WO2011030468A1 - Arithmetic device - Google Patents

Abstract

A representation transforming unit (51) performs transformations between a projection representation (h0, h1,..., hn-1)(where hi is an element of a finite field Fp^m, and 0 = i = n-1), which represents the elements for which the norm map related to a subfield Fp^mr of a finite field Fp^mn (where n is a positive integer, m is a positive integer, p is a prime number, r is a submultiple of n, and n/r = 3) is "1", and an affine representation (c0, c1,..., cf(n)-1) (where ci is an element of the finite field Fp^m, and 0 = i = f(n)-1) which represents an n-th-order algebraic torus Tn(Fp^m). An arithmetic unit (52) performs a finite field Fp^mn arithmetic for the projection representation (h0, h1,..., hn-1) as transformed by the representation transforming unit (51).

Description

Arithmetic unit

The present invention relates to an arithmetic device.

In recent years, an increase in the size of the encryption system has become a problem in public key encryption technology that realizes secure communication without prior key sharing. Against this background, a method for compressing the cryptographic system size in public key cryptography using an algebraic torus has been proposed (see Non-Patent Document 1, for example). Methods for expressing an algebraic torus element include an affine expression, a projective expression, and an extended field expression (see, for example, Non-Patent Document 2). In algebraic torus public key cryptography, affine representation is used for input / output and projection representation or extended field representation is used for computation in each step of key generation, encryption and decryption. For this reason, it is necessary to convert between each expression (expression conversion) before or after the operation.

However, depending on the combination of the expression before conversion and the expression after conversion, the calculation amount of the expression conversion increases, and there is a fear that the total calculation amount including the expression conversion and the calculation becomes large.

The present invention has been made in view of the above, and an object of the present invention is to provide an arithmetic device capable of reducing the entire calculation amount including expression conversion and calculation.

To solve the above problems and achieve the object, the present invention provides an arithmetic unit, finite F _{p ^ mn} (n: a positive integer, m: a positive integer, p: prime number) parts of the body F _{p ^ mr} (r: a divisor of n and n / r ≧ 3) for a projection expression representing an element whose norm map is 1, an arithmetic unit for performing a finite field F _{p ^ mn} operation, and the finite field F _{p ^ mn} Projection expression (h ₀ , h ₁ , ..., h _n-1 ) (h _i : element of finite field F _{p ^ m} , 0 ≦ i ≦ n-1) Affine expression (c ₀ , c ₁ , ..., c _{φ (n) -1} ) (c _i : element of finite field F _{p ^ m} , 0 ≦ i ≦ φ representing torus T _n (F _{p ^ m} ) (n) -1) and a first expression conversion unit.

According to the present invention, it is possible to reduce the overall calculation amount including expression conversion and calculation.

The figure which illustrates the functional structure of the arithmetic unit 50 of one embodiment. The flowchart which shows the procedure of the expression conversion and arithmetic processing which the arithmetic unit 50 performs. The figure which illustrates the calculation cost concerning each expression conversion in the conventional system. The figure which illustrates the calculation cost concerning each expression conversion in one embodiment. The figure which illustrates the calculation cost concerning each calculation in the conventional system. The figure which illustrates the calculation cost concerning each calculation concerning one embodiment.

Hereinafter, an embodiment of an arithmetic device according to the present invention will be described in detail with reference to the accompanying drawings.

[First embodiment]
First, mathematical preparations for operations in the algebraic torus according to the present embodiment will be described. _Let F _{p ^ m} be a finite field in which the algebraic torus T _n is defined. Here, p is a prime number, and n and m are positive integers. The symbol “^” represents a power and p ^ m represents p to the power of m. F _{p ^ m} represents a finite field with p ^ m elements. An algebraic torus T _n (F _{p ^ m} ) is a group with Φ _n (p ^ m) elements. Here, Φ _n (X) is an nth circular polynomial (circumferential n equal polynomial).

The affine representation of the algebraic torus T _n (F _{p ^ m} ) is represented by the original set of φ (n) F _{p ^ m} . Here, φ (x) is an Euler function. The projection expression of the element g of the algebraic torus T _n (F _{p ^ m} ) is expressed as the following expression 1 or the inverse element of expression 1 using an element h with F _{p ^ mn} .

Where σ is the generator of Galois group Gal (F _{p ^ mn} / F _{p ^ mr} ), and Frobenius map π: x → x ^ (p ^ m) and i = 0,1,…, n / r Σ = π ^ ir using r from -1, r is a divisor of n. In general, the projective representation h is represented by an original set of n F _{p ^ m} .

The meaning of Equation 1 will be described. From Hilbert's theorem 90, the norm map of F _{p ^ m with} respect to F _{p ^ mr} of F _{p ^ mn} is 1 and the existence of an element h of F _{p ^ mn} that satisfies _Equation 1 is equivalent. On the other hand, the definition of the element g of the algebraic torus T _n (F _{p ^ m} ) is that the norm map of F _{p ^ md} of g is 1 for all divisors of n. Equation 1 shows that the specific norm map of d = r of the element g of F _{p ^ mn} is 1, so that to be an element g of the algebraic torus T _n (F _{p ^ m} ) The condition that the norm map of d ≠ r is 1 must be imposed on h.

For example, consider a case where n = 2 * r and r is a prime number different from 2. If the basis of quadratic expansion is {1, x} and the element with F _{p ^ mr} is α, β, it is expressed as h = α + βx. Since Gal (F _{p ^ mn} / F _{p ^ mr} ) = {1, π ^ r}, σ = π ^ r. The element of F _{p ^ mr} is unchanged even when this σ is applied. In this case, the projection expression is an inverse element of Expression 2 or Expression 2 below.

In order to be an element g of an algebraic torus T _n (F _{p ^ m} ), the condition that the norm map for F _{p ^ m2} is 1 is imposed on h. (Αδ, βδ) obtained by multiplying the element δ of F _{p ^ mr} with respect to such (α, β) also represents the element g of the same algebraic torus. This is the reason why it is called projective expression. The projection expression h is represented by the original set (α, β) = (h ₀ , h ₁ ,..., H _n-1 ) of two F _{p ^ mr} . Here, h _i is an element of F _{p ^ m} , 0 ≦ i ≦ n−1.

Solving for the condition that the norm map for F _{p ^ m2} is 1 for (α / β, 1), the r original pairs representing α / β are part of (r-1) F _{p ^} Determined by the original set of _m . This is the affine expression. Projection representation (α, β) = (h ₀ , h ₁ , ..., h _n-1 ) to affine representation (c ₀ , c ₁ , ..., c _{φ (n) -1} ) is computes F _{p ^ mr} of inverse calculation once and F _{p ^ mr} multiplied once by performing the alpha / beta, a portion thereof from the r pieces of the original set representing the calculation result obtained ( It is realized by extracting the original set of r-1) F _{p ^ m} by a predetermined method. Here, c _i is an element of F _{p ^ m} , 0 ≦ i ≦ φ (n) −1.

