Parameter generation device, parameter generation method, and parameter generation program

Abstract

A parameter generation device (10) generates a seed. A pre-calculation unit (11) calculates, as a composite number condition, an integer condition such that at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial p (x) and a second polynomial r (x) becomes a composite number. A seed candidate generation unit (12) searches for an integer in which a Hamming weight expressed by a signed binary system expressed in a non-contiguous form is included in a weight range (W). A seed candidate generation unit (12) deletes integers satisfying a composite number condition from the set of integers obtained by the search, and sets the deleted integers as a set (T) of seed candidates. A prime number determination unit (13) extracts, from a set (T) of seed candidates, integers that are substituted so that both a first polynomial and a second polynomial become prime numbers, and sets the extracted integers as a set (S).

Description

Technical Field

[0001] The present disclosure relates to a parameter generation device, a parameter generation method, and a parameter generation program, and in particular to a parameter generation device, a parameter generation method, and a parameter generation program for generating parameters in a pairing operation. Background Art

[0002] Pairing operations are operations used internally in powerful encryption methods such as searchable encryption and attribute-based encryption. Pairing operations are roughly divided into the calculation of Miller functions and the calculation of powers over finite fields. Hereinafter, the former is referred to as the mirror loop and the latter is referred to as the final power. The calculation of the mirror loop and the final power requires a complex calculation process. The efficiency of the calculation of the two is more important for encryption methods using pairing operations.

[0003] The elliptic curve used in the pairing operation is selected from a family of elliptic curves suitable for the pairing operation. The family of elliptic curves is also called a pairing-friendly curve. As pairing-friendly curves, for example, a BN curve, a BLS curve, or a KSS curve is known. BN is the abbreviation of Barreto-Naehrig. BLS is the abbreviation of Barreto-Lynn-Scott. KSS is the abbreviation of Kachisa-Schaefer-Scott. In non-patent document 1, an elliptic curve equivalent to 256 bits of security is selected from the BLS27 curve.

[0004] The pairing friendly curve is composed of polynomial p(x), polynomial r(x), polynomial t(x) and embedding degree k. The elliptic curve E used in the pairing operation is an elliptic curve defined on a finite field Fp with p=p(u) as the number of elements. r=r(u) is the maximum prime number that divides the number of digits of the group E(Fp). t=t(u) is the trajectory of the elliptic curve E. In this case, k is the smallest positive integer that satisfies (p^k-1)=0(mod r).

[0005] Thus, the elliptic curve used in the pairing operation is selected by determining the integer u. The integer u is also called a seed. The integers p and r are prime numbers, and the integer r needs to be a size that satisfies a specified security level.

[0006] The integer u has a great influence on the amount of calculation of the pairing operation. More specifically, the fewer the number of bits and the Hamming weight of the signed binary representation of the integer u, the smaller the amount of calculation. In addition, depending on the pairing operation algorithm, sometimes the fewer the bits of -1 in the signed binary representation of the integer u, the smaller the amount of calculation.

[0007] Non-Patent Document 2 describes a method for generating parameters suitable for pairing operation.

[0008] Prior art literature

[0009] Non-patent literature

[0010] Non-patent document 1: X. Zhang, D. Lin, “Analysis of Optimum Pairing Products at High Security Levels”, INDOCRYPT 2012, pp. 412-430, 2012.

[0011] Non-patent literature 2: S.Duquesne, N.El Mrabet, S.Haloui and F.Rondepierre, "Choosing and generating parameters for pairing implementation on BN curves", Algebra Eng.Commun.Comput., vol.29, pp.113-147, 2018. Summary of the invention

[0012] Problems to be solved by the invention

[0013] In Non-Patent Document 1, an elliptic curve equivalent to 256-bit security is selected from the BLS27 curve.

[0014] In addition, in non-patent document 2, an integer whose Hamming weight is a specified s and satisfies a specified condition cond is selected from a specified range as an integer u. Then, it is confirmed that the integer p=p(u) and the integer r=r(u) relative to the selected integer u are prime numbers. Among them, the specified condition cond when selecting the integer u is a condition for making operations on a finite field efficient. In addition, there is no mention of a method for generating an integer u whose Hamming weight is a specified value h. In addition, in general, since the signed binary representation of an integer is not unique, the integer u generated in the parameter generation method of non-patent document 2 is repeated.

