₄ ² +Z _{4 ^{2) - (Y 2 Z 4}} 2 + Z 2 Y 4 2)) (ZY 4 -YZ 4) to calculate a ^second, curved point (= Q` on the image Edwards curves (E <sub>d`)</sub> (Y`: Z `)) and a projective curve coefficient, characterized in that the fourth-order Isogeny calculation method for a twisted Edwards curve.

Images