For example, consider a case where n = 3 * r and r is a prime number different from 3. If the basis of the third-order expansion is {1, y, y ^ 2} and the element with F _{p ^ mr} is α, β, γ, it is expressed as h = α + βy + γy ^ 2. Since Gal (F _{p ^ mn} / F _{p ^ mr} ) = {1, π ^ r, π ^ 2r}, σ = π ^ r or σ = π ^ 2r. The element of F _{p ^ mr} is unchanged even when this σ is applied. In this case, the projection expression is an inverse element of the following Expression 3 or Expression 3.

In order to be an element g of the algebraic torus T _n (F _{p ^ m} ), the condition that the norm map for F _{p ^ m3} is 1 is imposed on h. Solving the condition that the norm map for F _{p ^ m3} is 1 for (α / γ, β / γ, 1), the original set of 2r F _{p ^ m} representing α / γ and β / γ is It is determined by the original set of 2 (r-1) F _{p ^ m} parts. This is the affine expression. Projective representation (α, β, γ) = (h ₀ , h ₁ , ..., h _n-1 ) to affine representation (c ₀ , c ₁ , ..., c _{φ (n) -1} ) transformation, either or both of F _{p ^ mr} of inverse calculation once and F _{p ^ mr} multiplication ceil (2 (r-1) / r) by performing times alpha / gamma and beta / gamma This is realized by extracting a 2 (r-1) F _{p ^ m} original set as a part from a 2r original set representing the obtained calculation result by a predetermined method. Here, ceil () is a ceiling function.

For example, consider the case where n = r1 * r2 and r1 and r2 are different prime numbers. In this case, the projection to act and projective representation the action of origin σ1 of Galois group _{Gal (F p ^ mn / F} p ^ mr1), the origin σ2 of Galois group _{Gal (F p ^ mn / F} p ^ mr2) Two ways of expression are possible. The amount of calculation for realizing the transformation from the projective representation (h ₀ , h ₁ , ..., h _n-1 ) to the affine representation (c ₀ , c ₁ , ..., c _{φ (n) -1} ) is Different in two ways of projection expression. Galois group _{Gal (F p ^ mn / F} p ^ mr1) of F _{p ^ mr1} of inverse calculation once a projective representation of the action of origin σ1 and F _{p ^ mr1} multiplication ceil ((r2-1) (r1 -1) / r1) times, multiplication of Galois group _{Gal (F p ^ mn / F} p ^ mr2) in projective representation exerting origin σ2 of F _{p ^ mr2} of inverse calculation once and F _{p ^ mr2} ceil ((r1-1) (r2-1) / r2) times. Therefore, it is possible to select and use a projective expression with a small amount of expression conversion.

For example, consider the case of n = 2 * 3. In this case, the conventional projective expression is a second-order algebraic torus T ₂ (F _{p ^ mr} ), r = 3, which is an inverse element of Equation 2 or Equation 2. On the other hand, the projection expression according to the present embodiment is an element in which the norm mapping of F _{p ^ mn} with respect to F _{p ^ mr} , r = 2 or 3 is 1, and the inverse of Expression 3 or Expression 3 corresponding to r = 2 It can also be the original. The amount of computation to realize the transformation from the projective representation to the affine representation is the inverse of the formula 2 or 2 (when using the conventional method), one F _{p ^ m3} inverse calculation and the multiplication of F _{p ^ m3} it is one, (when the system of the present embodiment) inverse in the case of formula 3 or formula 3, is multiplication one F _{p ^} reverse _m2 original calculated once and F _{p ^ m2.} Therefore, the calculation amount of the method of the present embodiment is smaller than the calculation amount of the conventional method.

That is, conventionally, the projection expression of the 6th order torus has a 3rd order vector (a ₀ , a ₁ , a ₂ , b ₀ , b ₁ , b ₂ ) as a second order torus on the third extension field. Was used. Here, a _i and b _i are _elements of F _{p ^ m} , 0 ≦ i ≦ 2. However, when calculating the transformation from the projective representation to the affine representation (c ₀ , c ₁ ), the computation of the cubic extension field is performed, which is wasteful. Specifically, (c ₀ , c ₁ , c ₂ ) = (a ₀ , a ₁ , a ₂ ) / (b ₀ , b ₁ , b ₂ ) was calculated, and c ₂ was discarded. Here, c _i is an element of F _{p ^ m} and 0 ≦ i ≦ 2.

On the other hand, in the present embodiment, the projection expression of the sixth-order torus includes a third-order vector triplet (a ₀ , a ₁ , b ₀ , b ₁ , b ₂ , c ₀ , c ₁ ) is used. Here, a _i , b _i, and c _i are _elements of F _{p ^ m} and 0 ≦ i ≦ 1. Then, when calculating the transformation from the projective representation to the affine representation (d ₀ , d ₁ ), the calculation can be performed only by the operation of the secondary extension field, and there is no waste. Specifically, (d ₀ , d ₁ ) = (b ₀ , b ₁ ) / (c ₀ , c ₁ ) is calculated. Here, d _i is an element of F _{p ^ m} and 0 ≦ i ≦ 1. Therefore, in the present embodiment, it is possible to reduce the amount of calculation and reduce waste in conversion from the projective expression to the affine expression as compared with the conventional method.

Similarly, a projective expression can be configured for n including three or more prime numbers or squares. That is, the projection expression can be similarly configured for n where n = r1 * r2 * r3 (r1, r2, r3: prime number) or n = r4 * r4 (r4: positive integer).

Next, the hardware configuration of the arithmetic device according to this embodiment will be described. The arithmetic device according to the present embodiment includes a control unit such as a CPU (Central Processing Unit) that controls the entire device, a ROM (Read Only Memory) that stores various data and various programs, and a RAM (Random Access Memory). Equipped with a storage unit, an auxiliary storage unit such as an HDD (Hard Disk Drive) or CD (Compact Disk) drive device for storing various data and various programs, and a bus connecting them, using a normal computer It has a hardware configuration.

In such a hardware configuration, various functions realized by the CPU of the arithmetic unit executing various programs stored in the main storage unit and the auxiliary storage unit will be described. FIG. 1 is a diagram illustrating a functional configuration of the arithmetic device 50. The calculation device 50 includes an expression conversion unit 51 and a calculation unit 52. These units are generated on a main storage unit such as a RAM when the CPU program is executed.