[0015] As described above, since the probability that the integer u selected randomly satisfies all the conditions is not high, there is a problem that a lot of time is wasted in searching for the integer u which is one of the parameters of the pairing operation.

[0016] An object of the present disclosure is to efficiently search for a seed suitable for a pairing operation, thereby generating an appropriate seed in a short time.

[0017] Means for solving problems

[0018] The parameter generation device of the present disclosure generates a seed as a parameter for determining an elliptic curve used in a pairing operation, wherein the parameter generation device has:

[0019] a preliminary calculation unit that calculates an integer condition as a composite number condition so that at least one of a first integer and a second integer obtained by substituting integers into each of a first polynomial and a second polynomial becomes a composite number, wherein the first polynomial and the second polynomial constitute an elliptic curve family for which the elliptic curve is selected;

[0020] a seed candidate generating unit, which searches for integers whose Hamming weights expressed in a signed binary form in a non-adjacent form are included in a predetermined weight range, deletes integers satisfying the composite number condition from the set of integers obtained by the search, and sets the set of remaining integers after deleting the integers satisfying the composite number condition as a set of seed candidates; and

[0021] A prime number determination unit determines whether each integer substituted into the set of seed candidates makes the first polynomial and the second polynomial both prime numbers, and extracts an integer that makes the first polynomial and the second polynomial both prime numbers as the seed from the set of seed candidates.

[0022] Effects of the Invention

[0023] In the parameter generation device of the present disclosure, the pre-calculation unit calculates an integer condition as a composite condition, which is an integer condition that makes at least one of the first integer and the second integer obtained by substituting integers into the first polynomial and the second polynomial constituting the elliptic curve family become a composite number. The seed candidate generation unit searches for integers whose Hamming weights expressed in signed binary in a non-adjacent form are included in the weight range. Then, the seed candidate generation unit deletes the integers that meet the composite condition from the set of integers obtained by the search, and sets them as a set of seed candidates. Therefore, according to the parameter generation device of the present disclosure, the following effects are achieved: seeds suitable for pairing operations can be efficiently searched, and appropriate seeds can be generated in a short time. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a diagram showing a functional configuration example of a parameter generating device according to the first embodiment.

[0025] Figure 2 This is a flowchart showing the operation of the advance calculation unit according to the first embodiment.

[0026] Figure 3 This is a flowchart showing the operation of the seed candidate generating unit according to the first embodiment.

[0027] Figure 4 It is the flow chart showing the action of the prime number determination unit of implementation mode 1.

[0028] Figure 5This is a flowchart showing the operation of the seed expression generating unit according to the first embodiment.

[0029] Figure 6 This is a diagram showing a hardware configuration example of the parameter generating device according to the first embodiment.

[0030] Figure 7 This is a diagram showing a hardware configuration example of a parameter generating device 10 according to a modified example of the first embodiment. DETAILED DESCRIPTION

[0031] Hereinafter, the present embodiment will be described using the accompanying drawings. In each figure, the same or corresponding parts are marked with the same reference numerals. In the description of the embodiment, the same or corresponding parts are appropriately omitted or simplified. The arrows in the figure mainly show the flow of data or the flow of processing.

[0032] Implementation method 1.

[0033] The parameter generation device 10 according to the present embodiment generates a seed which is a parameter for determining an elliptic curve used in a pairing operation.

[0034] In this embodiment, the seed to be searched is sometimes referred to as an integer u.

[0035] ***Description of the structure***

[0036] Figure 1 It is a diagram showing a functional configuration example of the parameter generating device 10 according to the present embodiment.

[0037] As functional elements, the parameter generating device 10 includes a preliminary calculation unit 11, a seed candidate generating unit 12, a prime number determining unit 13, and a seed expression generating unit 14.

[0038] Here, the input and output of each functional element will be mainly described.

[0039] The parameter generating device 10 receives a search range U, a weight range W, a polynomial p(x), a polynomial r(x), and a threshold b.

[0040] The search range U is the range of the search integer u, ie, the seed.

[0041] The weight range W is the range of the Hamming weight in the non-adjacent form of the integers. In the present embodiment, the Hamming weight in the non-adjacent form of the integer a is represented by HW(NAF(a)).

[0042] The polynomial p(x) and the polynomial r(x) are polynomials of the elliptic curve family that constitutes the selected elliptic curve. The details will be described later.

[0043] Threshold b is the prime number threshold.