The representation conversion unit 51 is a norm related to a subfield F _{p ^ mr} (r: divisor of n: n / r ≧ 3) of a finite field F _{p ^ mn} (n: positive integer, m: positive integer, p: prime number). Projective representation (h ₀ , h ₁ , ..., h _n-1 ) (h _i : element of finite field F _{p ^ m} , 0 ≦ i ≦ n-1) and nth order Affine expression (c ₀ , c ₁ , ..., c _{φ (n) -1} ) (c _i : element of finite field F _{p ^ m} , 0 ≦ i representing algebraic torus T _n (F _{p ^ m} ) Conversion between ≦ φ (n) -1). Specifically, the expression conversion unit 51 includes a first expression conversion unit 51A and a second expression conversion unit 51B. The first representation conversion unit 51A converts the projection expression after the calculation performed by the calculation unit 52, which will be described later, into an affine expression, thereby _substituting the subfield F _{p ^ md} of the finite field F _{p ^ mn} for all divisors d. Each element c _i of the affine expression (c ₀ , c ₁ ,..., C _{φ (n) −1} ) determined by the condition that the norm map for 1 is 1 is obtained. That is, the first representation conversion unit 51A applies a set of r elements h _i of the projection representation (h ₀ , h ₁ ,..., H _n-1 ) after the calculation performed by the calculation unit 52 to the first expression conversion unit 51A. For all divisors of n, finite field F _{p ^ mr} is determined by the condition that the norm map for the subfield F _{p ^ md} of the finite field F _{p ^ mn} is 1, and the affine representation (c ₀ , c ₁ ,..., C _{φ (n) −1} ) to obtain each element c _i . The second representation conversion unit 51B uses the affine representation (c ′ ₀ , c ′ ₁ ,..., C ′ _{φ (n) −1} ) (c ′) representing the _n- th order algebraic torus T _n (F _{p ^ m} ). _i : For each element c ' _{i of the} element 0 ≤ i ≤ φ (n) -1) of the finite field F _{p ^ m} , subfield F of the finite field F _{p ^ mn} for all divisors d Projective representation that is the target of the operation performed by the operation unit 52 by performing the finite field F _{p ^ m} operation determined by the condition that the norm map for _{p ^ md} is 1, the modulus polynomial and the base for constructing the nth-order expansion Each element h ′ _i of (h ′ ₀ , h ′ ₁ ,..., h ′ _n−1 ) is obtained. The calculation unit 52 performs a finite operation that is an operation on the finite field F _{p ^ mn on} the projection expression (h ′ ₀ , h ′ ₁ ,..., H ′ _n−1 ) converted by the expression conversion unit 51. Perform field F _{p ^ mn} operation. The calculation includes, for example, multiplication (including square), Frobenius map, and power. Also, for each operation, the normal operation (normal operation) and the partial field F _{p ^ m '} using all elements including elements of the projection expression or elements of the partial field F _{p ^ m'} There are operations that are originally restricted (referred to as constraint operations) and operations that are a mixture of normal operations and constraint multiplication (referred to as mixed operations). The calculated projection expression is converted into an affine expression by the expression conversion unit 51 described above.

Next, the procedure of expression conversion and arithmetic processing performed by the arithmetic device 50 according to the present embodiment will be described with reference to FIG. The arithmetic unit 50 uses each element c ′ _{i of the} affine expression (c ′ ₀ , c ′ ₁ ,..., C ′ _{φ (n) −1} ) representing the _n- th order algebraic torus T _n (F _{p ^ m} ). For all divisors of n, it is determined by the condition that the norm map for the subfield F _{p ^ md} of the finite field F _{p ^ mn} is 1, and the modulus polynomial and basis for constructing the n-th order expansion performs a finite field F _{p ^ m} calculation, finite field F _{p ^ mn} projective representation norm mapping with respect to the partial body F _{p ^ mr} represents the original is one of _{(h '0, h' 1} , ···, h ' Each element h ′ _i of _n−1 ) is obtained (step S1). Next, the arithmetic unit 50 performs a finite field F _{p ^ mn} operation on the projection expression (h ′ ₀ , h ′ ₁ ,..., H ′ _n−1 ) obtained in step S1 (step S2). ). Thereafter, the arithmetic unit 50 calculates all of n for the set of r elements h _i of the projection expression (h ₀ , h ₁ ,..., H _n−1 ) calculated in step S2. The finite field F _{p ^ mr} is determined by the condition that the norm map of the subfield F _{p ^ md} of the finite field F _{p ^ mn} is 1 for the divisor d of, and the affine representation (c ₀ , c ₁ , ... , c _{φ (n) −1} ), each element c _i is obtained (step S3).

According to the configuration described above, the amount of calculation for converting from a projective representation to an affine representation is smaller than that of the conventional method. However, the conversion from the affine representation to the projective representation may increase the amount of calculation compared to the conventional method. However, the amount of calculation that increases in this case is smaller than the amount of calculation that can be reduced compared to the conventional method when converting from a projective representation to an affine representation. For this reason, the total calculation amount including expression conversion and calculation can be suppressed.

[Second Embodiment]
Next, a second embodiment of the arithmetic device will be described. In addition, about the part which is common in the above-mentioned 1st Embodiment, it demonstrates using the same code | symbol or abbreviate | omits description.

In this embodiment, an example in which a modulus polynomial is fixed will be described. First, a conventional method will be described. Here, n = 6 and F _{((p ^ m) ^ 3) ^ 2)} = F _{(p ^ m) ^ 3} [x] / (f ₂ (x)), F _{(p ^ m) ^ 3} = F _{p ^ m} [y] / (f ₃ (y)), the quadratic expansion polynomial is f ₂ (x) = x ² -d, d∈F _{p ^ m} , and the cubic expansion method Let the polynomial be f ₃ (y) = y ³ -w, w∈F _{p ^ m} . Then, after obtaining the projective representation T ₂ (F _{(p ^ m) ^ 3} ), the norm map for the subfield F _{p ^ md} of the finite field F _{p ^ m6} is 1 for all divisors of n = 6. By solving for g ^ (p ^ 4m + p ^ 2m + 1) = 1, an affine representation of T ₆ (F _{p ^ m} ) is obtained. Here, the mapping for converting from the affine representation to the projective representation is expressed by Equation 4. A mapping for converting from the projective representation to the affine representation is expressed by Equation 5.

The right side of Equation 5 is an element of F _{(p ^ m) ^ 3} , but it is sufficient to obtain only the constant term and the coefficient of y. The mapping for converting from the affine representation to the projective representation may be a form in which c1 is multiplied by the numerator and denominator so that the inverse element does not have to be calculated. FIG. 3 is a diagram illustrating the calculation cost for each expression conversion in the conventional method. Respectively I, M, S, F is the shown in the figure, the inverse element of F _{p ^ m,} multiplication of F _{p ^ m,} square F _{p ^ m,} the computation cost of the Frobenius mapping F _{p ^ m.} Also, B is the computational cost of multiplication between the original F _{p ^} constants belonging to _m and F _{p ^ m.} The calculation cost of B depends on how to take parameters d and w.

On the other hand, in the present embodiment, projective representation _{T 3 (F (p ^ m} ) ^ 2) After obtaining the partial bodies of the finite field F _{p ^ m6} for all divisor d of n = 6 F _{p ^} Solving g ^ (p ^ 3m + 1) = 1 as a condition for the norm mapping for _md to be 1. Since the following formula 6 holds, σ = π ^ 2 or π ^ 4. Here, σ = π ^ 2 is used. For the norm, the following equation 7 holds.