[0044] The preliminary calculation unit 11 receives the polynomial p(x), the polynomial r(x), and the threshold b as elements constituting the pairing-friendly curve, and then outputs the threshold b and the generated set B to the seed candidate generation unit 12 .

[0045] Seed candidate generation unit 12 receives the search range U of integer u and the weight range W of Hamming weight. In addition, seed candidate generation unit 12 uses the output of pre-calculation unit 11, i.e., threshold value b and set B as input. Then, seed candidate generation unit 12 outputs the candidate set T of integer u generated to prime number determination unit 13.

[0046] Prime number determination unit 13 receives polynomial p (x) and polynomial r (x). In addition, prime number determination unit 13 uses the output of seed candidate generation unit 12, i.e. set T as input. Then, prime number determination unit 13 outputs the set S of integer u that is a prime number to seed expression generation unit 14 with integer p (u) and integer r (u).

[0047] The seed expression generation unit 14 takes the set S, which is the output of the prime number determination unit 13, as input. Then, the seed expression generation unit 14 calculates a set R of expressions of the integer u suitable for the pairing operation, and transmits the set R.

[0048] Here, the integer u, which is a seed generated in this embodiment, the signed binary representation of the integer, and the non-adjacent form in the signed binary representation are described.

[0049] As described above, the elliptic curve used in the pairing operation is selected from an elliptic curve family suitable for the pairing operation. In the following description, the elliptic curve family is referred to as a pairing-friendly curve.

[0050] The pairing friendly curve is composed of polynomial p(x), polynomial r(x), polynomial t(x) and embedding degree k. The elliptic curve E used in the pairing operation is an elliptic curve defined on a finite field Fp with p=p(u) as the number of elements. r=r(u) is the maximum prime number that divides the number of digits of the group E(Fp). t=t(u) is the trajectory of the elliptic curve E. In this case, k is the smallest positive integer that satisfies (p^k-1)=0(mod r).

[0051] Thus, the elliptic curve used in the pairing operation is selected by determining the integer u, wherein the integer p and the integer r are prime numbers, and the integer r needs to be a size that satisfies a prescribed security level.

[0052] The integer u has a great influence on the amount of calculation of the pairing operation. More specifically, the fewer the number of bits and the Hamming weight of the signed binary representation of the integer u, the smaller the amount of calculation. In addition, depending on the pairing operation algorithm, sometimes the fewer the bits of -1 in the signed binary representation of the integer u, the smaller the amount of calculation.

[0053] Here, the signed binary expression of integer a refers to a binary number expression that allows -1. In addition, the Hamming weight of integer a refers to the number of non-0 bits in the signed binary expression of integer a. For example, the decimal number 198 can be expressed by the binary number (11000110)2. Here, when n is used as the bit of -1, for example, (11001n10)2 is one of the 198 signed binary expressions, and the Hamming weight is 5.

[0054] As an expression method included in the signed binary expression, there is a non-adjacent form (NAF). Generally speaking, the signed binary expression of an integer a is not unique. However, the non-adjacent form of the integer a is unique and has the smallest Hamming weight. For example, the non-adjacent form of the decimal number 198 is (10n0010n0)2, and the Hamming weight is 4.

[0055] ***Description of the action***

[0056] Next, the operation of the parameter generation device 10 of this embodiment will be described. The operation process of the parameter generation device 10 corresponds to the parameter generation method. In addition, the program that realizes the operation of the parameter generation device 10 corresponds to the parameter generation program.

[0057] use Figure 1 , the operation of the parameter generating device 10 of this embodiment is described.

[0058] In order to perform the pairing operation, prime numbers p and r are required as parameters. Prime numbers p and r are generated by substituting integer u into polynomials p(x) and r(x) which are elements of the pairing friendly curve. Therefore, integer u needs to be fixed.

[0059] However, regarding the integer u, for the polynomial p(x) and the polynomial r(x), it is preferred that both the integer p(u) and the integer r(u) are prime numbers, and the Hamming weight of the integer u is small. Here, the condition that both the integer p(u) and the integer r(u) are prime numbers is set as condition 1. In addition, the condition that the Hamming weight of the integer u is small is set as condition 2.

[0060] The integer u serving as the seed needs to satisfy conditions 1 and 2 for the polynomial p(x) and the polynomial r(x).

[0061] Condition 1 is a condition necessary for pairing operation to be established. In addition, condition 2 is a condition for efficiently calculating pairing operation.