The condition that the norm is 1 for F _{(p ^ m) ^ 2 in} g∈F _{(p ^ m) ^ 6} is equal to the condition that g is T ₃ (F _{(p ^ m) ^ 2} ) (see Equation 8) That is, Expression 9 is established.

F _{((p ^ m) ^ 2) ^ 3)} = F _{(p ^ m) ^ 2} [y] / (f ₃ (y)), F _{(p ^ m) ^ 2} = F _{p ^ m} As [x] / (f ₂ (x)), the quadratic expansion polynomial is f ₂ (x) = x ² -d, d∈F _{p ^ m} and the cubic expansion polynomial is f ₃ (y) = y ² −w, w∈F _{p ^ m} . When Equation 9 is specifically written, Equation 10 is obtained. In order to obtain T ₆ (F _{p ^ m} ), (α, β, γ) which is a solution of g ^ (p ^ 3m + 1) = 1 is obtained.

(Αδ, βδ, γδ) obtained by multiplying (α, β, γ) by δ∈F _{(p ^ m) ^ 2} respectively represents the same element g. This is the reason why it is called projective expression. The representative point of the projection expression (α, β, γ) is set to (α / γ, β / γ, 1) or (α / β, 1,0) (Equations 11a to 11c).

Next, when g ^ (p ^ 3m + 1) = 1 is solved for Expressions 11a to 11c, an affine representation of T ₆ (F _{p ^ m} ) is obtained.

When γ = 0 and β ≠ 0, if α / β = α ′, Equation 12 is solved, which means that Equation 13 is obtained. However, this contradicts the irreducibility of f ₃ (y). Therefore, there is no solution.

When γ ≠ 0 and α / γ = α ′ and α / γ = β ′, Equation 14 is solved, which means that Equation 15 is obtained. Due to the irreducibility of f ₃ (y), Equation 16 is obtained.

Assuming that α ′ = a ₀ + a ₁ x and β ′ = b ₀ + b ₁ x, Equation 16 can be rewritten as Equation 17, and Equation 17 can be solved.

For example, when a ₀ and a ₁ are represented by b ₀ and b ₁ , Expression 18 is obtained. Here, b ₁ ≠ 0. This is because if b ₁ = 0, b ₀ ^ 3 = w, which contradicts the irreducibility w ^ ((p ^ m-1) / 3) ≠ 1 of f ₃ (y).

Therefore, the mapping for converting from the affine representation to the projective representation is expressed by Equation 19.

A mapping for converting from the projective representation to the affine representation is expressed by Equation 20.

Note that the mapping for converting from the affine representation to the projective representation may be a form in which b1 is multiplied by the numerator and denominator so that the inverse element does not have to be calculated.

FIG. 4 is a diagram illustrating the calculation cost for each expression conversion in the present embodiment. .

[Third embodiment]
Next, a third embodiment of the arithmetic device will be described. In addition, about the part which is common in the above-mentioned 1st Embodiment or 2nd Embodiment, it demonstrates using the same code | symbol or abbreviate | omits description.

In the present embodiment, an example will be described in which the modulus polynomial is fixed and multiplication, square, and Frobenius mapping are performed as the finite field F _{p ^ mn} operation. First, a conventional method will be described. As in the second embodiment, n = 6 and F _{((p ^ m) ^ 3) ^ 2)} = F _{(p ^ m) ^ 3} [x] / (f ₂ (x)) , F _{(p ^ m) ^ 3} = F _{p ^ m} [y] / (f ₃ (y)), the quadratic expansion polynomial is f ₂ (x) = x ² -d, d∈F _p Let _{^ m} be the third-order expansion polynomial, f ₃ (y) = y ² −w, w∈F _{p ^ m} .

First, the normal operation of the finite field F _{p ^ mn} operation will be described. The operations of the extended field type and the extended field type are normal operations. Of these operations, a case where the karatsuba method is used for multiplication will be described. The multiplication result of the expansion type (α, β) and the expansion type (γ, δ) is expressed by Equation 21 and becomes (αγ + βδd, βγ + αδ). Since αγ, βδ, (α + β) (γ + δ) is calculated, the calculation cost is 3 (6M + 2B + 14A) + 3B + 15A = 18M + 9B + 57A.

Next, the case where the Toom-Cook method is used for multiplication will be described. The expansion type (α, β) and the expansion type (γ, δ) are each converted into a sixth-order expansion field. The multiplication result is expressed by Equation 22.

In order to find e ₀ ,..., e ₁₀ , 11 values are substituted for s and 11 simultaneous equations are solved. The assigned left side corresponds to the multiplication on the basic field, and becomes 11M. If the sixth-order expansion polynomial is binomial, constants remain after dividing by s ^ 6 by the modulus, and the multiplication of the constant on the fundamental field is 5B.

Next, the case of using the Complex method for square will be described. The squared result of the extended field type (α, β) is expressed by Equation 23 and becomes (α ^ 2 + β ^ 2 * d, 2αβ), and α ^ 2 + β ^ 2 * d = (α + β) (α + βd)-(1 + d) αβ is calculated. Therefore, the calculation cost is 2 (6M + 2B + 14A) + 6B + 12A = 12M + 10B + 40A.

Next, the case where the Toom-Cook method is used for square will be described. What is necessary is just to change the multiplication on the basic field in the case of multiplication to the square on the basic field.

Next, the Frobenius map will be explained. The Frobenius mapping result of the extended field type (α, β) is expressed by Equation 24 and becomes (α ^ p + β ^ p * d ^ (p ^ 1) / 2), and the calculation cost is 2 (3F + 2B) + 3B = 6F + 7B.

Next, the mixed operation and the constraint operation of the finite field F _{p ^ mn} operation will be described. The expansion field type and affine type operations are mixed operations, and the affine type and affine type operations are constraint operations. It is assumed that the mapping for converting from the affine representation to the projective representation is expressed by Expression 25. Further, a mapping for converting from the projective expression to the affine expression is represented by Expression 26.

First, consider the case of using the Karatsuba method for multiplication. The multiplication result of the expanded field type (α, β) and the affine type (δ, 1) is (αδ + βd, βδ + α). The calculation cost is 2 (6M + 2B + 14A) + 3B + 6A = 12M + 7B + 34A.

The multiplication result of the affine type (α, 1) and the affine type (δ, 1) is (αδ + d, δ + α). The calculation cost is (6M + 2B + 14A) + 4A = 6M + 2B + 18A.

Next, consider the case of using the Toom-Cook method for multiplication. The expansion field type (α, β) and the affine type (δ / f0, 1 / f0) are converted to the sixth expansion field, respectively. Here, δ = f0 + f1y + f2y2. The reason for transforming the affine type in this way is that the constant term becomes 1 when converted to the base of the sixth-order extension field. The multiplication result is expressed by Expression 27.