[0062] If an integer u is randomly selected, in many cases, the probability of satisfying condition 1 or condition 2 is very low. Therefore, in this embodiment, integers u having a higher probability of satisfying condition 1 or condition 2 are selected to improve the efficiency of the search process for integer u.

[0063] First, integers that satisfy condition 2, i.e., the condition that the Hamming weight of the integer is small, are generated using a non-adjacent form. As described above, generally speaking, since the signed binary expression is not unique, the integer u that satisfies condition 2 is repeated, and the search time increases. On the other hand, the non-adjacent form in the signed binary expression is unique with respect to the integer. Therefore, the search range of the integer u can be minimized, and the Hamming weight is minimized, so it is easy to confirm whether condition 2 is satisfied.

[0064] Then, in order to improve the probability that satisfies condition 1 that integer p (u) and integer r (u) are all the such condition of prime number, calculate in advance that integer p (u) or integer r (u) have the condition of the integer u of less prime factor.

[0065] For example, when there is an integer a such that p(a)=0(mod q) with respect to a certain prime number q, it is obvious that if u=a(mod q), then p(u)=0(mod q).

[0066] For prime number q arbitrarily, calculate the root of p (x) mod q and the root of r (x) mod q in advance, when integer u is consistent with the root according to modulo q, delete this integer u from the candidate of search.Thus, can before the prime number judgement for p (u) or r (u), by the remainder operation to integer u, confirm the existence of prime factor q.In addition, as the group of this prime number q and root, as described in non-patent literature 2, also can add the condition that the computing on the finite field becomes efficient.

[0067] In addition, a screening process can also be used in the deletion of the search candidates of integer u, and the screening process uses the elements of set B. For example, when a prime number q and a root a of the polynomial f(x) mod q are obtained, f(a) has a prime factor q. In addition, f(a+mq) relative to integer m also has a prime factor q. Thus, when integer u is consistent with the root a modulo q, u+mq can be deleted from the search candidates without performing a remainder operation.

[0068] When a non-adjacent form is used as the signed binary representation of the integer u, the Hamming weight is minimized, which can make the pairing operation more efficient. However, if it is a non-adjacent form, it may not necessarily minimize the amount of calculation for the pairing operation. For example, when the integer u is 198 in decimal, the non-adjacent form of u is (10n0010n0)2, and the Hamming weight is 4.

[0069] Here, (110010n0)2, which is one of the signed binary expressions of u, also has a Hamming weight of 4, and the number of bits is 1 less than that of the non-adjacent form.

[0070] Likewise, (11000110)2, which is one of the signed binary expressions of u, also has a Hamming weight of 4 and is an expression of bits consisting of only 0 and 1. Using the last-shown signed binary expression enables the computational complexity of the pairing operation to be reduced compared to the non-adjacent form.

[0071] In the preliminary calculation unit 11, the roots of the first polynomial p(x) and the second polynomial r(x) are calculated for a prime number q below a threshold value b, and a set B of sets of q and roots is generated.

[0072] The seed candidate generator 12 searches the search range U for integers u whose Hamming weights in a non-adjacent form are included in the weight range W to generate a set T. Then, referring to the set B, integers u that do not satisfy condition 1 are deleted from the set T.

[0073] In the prime number determination unit 13, for the integer u of the element of the set T, it is determined whether the integers p(u) and r(u) are both prime numbers, and a set S of the integers u whose determination result is true is generated.

[0074] The seed expression generation unit 14 calculates a signed binary expression v for each element u of the set S in which a pairing operation becomes efficient, and generates a set R of pairs (u, v).

[0075] <Preliminary Calculation Processing>

[0076] Figure 2 This is a flowchart showing the operation of the advance calculation unit 11 according to the present embodiment.

[0077] according to Figure 2 , describing the pre-calculation processing of this embodiment.

[0078] In the preliminary calculation process, the preliminary calculation unit 11 calculates an integer condition as a composite condition so that at least one of the first integer p and the second integer r obtained by substituting integers into each of the first polynomial p(x) and the second polynomial r(x) becomes a composite number, wherein the first polynomial p(x) and the second polynomial r(x) constitute an elliptic curve family of the selected elliptic curve.

[0079] Specifically, pre-calculation unit 11 calculates the root of p(x) mod q and r(x) mod q for the prime number q below the threshold value b. Then, pre-calculation unit 11 generates the set B of the group of the root a of q and p(x) mod q or r(x) mod q as the composite number condition.