To find g ₂ , ..., g ₉ , substitute 8 values for s and solve 8 simultaneous equations. The assigned left side corresponds to the multiplication on the basic field and becomes 8M. Also, if the sixth-order expansion polynomial is binomial, constants remain after s ^ 6 divided by the modulus polynomial, and the multiplication of the constant on the fundamental field is 4B. The affine type (α / c ₀ , 1 / c ₀ ) and the affine type (Δ / f ₀ , 1 / f ₀ ) are each converted into a sixth-order extension field. Here, α = c ₀ + c ₁ y + c ₂ y ^ 2. If the conversion from the affine representation to the projected representation (α / c ₀ , 1 / c ₀ ) is expressed by Equation 28, the calculation cost is I + 4M + 2S + B + A. The conversion to the sixth extension field can be realized by replacing elements and multiplying by a constant, and the calculation cost is 3B considering that it is not necessary to calculate multiplication for zero elements. The multiplication result is expressed by Equation 29.

In order to find g ₄ ,..., g ₈ , five values are substituted into s, and five simultaneous equations are solved. The assigned left side corresponds to the multiplication on the basic field and becomes 5M. If the sixth-order expansion polynomial is binomial, constants remain after dividing s ^ 6 by the normal polynomial, and the multiplication of the constant on the fundamental field is 3B.

Next, consider the case of using the Karatsuba method for squares. The square result of the affine type (α, 1) is (α ^ 2 + d, 2α). c ₁ c ₂ w = c ₀ ^ 2 + d / 3 can be used to omit the square on the basal body once. Using Karatsuba method, the calculation cost is (5S + B + 9A) + 4A = 5S + B + 13A. This is because α ^ 2 can be calculated by Equation 30.

Next, consider the case of using the Toom-Cook method for squares. For the square of the affine type (α / c ₀ , 1 / c ₀ ), the multiplication on the basic field in the case of multiplication may be changed to the square on the basic field. There is a possibility that the square on the basal body can be omitted once using c ₁ c ₂ w = c ₀ ^ 2 + d / 3. However, g ₆ where these converted terms a ₂ a ₄ and a ₃ ^ 2 appear is s = (1 + a ₂ s ^ 2 + a ₃ s ^ 3 + a ₄ s ^ 4) ^ 2 It can be calculated using t ₁ , t _{? 1} , t∞ and a ₂ ^ 2 with = ± 1, ∞ assigned. If a ₂ a ₃ or a ₃ a ₄ is calculated as a multiplication on the fundamental field, the Toom-Cook method can be modified to calculate with much less A than the M + 4S and Toom-Cook methods. Expression 31 is expression 32.

Next, the Frobenius map will be explained. The Frobenius mapping result of the affine type (α, 1) is (α ^ p, d ^ {(p-1) / 2}). The calculation cost is 3F + 2B.

Next, in the present embodiment, an example will be described in which a modulus polynomial is fixed and multiplication, square, and Frobenius mapping are performed as a finite field F _{p ^ mn} operation. As in the second embodiment, n = 6 and F _{((p ^ m) ^ 2) ^ 3)} = F _{(p ^ m) ^ 2} [y] / (f3 (y) ), F _{(p ^ m) ^ 2} = F _{p ^ m} [x] / (f2 (x)), the quadratic expansion polynomial is f ₂ (x) = x ² -d, d∈F _p Let _{^ m} be the third-order expansion polynomial, and fix the polynomial by f ₃ (y) = y ² -w, w∈F _{p ^ m} .

First, the normal operation of the finite field F _{p ^ mn} operation will be described. A case where the karatsuba method is used for multiplication will be described. The multiplication result of the expansion field type (α, β, γ) and the expansion field type (δ, ε, ζ) is represented by a vector 52. The calculation cost is 6 (3M + B + 5A) + 4B + 28A = 18M + 10B + 58A. When the elements are exchanged and calculated as the secondary expansion of the tertiary expansion, 18M + 9B + 57A is obtained as in the case of multiplication in a normal operation.

Next, the case where the Toom-Cook method is used for multiplication will be described. The expansion body type (α, β, γ) and the expansion body type (δ, ε, ζ) are converted into the sixth expansion field, respectively. The multiplication result is expressed by Expression 33.

In order to find g ₀ ,..., g ₁₀ , 11 values are substituted into s and 11 simultaneous equations are solved. The assigned left side corresponds to multiplication on the basic field and becomes 11M. If the sixth-order expansion polynomial is binomial, constants remain after dividing by s ^ 6 by the modulus, and the multiplication of the constant on the fundamental field is 5B.

Next, the case of using the Complex method for square will be described. The squared result of the extension field type (α, β, γ) is represented by the vector 34. When the elements are exchanged and calculated as the secondary expansion of the tertiary expansion, 12M + 10B + 40A is obtained as in the case of the square in the normal calculation.

Next, the case where the Toom-Cook method is used for square will be described. The multiplication on the basic field in the case of multiplication may be changed to the square on the basic field.

Next, the Frobenius map will be explained. The Frobenius mapping result of the expansion field type (α, β, γ) is expressed in the vector 36 by Expression 35 when p mod 3 = 1. The calculation cost is 3 (2F + B) + 4B = 6F + 7B.

Next, mixed operations and constraint operations will be described. It is assumed that the mapping for converting from the affine expression to the projective expression is expressed by Expression 37. Further, a mapping for converting from the projective expression to the affine expression is represented by Expression 38.

First, consider the case of using the Karatsuba method for multiplication. A multiplication result of the expansion field type (α, β, γ) and the affine type (δ, ε, 1) is represented by a vector 39. The calculation cost is 5 (3M + B + 5A) + 4B + 24A = 15M + 9B + 49A. When the elements are exchanged and calculated as the secondary expansion of the tertiary expansion, 2 (6M + 2B + 14A) + (3M + B + 5A) + 3B + 14A = 15M + 8B + 47A.

The multiplication result of the affine type (α, β, 1) and the affine type (δ, ε, 1) is represented by a vector 40. The calculation cost is 3 (3M + B + 5A) + 2B + 18A = 9M + 5B + 33A. When replacing the elements and calculating as the secondary expansion of the third expansion, 2 (3M + B + 10A) + (3M + 4A) + 2B + 13A = 9M + 4B + 37A.

Next, consider the case of using the Toom-Cook method for multiplication. The expansion field type (α, β, γ) and the affine type (δ / d ₀ , ε / d ₀ , 1 / d ₀ ) are converted into sixth-order expansion fields, respectively. Here δ = d ₀ + d ₁ x. The reason for transforming the affine type in this way is that the constant term becomes 1 when converted to the base of the sixth-order extension field. The multiplication result is expressed by Equation 41.

To find g ₁ , ..., g ₉ , 9 values are substituted into s and 9 simultaneous equations are solved. The assigned left side corresponds to the multiplication on the basic field and becomes 9M. If the sixth-order expansion polynomial is binomial, constants remain after dividing s ^ 6 by the modulus, and the multiplication of the constant on the fundamental field is 4B.