[0080] More specifically, it is as follows.

[0081] In step S111 , the preliminary calculation unit 11 receives the first polynomial p(x), the second polynomial r(x), and the threshold value b.

[0082] In step S112, the pre-calculation unit 11 calculates the prime number q below the threshold value b. i , calculate modulo q i The root a of the polynomial p(x) and the polynomial r(x) under i，j Root a i，j is the root of p(x) mod q or r(x) mod q. In this case, the subscripts of i and j can also be natural numbers or integers greater than 0. i represents the number of prime numbers, and j represents the number of prime numbers q. i The corresponding root a i The number of

[0083] In step S113, the pre-calculation unit 11 generates the calculated set (qi, a i，j ) as the composite condition.

[0084] In step S114 , the preliminary calculation unit 11 sends the threshold value b and the set B to the seed candidate generation unit 12 .

[0085] <Seed Candidate Generation Process>

[0086] Figure 3 This is a flowchart showing the operation of the seed candidate generating unit 12 according to the present embodiment.

[0087] according to Figure 3 , describing the seed candidate generation process of this embodiment.

[0088] In the seed candidate generation process, the seed candidate generation unit 12 searches for integers whose Hamming weights expressed in a signed binary form in a non-adjacent form are included in a predetermined weight range W. Then, the seed candidate generation unit 12 deletes the integers satisfying the composite number condition from the set T' of integers obtained by the search. Then, the seed candidate generation unit 12 sets the set of remaining integers after deleting the integers satisfying the composite number condition as the set T of seed candidates.

[0089] Specifically, the seed candidate generating unit generates a set of prime numbers q and u mod q for an integer u in the set T' of integers obtained by searching. Then, when the set of prime numbers q and u mod q is included in the set B as the composite number condition, the seed candidate generating unit deletes the integer u from the set T' of integers obtained by searching.

[0090] In addition, the integer u satisfies the composite number condition when the integer u is consistent with the root a modulo q.

[0091] More specifically, it is as follows.

[0092] In step S121 , the seed candidate generator 12 receives the search range U of the integer u, the range of the Hamming weight, that is, the weight range W, the threshold b, and the set B.

[0093] In step S122 , the seed candidate generator 12 searches the search range U for integers whose Hamming weights are not adjacent to each other and are included in the weight range W, and generates a set T′ of the obtained integers.

[0094] In step S123, the seed candidate generator 12 calculates the group (qi, u mod qi) for each element u of the set T' and the prime number qi below the threshold b. Then, the seed candidate generator 12 sets the set T' obtained by deleting the integer u included in the set B of the group (qi, u mod qi) as the set T of seed candidates.

[0095] In step S124, the seed candidate generating unit 12 sends the set T to the prime number determining unit 13.

[0096] <Prime number determination processing>

[0097] Figure 4 It is the flow chart showing the action of the prime number determination unit 13 of the present embodiment.

[0098] according to Figure 4 , the prime number determination process of the present embodiment is described.

[0099] In the prime number determination process, prime number determination unit 13 determines whether each integer u by substituting into the set T of seed candidate makes the 1st polynomial p (u) and the 2nd polynomial r (x) all become prime numbers. Prime number determination unit 13 extracts the integer u that the 1st polynomial p (u) and the 2nd polynomial r (x) all become prime numbers as seed from the set T of seed candidate.

[0100] Specifically, it is as follows.

[0101] In step S131, prime number determination unit 13 receives the first polynomial p(x), the second polynomial r(x) and a set T of seed candidates.

[0102] In step S132, prime number determination unit 13 determines whether integer p=p(u) and integer r=r(u) are both prime numbers for each element u of set T, and generates a set S of integer u whose determination result is true.

[0103] In step S133, prime number determining unit 13 sends set S to seed expression generating unit 14.

[0104] <Seed Expression Generation Process>

[0105] Figure 5 This is a flowchart showing the operation of the seed expression generating unit 14 according to the present embodiment.

[0106] according to Figure 5 , describing the seed expression generation process of this embodiment.

[0107] In the seed expression generation process, the seed expression generation unit 14 expresses the seed using a signed binary expression that requires less calculation complexity for pairing operations than the non-adjacent form.

[0108] Specifically, it is as follows.

[0109] In step S141 , the seed expression generation unit 14 receives the set S.

[0110] In step S142 , the seed expression generation unit 14 generates a signed binary expression v with a smaller amount of calculation for pairing operation for each element u of the set S. The seed expression generation unit 14 preferably generates a signed binary expression v with a minimum amount of calculation for pairing operation for each element u of the set S.

[0111] In step S143 , the seed expression generation unit 14 generates a set R of the generated sets (u, v).

[0112] In step S144 , the seed expression generation unit 14 sends the set R.

[0113] ***Explanation of the Effects of the Present Implementation Method***

[0114] As described above, in the present embodiment, an efficient search method for an integer u suitable for pairing operations is introduced. Specifically, in the parameter generation device of the present embodiment, a non-adjacent form expressing a uniqueness is used as a signed binary expression, thereby eliminating duplication of the integer u and making the search more efficient. In addition, in the parameter generation device of the present embodiment, a list of x having smaller prime factors of the integers p=p(x) and r=r(x) is prepared. Moreover, in the parameter generation device of the present embodiment, the elements of the list are removed from the search range of the integer u, thereby reducing the amount of calculation for the parameter search.

[0115] Therefore, according to the parameter generation device of the present embodiment, the integer u of the prescribed Hamming weight is generated by using the non-adjacent form, thereby eliminating the duplication of the integer u and making the search more efficient. In addition, according to the parameter generation device of the present embodiment, the determination of whether the integer p or the integer r has a smaller prime factor is replaced by the determination based on the remainder operation of the integer u, thereby reducing the amount of calculation for prime number determination. And, according to the parameter generation device of the present embodiment, a signed binary expression converted from the non-adjacent form of the integer u without changing the Hamming weight is generated, thereby reducing the amount of calculation for the pairing operation.

[0116] ***Description of Hardware Configuration Example***

[0117] Figure 6 It is a diagram showing a hardware configuration example of the parameter generating device 10 according to the present embodiment.

[0118] The parameter generating device 10 is a computer and includes a processor 910 and other hardware such as a memory 921, an auxiliary storage device 922, an input / output interface 930, and a communication interface 950. The processor 910 is connected to other hardware via a signal line 80 and controls the other hardware.

[0119] As mentioned above, as functional element, parameter generating device 10 has advance calculation unit 11, seed candidate generating unit 12, prime number determining unit 13 and seed expression generating unit 14. The function of advance calculation unit 11, seed candidate generating unit 12, prime number determining unit 13 and seed expression generating unit 14 is realized by software.

[0120] Hereinafter, the preliminary calculation unit 11, the seed candidate generation unit 12, the prime number determination unit 13 and the seed expression generation unit 14 are sometimes referred to as the respective units of the parameter generation device 10.

[0121] The processor 910 is a device that executes a parameter generation program. The parameter generation program is a program that realizes the functions of the parameter generation device 10.

[0122] The processor 910 is an IC that performs calculation processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is the abbreviation of Integrated Circuit. CPU is the abbreviation of Central Processing Unit. DSP is the abbreviation of Digital Signal Processor. GPU is the abbreviation of Graphics Processing Unit.

[0123] The memory 921 is a storage device for temporarily storing data. A specific example of the memory 921 is SRAM or DRAM. SRAM is an abbreviation of Static Random Access Memory. DRAM is an abbreviation of Dynamic Random Access Memory.

[0124] The auxiliary storage device 922 is a storage device for storing data. A specific example of the auxiliary storage device 922 is an HDD. In addition, the auxiliary storage device 922 may also be a mobile storage medium such as an SD (registered trademark) memory card, CF, NAND flash memory, a floppy disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. In addition, HDD is the abbreviation of Hard Disk Drive. SD (registered trademark) is the abbreviation of Secure Digital. CF is the abbreviation of Compact Flash. DVD is the abbreviation of Digital Versatile Disk.

[0125] The input / output interface 930 is an interface for connecting an input / output device. As a specific example, the input / output interface 930 is a port of USB or HDMI (registered trademark). USB is an abbreviation of Universal Serial Bus. HDMI (registered trademark) is an abbreviation of High-Definition Multimedia Interface.

[0126] The communication interface 950 is an interface for communicating with an external device. As a specific example, the communication interface 950 is an Ethernet (registered trademark) port or a device for performing wireless communication.