The affine type (α / a ₀ , β / a ₀ , 1 / a ₀ ) and the affine type (δ / d ₀ , ε / d ₀ , 1 / d ₀ ) are converted into sixth-order extensions, respectively. Here, α = a ₀ + a ₁ x. If the conversion from the affine representation to the projective representation (α / a ₀ , β / a ₀ , 1 / a ₀ ) is expressed by Equation 42, the calculation cost is I + 7M + 2S + 3B + 2A. The conversion to the sixth extension field can be realized by replacing elements and multiplying by a constant, and the calculation cost is 3B considering that it is not necessary to calculate multiplication for zero elements. The multiplication result is expressed by Expression 43.

In order to find g ₂ ,..., g ₈ , 7 values are substituted into s and 7 simultaneous equations are solved. The assigned left side corresponds to the multiplication on the base field and becomes 7M. If the sixth-order expansion polynomial is binomial, constants remain after dividing s ^ 6 by the normal polynomial, and the multiplication of the constant on the fundamental field is 3B.

Next, consider the case of using the Complex method for square. The square result of the affine type (α, β, 1) is expressed by Equation 44. The square result is expressed by Equation 45 as the secondary expansion of the third expansion by replacing the elements. The calculation cost is (3M + B + 10A) + (3M + B + 5A) + 4B + 7A = 6M + 6B + 22A.

Next, consider the case of using the Karatsuba method for squares. Further, if a relational expression established between a ₀ , a ₁ , b ₀ , and b ₁ is used, it can be arranged as shown in Expression 46. The calculation cost is 5M + S + 5B + 18A.

Next, consider the case of using the Toom-Cook method for squares. The square of (α / a ₀ , β / a ₀ , 1 / a ₀ ) may be changed from the multiplication on the base field in the case of multiplication to the square on the base field. There is a possibility that the square on the basal body can be omitted twice by using a ₀ b ₀ -a ₁ b ₁ + w / 2 = 0 and b ₀ ^ 2-b ₁ ^ 2d + 2a ₀ = 0. With respect to Expression 47, the Toom-Cook method is transformed into Expression 48. That is, the relational expression holds for each element of the affine type is only using only two eyes in the calculation of g _2. Computation cost can be calculated with much less A than 2M + 4S and Toom-Cook method.

Next, the Frobenius map will be explained. The affine type (α, β, 1) Frobenius mapping result is represented by the vector 36 described above when p mod 3 = 1. The calculation cost is 2 (2F + B) + 2B = 4F + 4B.

FIG. 5 is a diagram illustrating the calculation cost for each F _{p ^ mn} operation in the conventional method. FIG. 6 is a diagram exemplifying a calculation cost for each F _{p ^ mn} operation according to the present embodiment. Note that the expansion type (α, β) in FIG. 5 is a calculation cost for a normal calculation. The affine type (α, c ₁ ) and the affine type (α, 1) are calculation costs for the constraint operation. The mixing (α, β) (δ, f1) and the mixing (α, β) (δ, 1) are calculation costs for the mixing operation. The expanded field type (α, β, γ) in FIG. 6 is a calculation cost for a normal calculation. The affine type (α, β, b ₁ ) and the affine type (α, β, 1) are calculation costs for the constraint calculation. The mixing (α, β, γ) (δ, ε, e ₁ ) and the mixing (α, β, γ) (δ, ε, 1) are calculation costs for the mixing operation. As shown in FIGS. 5 to 6, although the calculation cost according to the present embodiment may be larger, the amount that increases compared to the conventional method can be calculated from the projection expression with reference to FIGS. It is smaller than the amount that can reduce the calculation cost for conversion to the affine representation. For this reason, according to this Embodiment, the whole calculation cost including expression conversion and a calculation can be reduced compared with the past.

[Fourth Embodiment]
Next, a case where exponentiation is performed as a calculation will be described. For example, in the algebraic torus T _n (F _{p ^ m} ), n = 6 will be described. A case where the power is calculated using a table created by a table creation device (not shown) will be described. The power calculation is performed by combining multiplication, square, and Frobenius mapping. First, an example in which such a power calculation is performed using the Karatsuba method will be described.

Here, an operation for calculating the power g ^ a will be described in comparison with the conventional technique. The exponent a is input in p-adic expression or the p-adic expansion of a is calculated to obtain a p-adic expression. Next, a binary representation of each digit of the exponent a expressed in p-adic is obtained. For each digit of the p-adic representation of the exponent a, a sequence in which the same digit of the binary representation is arranged is obtained. With respect to the obtained 2m long ceil (log ₂ (p)) sequences, all sequences starting with 1 and ending with 1 within the window width win are extracted and set as table entries. Alternatively, precalculate all possibilities within the window width win as table entries. The table creation device, for example, T ₁₁ = g × φ (g) for the third series 11 and T ₁₁₀₁ = g × φ ^ 1 (g) × φ for the 11th series 1101 Calculate ^ 3 (g) and store it in the table. It should be noted that in the notation of series, the beginning corresponds to p ^ 0 and is written as p ^ 1, p ^ 2,. That is, for the k-th sequence B ₀ B ₁ B ₂ B ₃ ... B _i ... B _win-1 , T _{B0 B1 B2 B3 ... Bi ... Bwin-1} = Π _i φ ^ Calculate and hold (B _i * i) (g). Here, B _win-1 means that the subscript of B is win-1.

In this calculation, first, a sequence in which 2 ^ j digits in binary representation are arranged for each digit of the index a is represented by concatenation of table entries. Here j is a non-negative integer. For example, the series 11001101 is expressed as 11 · 00 · 1101. Each digit in the sequence corresponds to each digit in p-adic. For example, the arithmetic unit calculates T ₁₁ × φ ^ 4 (T ₁₁₀₁ ) for 1 1 00 1 10 1. The calculation result corresponding to the 2 ^ j digit series is A _j . Then, the arithmetic unit calculates the square of A _j from the larger _j , multiplies A _j ^ 2 by the next A _j-1 , and calculates the square of the result, (A _j ^ 2 * A _{j− 1} ) It repeats multiplying ^ 2 and the next A _j-2 and calculating the square of the result. 0 ≦ j ≦ ceil (log ₂ (p))-1 and ceil (x) are ceiling functions that return the smallest integer greater than or equal to x.

Regarding the calculation cost, the main part of the maximum calculation cost of table generation is
[T1] Multiplication in the (win-1) times algebraic torus for the input element g and the Frobenius map of the element g,
[T2] Multiplication in the (2 ^ (win-1) -win) algebraic torus for the input g and the Frobenius map of the entry already in the table.