[0127] The parameter generation program is executed in the parameter generation device 10. The parameter generation program is read into the processor 910 and executed by the processor 910. In the memory 921, not only the parameter generation program but also the OS is stored. OS is the abbreviation of Operating System. The processor 910 executes the parameter generation program while executing the OS. The parameter generation program and the OS may also be stored in the auxiliary storage device 922. The parameter generation program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. In addition, part or all of the parameter generation program may also be assembled into the OS.

[0128] The parameter generation device 10 may include a plurality of processors instead of the processor 910. These plurality of processors share the execution of the parameter generation program. Similar to the processor 910, each processor is a device that executes the parameter generation program.

[0129] Data, information, signal values, and variable values ​​used, processed, or output by the parameter generation program are stored in the memory 921 , the auxiliary storage device 922 , or registers or flash memory within the processor 910 .

[0130] The "part" of the advance calculation unit 11, the seed candidate generating unit 12, the prime number determination unit 13 and the seed expression generating unit 14 can also be replaced with a "circuit", "process", "procedure", "processing" or "circuit". The parameter generation program enables the computer to perform the advance calculation processing, the seed candidate generating processing, the prime number determination processing and the seed expression generating processing. The "processing" of the advance calculation processing, the seed candidate generating processing, the prime number determination processing and the seed expression generating processing can also be replaced with a "program", "program product", "a storage medium that a computer with a program can read" or "a recording medium that a computer with a program can read". In addition, the parameter generation method is a method for performing the parameter generation program by the parameter generating device 10.

[0131] The parameter generation program may be provided by being stored in a computer-readable recording medium. In addition, the parameter generation program may be provided as a program product.

[0132] ***Other structures***

[0133] <Modification>

[0134] In the present embodiment, the function of pre-calculation unit 11, seed candidate generating unit 12, prime number determination unit 13 and seed expression generating unit 14 is realized by software.As a modification, the function of pre-calculation unit 11, seed candidate generating unit 12, prime number determination unit 13 and seed expression generating unit 14 also can be realized by hardware.

[0135] Specifically, the parameter generating device 10 includes an electronic circuit 909 instead of the processor 910 .

[0136] Figure 7 It is a diagram showing a hardware configuration example of a parameter generating device 10 according to a modification of the present embodiment.

[0137] The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of each part of the parameter generating device 10. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is the abbreviation of Gate Array. ASIC is the abbreviation of Application Specific Integrated Circuit. FPGA is the abbreviation of Field-Programmable Gate Array.

[0138] The functions of the various components of the parameter generating device 10 may be implemented by one electronic circuit or may be implemented by distributing the functions of the various components in a plurality of electronic circuits.

[0139] As another modification, a part of the functions of each component of the parameter generating device 10 may be implemented by an electronic circuit, and the remaining functions may be implemented by software. In addition, a part or all of the functions of each component of the parameter generating device 10 may be implemented by firmware.

[0140] The processor and the electronic circuit are also referred to as processing circuits. That is, the functions of each unit of the parameter generating device 10 are implemented by the processing circuits.

[0141] In the above embodiment 1, the various parts of the parameter generating device 10 are described as independent functional blocks. However, the structure of the parameter generating device 10 may not be the structure of the above embodiment. The functional blocks of the parameter generating device 10 may have any structure as long as they can realize the functions described in the above embodiment. In addition, the parameter generating device 10 may also be a system composed of multiple devices instead of a single device.

[0142] In addition, a plurality of parts in Embodiment 1 may be implemented in combination. Alternatively, one part of this embodiment may be implemented. In addition, this embodiment may be implemented in combination as a whole or in part.

[0143] That is, in Embodiment 1, it is possible to freely combine the various embodiments, to modify any constituent element in the various embodiments, or to omit any constituent element in the various embodiments.

[0144] In addition, the above-mentioned embodiments are essentially only preferred examples and are not intended to limit the scope of the present disclosure, the scope of the application of the present disclosure, and the scope of the use of the present disclosure. The above-mentioned embodiments can be variously changed as needed. For example, the process described using a flowchart or a timing diagram can be appropriately changed.

[0145] Description of symbols

[0146] 10: parameter generating device; 11: pre-calculation unit; 12: seed candidate generating unit; 13: prime number determining unit; 14: seed expression generating unit; U: search range; W: weight range; b: threshold; T, B, S, R: set; 80: signal line; 909: electronic circuit; 910: processor; 921: memory; 922: auxiliary storage device; 930: input and output interface; 950: communication interface.