The main part of the calculation cost of this calculation is determined by the index a, the window width win, and the expansion order m of the foundation. As a breakdown of multiplication in f (a, win, m) algebraic torus,
[M1] Multiplying ceil (log ₂ (p)) times in the algebraic torus between table entries,
[M2] Multiplication (f (a, win, m) -2ceil (log ₂ (p)) + 1) times in the algebraic torus of the intermediate result and the table entry,
The number of multiplications of [M3] corresponds to the operation of multiplying Aj.
[M4] is the square in the algebraic torus of (ceil (log ₂ (p))-1) intermediate results.

With the conventional technique (when n = 2 * r, r = 3, and the third-order expansion law polynomial is f ₃ (y) = y ^ 3-w), the power is calculated using the Karatsuba method in the constraint operation. An example of calculation cost in the case of execution will be described.
[T0] The computational cost of the input transformation of the input element g is I + M + S + B + A: the multiplication in the 2-by-2 affine projection transformation [T1] to [T2] algebraic torus in FIG. Calculation cost of 6M + 2B + 18A per: 2 rows 4 columns affine type multiplication (Karatsuba method)
[T3] Maximum computational cost representation conversion table entry (2 ^ (win-1) -1) times, per F _{p ^ mr} of inverse once and F _{p ^ mr} multiplication once, When the Itoh-Tsujii method is used for the inverse element calculation, I + 21M + 10B + 39A: the 5-row 2-column projection affine transformation of FIG. All entries in the table are projected expressions with 2 elements being 0 and 1 element being 1 among 6 F _{p ^ m} elements.
[M1] The calculation cost of multiplication in the algebraic torus between entries in the table is 6M + 2B + 18A: 2 rows 4 columns affine type multiplication (Karatsuba method) in the upper diagram of FIG.
[M2] Multiplication in an algebraic torus of intermediate results and table entries is an algebraic torus of a general projection expression and a projection expression in which 2 elements are 0 and 1 element is 1 out of 6 Fp ^ m elements. The calculation cost of 12M + 7B + 34A per time because it is a multiplication in 2: 3 rows mixed multiplication (Karatsuba method) in the lower figure of Fig. 5
[M3] Since the multiplication in the algebraic torus between the intermediate results is a general projection expression, the calculation cost of 18M + 9B + 57A per time: 2 rows and 3 columns expansion field multiplication (Karatsuba method) in the upper diagram of FIG.
[M4] Since it is a square in an algebraic torus between general projection expressions, if the Complex method is used, the calculation cost of 12M + 10B + 40A per time is the 4 × 3 expanded field square in the upper diagram of FIG.

Next, the computing device 50 in the present embodiment (when n = 3 * r, r = 2, and the quadratic expansion polynomial is f ₂ (x) = x ^ 2-d) uses the Karatsuba method. An example of the calculation cost when executing the power calculation will be described.
[T0] The computational cost of the input transformation of the input element g is I + 2M + 2S + 3B + A: 2 rows and 2 columns affine projective transformation [T1] to [T2] of the algebraic torus in FIG. Calculation cost of 9M + 4B + 37A per: 2 rows 4 columns affine type multiplication (Karatsuba method)
[T3] Maximum computational cost representation conversion table entry (2 ^ (win-1) -1) times, per F _{p ^ mr} of inverse once and F _{p ^ mr} multiplication once, When the Itoh-Tsujii method is used for inverse element calculation, it is I + 8M + 3B + 10A: the 5-row 2-column projection affine transformation of FIG. All entries in the table are projected expressions with 2 elements being 0 and 1 element being 1 among 6 F _{p ^ m} elements.
[M1] Multiplication cost in algebraic torus between table entries is 9M + 4B + 37A per time: 2-row 4-column affine type multiplication (Karatsuba method) in the upper diagram of FIG.
[M2] Multiplication in an algebraic torus of intermediate results and table entries is an algebraic torus of a general projection expression and a projection expression in which 2 elements are 0 and 1 element is 1 out of 6 Fp ^ m elements. The calculation cost of 15M + 8B + 47A per time because it is multiplication in 2: 3 rows mixed multiplication (Karatsuba method) in the lower figure of Fig. 6
[M3] Since the multiplication in the algebraic torus between the intermediate results is between the general projection expressions, the calculation cost of 18M + 9B + 57A per time: 2 rows 3 columns expansion field multiplication (Karatsuba method) in the upper diagram of FIG.
[M4] Since it is a square in the algebraic torus between general projection expressions, if the Complex method is used, the calculation cost of 12M + 10B + 40A per time is the 4 × 3 expanded field square in the upper diagram of FIG.

Next, an example of calculating the power in the algebraic torus using the Toom-Cook method will be described.

In the conventional technique (when n = 2 * r, r = 3, and the cubic polynomial of the _third -order expansion is f ₃ (y) = y ^ 3-w), the power is raised using the Toom-Cook method in the constraint calculation An example of the calculation cost when executing the calculation will be described.
[T0] I + 4M + S + B + A: 4 rows and 2 columns affine projective transformation in FIG. 3 [T1] to [T2] 5M + 3B calculation cost per time: 3 rows and 4 columns affine in the upper diagram of FIG. Type multiplication (Toom-Cook method)
[T3] Representation conversion of table entries is a maximum of (2 ^ (win-1) -1) times, and the calculation cost of I + 21M + 10B + 39A per time: 5-row 2-column projection affine transformation of FIG. is there. All entries in the table are projected expressions with 2 elements being 0 and 1 element being 1 among 6 F _{p ^ m} elements.
[M1] Calculation cost of 5M + 3B per time: 3-row 4-column affine type multiplication (Toom-Cook method) in the upper diagram of FIG.
[M2] Multiplication in algebraic torus with general projection expression and projection expression with 2 elements of 0 and 1 element of 6 F _{p ^ m} elements, so calculation cost of 8M + 4B per time: Figure 3 lower row 3-by-3 mixed multiplication (Toom-Cook method)
[M3] Calculation cost of 11M + 5B per time because they are general projection expressions: 3-row 3-column expansion field type multiplication (Toom-Cook method)
[M4] Since it is a square in an algebraic torus between general projection expressions, the calculation cost of 11S + 5B per time: 5-row, 3-column expanded body square (Toom-Cook method) in the upper diagram of FIG.
It is.

Next, the calculation device 50 in this embodiment (n = 3 * r, r = 2, when the quadratic expansion polynomial is set to f ₂ (x) = x ^ 2-d) uses the Toom-Cook method. An example of the calculation cost in the case of executing the power calculation using will be described.
[T0] I + 7M + 2S + 3B + 2A: 4-row 2-column affine projective transformation in FIG. 4 [T1]-[T2] 7M + 3B calculation cost per time: 3-row 4-column affine in FIG. Type multiplication (Toom-Cook method)
[T3] Representation conversion of table entries is a maximum of (2 ^ (win-1) -1) times, and the calculation cost of I + 8M + 3B + 10A per time: 5-row 2-column projection affine transformation of FIG. is there. All entries in the table are projected expressions with 2 elements being 0 and 1 element being 1 among 6 F _{p ^ m} elements.
[M1] 7M + 3B calculation cost per time: 3 rows by 4 columns affine multiplication (Toom-Cook method)
[M2] is a multiplication in an algebraic torus between a general projection expression and a projection expression with 2 elements of 0 and 1 element out of 6 F _{p ^ m} elements, so it costs 9M + 4B each time : 3-by-3 mixed multiplication (Toom-Cook method)
[M3] 11M + 5B calculation cost per time because it is a general projection expression: 3-row 3-column expansion field type multiplication (Toom-Cook method) in the upper diagram of FIG.
[M4] Since it is a square in the algebraic torus between general projection expressions, the calculation cost of 11S + 5B per time: 5-row, 3-column expanded body type square (Toom-Cook method) in the upper diagram of FIG.
It is.

As described above, according to the present embodiment, it is possible to reduce the overall calculation cost including expression conversion and calculation for the power to be combined with multiplication, square, and Frobenius mapping, as compared with the prior art. As a specific numerical value, when ceil (log ₂ (p)) = 13, a is about 700 bits, win = 5, m = 27, f (a, win, m) = 118.72 on average. Since A is a very small value compared with I, M, S, and B, the entire calculation cost is calculated without taking into consideration here. When performing exponentiation using the Toom-Cook method, the total calculation cost is (I + 4M + S + B) + (5M + 3B) * (2 ^win-1 -1) + (I + 21M + 10B) * (2 ^win-1 -1) + (5M + 3B) * ceil (log ₂ (p)) + (8M + 4B) * (f (a, win, m) -2ceil (log ₂ (p)) + 1) + (11M + 5B) * (ceil (log ₂ (p))-1) + (11S + 5B) * (ceil (log ₂ (p))-1) = 2 ^win-1 I + (26 * 2 ^win-1 + 8f (a, win, m) -25) M + (11ceil (log ₂ (p))-10) S + (13 * 2 ^win-1 + 4f (a, win, m) + 5ceil (log ₂ (p))-18) B = 16I + 1340.76M + 133S + 729.88B. On the other hand, in this embodiment, the total calculation cost is (I + 7M + 2S + 3B) + (7M + 3B) * (2 ^win-1 -1) + (I + 8M + 3B) * (2 ^{win- 1} -1) + (7M + 3B) * ceil (log ₂ (p)) + (9M + 4B) * (f (a, win, m) -2ceil (log ₂ (p)) + 1) + (11M + 5B) * (ceil (log ₂ (p))-1) + (11S + 5B) * (ceil (log ₂ (p))-1) = 2 ^win-1 I + (15 * 2 ^win-1 + 9f (a, win, m) -10) M + (11ceil (log ₂ (p))-9) S + (6 * 2 ^win-1 + 4f (a, win, m) + 5ceil (log ₂ (p))- 9) B = 16I + 1298.48M + 134S + 626.88B, which can be reduced by 42.28M-S + 103B compared to the conventional case.

[Modification]
Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Moreover, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined. Further, various modifications as exemplified below are possible.

In each of the above-described embodiments, various programs executed by the computing device 50 may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. The various programs are recorded in a computer-readable recording medium such as a CD-ROM, a flexible disk (FD), a CD-R, a DVD (Digital Versatile Disk), etc. in a file that can be installed or executed. It may be configured to be provided as a computer product.

In each of the above-described embodiments, the arithmetic unit 50 performs the processing of steps S1 to S3, but may perform steps S1 to S2 or steps S2 to S3. In the former case, the processing of step S3 is performed by the information processing device connected to the arithmetic device 50. In the latter case, the processing of step S1 is performed by the information processing device connected to the arithmetic device 50, and the result is obtained. The arithmetic unit 50 may perform steps S2 to S3 for the projection expression.

50 arithmetic unit 51 expression conversion unit 52 arithmetic unit

Claims (6)

1. An element whose norm map is 1 for a subfield F _{p ^ mr} (r: divisor of n, n / r ≧ 3) of a finite field F _{p ^ mn} (n: positive integer, m: positive integer, p: prime number) An arithmetic unit that performs a finite field F _{p ^ mn} operation on the projective representation that represents
   Projective representation (h ₀ , h ₁ ,..., H _n-1 ) (h _i : element of finite field F _{p ^ m} , 0 ≦ i ≦ n−1) after the finite field F _{p ^ mn} operation , An affine representation (c ₀ , c ₁ , ..., c _{φ (n) -1} ) (c _i : element of a finite field F _{p ^ m} , representing an n-th order algebraic torus T _n (F _{p ^ m} ) And a first expression conversion unit that converts 0 ≦ i ≦ φ (n) −1).
2. The first representation conversion unit by converting the projective representation of the finite field F _{p ^ mn} after operation on the affine representation, part of finite F _{p ^ mn} for all divisor d of n F _{p 2.} Each element c _i of an affine expression (c ₀ , c ₁ ,..., c _{φ (n) −1} ) determined by a condition that a norm map regarding _{^ md} is 1 is obtained. Arithmetic unit.
3. (Projection affine transformation calculation example)
   The first representation conversion unit _applies a set of r elements h _i of the projection representation (h ₀ , h ₁ ,..., H _n-1 ) after the finite field F _{p ^ mn} operation. Then, for all divisors of n, finite field F _{p ^ mr} operation determined by the condition that norm mapping for subfield F _{p ^ md} of finite field F _{p ^ mn} is 1 is performed, and affine representation (c ₀ , c The arithmetic unit according to claim 2, wherein each element c _i of ₁ ,..., C _{φ (n) −1} ) is obtained.
4. An affine expression (c ' ₀ , c' ₁ , ..., c ' _{φ (n) -1} ) (c' _i : finite field F _{p ^ m} representing the n-th order algebraic torus T _n (F _{p ^ m} ) , 0 ≤ i ≤ φ (n) -1), the projection expression (h ' ₀ , h' ₁ , ..., h ' _n-1 ) (h' _i The arithmetic unit according to any one of claims 1 to 3, further comprising: a second representation conversion unit that converts the element into a finite field _{Fp ^ m} , 0≤i≤n-1).
5. The second representation conversion unit performs all divisors of n for each element c ′ _i of the affine representation (c ′ ₀ , c ′ ₁ ,..., C ′ _{φ (n) −1} ). Perform the finite field F _{p ^ m} operation determined by the condition that the norm map for the subfield F _{p ^ md} of the finite field F _{p ^ mn} is 1, the modulus polynomial and base to construct the nth-order expansion, and 5. Each element h ′ _i of the projection expression (h ′ ₀ , h ′ ₁ ,..., H ′ _n−1 ) to be subjected to a finite field F _{p ^ mn} operation is obtained. The computing device described.
6. 6. The arithmetic apparatus according to claim 5, wherein the r-order expansion and n / r-order expansion polynomials are each binomial, and the bases are respectively polynomial bases or pseudo-polynomial bases.

Images