Claims

1. A parameter generating device for generating a seed as a parameter for determining an elliptic curve used in a pairing operation, wherein: The parameter generating device has: a preliminary calculation unit that calculates an integer condition as a composite number condition so that at least one of a first integer and a second integer obtained by substituting integers into each of a first polynomial and a second polynomial becomes a composite number, wherein the first polynomial and the second polynomial constitute an elliptic curve family for which the elliptic curve is selected; a seed candidate generating unit, which searches for integers whose Hamming weights expressed in a signed binary form in a non-adjacent form are included in a predetermined weight range, deletes integers satisfying the composite number condition from the set of integers obtained by the search, and sets the set of remaining integers after deleting the integers satisfying the composite number condition as a set of seed candidates; and A prime number determination unit determines whether each integer substituted into the set of seed candidates makes the first polynomial and the second polynomial both prime numbers, and extracts an integer that makes the first polynomial and the second polynomial both prime numbers as the seed from the set of seed candidates.

2. The parameter generating device according to claim 1, wherein: The parameter generation device includes a seed expression generation unit that expresses the seed using a signed binary expression that requires less computational effort in the pairing operation than in the non-adjacent form.

3. The parameter generating device according to claim 1 or 2, wherein: The pre-calculation unit calculates the root a of p(x) mod q or r(x) mod q for p(x) as the first polynomial, r(x) as the second polynomial, and a prime number q, and uses a combination of the prime number q and the root a as the composite number condition. The seed candidate generating unit generates a set of prime numbers q and u mod q for an integer u in the set of integers obtained by the search, and deletes the integer u from the set of integers obtained by the search when the set of prime numbers q and u mod q is included in the composite number condition.

4. The parameter generating device according to claim 3, wherein: The pre-calculation unit receives a predetermined threshold value, and calculates a root a of p(x) mod q or r(x) mod q for p(x), r(x) and a prime number q below the threshold value. The seed candidate generating unit generates a set of prime numbers q and u mod q that are less than the threshold.

5. The parameter generation device according to any one of claims 1 to 4, wherein: The seed candidate generating unit receives a range for searching the seeds as a search range, and searches the search range for an integer whose Hamming weight is included in the weight range.

6. The parameter generation device according to any one of claims 1 to 5, wherein: The seed candidate generating unit receives the weight range and searches for an integer whose Hamming weight is included in the weight range.

7. A parameter generation method used in a parameter generation device, the parameter generation device generating a seed as a parameter for determining an elliptic curve used in a pairing operation, wherein: The computer calculates an integer condition as a composite number condition so that at least one of a first integer and a second integer obtained by substituting integers into each of a first polynomial and a second polynomial becomes a composite number, wherein the first polynomial and the second polynomial constitute an elliptic curve family for which the elliptic curve is selected, The computer searches for integers whose Hamming weights expressed in a non-adjacent form with a signed binary expression are included in a predetermined weight range, deletes integers satisfying the composite number condition from the set of integers obtained by the search, and sets the set of remaining integers after deleting the integers satisfying the composite number condition as a set of seed candidates, The computer determines whether each integer substituted into the set of seed candidates makes the first polynomial and the second polynomial both prime numbers, and extracts an integer that makes the first polynomial and the second polynomial both prime numbers from the set of seed candidates as the seed.

8. A parameter generation program used in a parameter generation device for generating a seed as a parameter for determining an elliptic curve used in a pairing operation, wherein: The parameter generation program causes the computer to execute the following processing: Preliminary calculation processing is performed to calculate an integer condition as a composite number condition, which is a condition that at least one of a first integer and a second integer obtained by substituting integers into a first polynomial and a second polynomial is a composite number, wherein the first polynomial and the second polynomial constitute an elliptic curve family for which the elliptic curve is selected; A seed candidate generation process, searching for integers whose Hamming weights expressed in a signed binary form in a non-adjacent form are included in a predetermined weight range, deleting integers satisfying the composite number condition from the set of integers obtained by the search, and setting the set of remaining integers after deleting the integers satisfying the composite number condition as a set of seed candidates; and The prime number determination process determines whether each integer substituted into the set of seed candidates makes the first polynomial and the second polynomial both prime numbers, and extracts an integer that makes the first polynomial and the second polynomial both prime numbers as the seed from the set of seed candidates.

Images