Method for compressing and decompressing elliptic curve points on prime number field

Abstract

The invention relates to an elliptic curve point compression and point decompression method on a prime number field, and belongs to the technical field of passwords. The point decompression calculation is converted into a square root solving problem, and the square root solving problem is converted into repeated (m-2) times of square operation due to the fact that the size of p meets the condition that p is equivalent to 3 (mod4). Elliptic curve points (xp, yp) are compressed into yp and zp, zp is the rightmost bit of xp, and the storage space is reduced by about 50%. According to the technical scheme provided by the invention, the problems of public key point compression and point decompression are solved. In an application scene with high communication cost and low calculation cost, the public key only needs to transmit the compressed value during air-ground information data exchange, so that the transmission bandwidth is saved.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography, and in particular relates to a method for decompressing compressed points of elliptic curves on a prime number field. Background Art

[0002] In harsh environments such as oceans, deserts, and the wild where there are no communication signals, Beidou short message communication is the two-way sending and receiving of short messages and short instructions between satellites and the ground, stably and reliably transmitting small-capacity data. A single short message service supports communications at the level of thousands of bits in length. For ECC algorithms with large bit widths, the length of the public key reaches thousands of bits. The excessive length of the public key causes the short message service to be frequently sub-packeted and transmitted, thus affecting the reliability of the key exchange function, and then affecting the stability of the password encryption and decryption and signature verification functions. Therefore, in application scenarios with high communication costs and low computing costs, point compression can reduce the length of public key transmission.

[0003] Elliptic curve point P = (x p ,y p )'s coordinate x p and p is a public key bit string of length m, which is compressed to x by point compression. p and a bit length, compressed from 2m to (m+1), reducing the storage space and transmission bandwidth of the public key by about 50%, at the cost of additional computation for decompression, i.e., reconstructing the y coordinate of point P on the elliptic curve.

[0004] Set point P = (x p ,y p ), is the prime field F p Elliptic curve E:y 2 =x 3 +ax+b is a point on z. p Yes p The rightmost bit of , then point P can be compressed to (x p ,z p ). By the x coordinate x of P p and z p Restore p The method is as follows: First, calculate the domain element α=(x p 3 +ax p +b) mod p; Step 2, calculate the square root β of α mod p. If the square root does not exist, an error is reported; Step 3, if the rightmost bit of β is equal to z p , then set y p =β, otherwise set y p =p-β.

[0005] On a general elliptic curve, the commonly used compression method is to give the compression method of the x - coordinate of a point, and the y - coordinate is calculated by solving the square - root algorithm of the quadratic equation y 2 =P(x). In special cases, on an elliptic curve E: x p +y 2 =1 + ax 2 in a specific prime field F 2 y 2 , the y - coordinate of a point needs to be given, and the x - coordinate needs to be calculated by solving. Where a is a constant in the prime field, the size of p is 2 m -1 and satisfies p≡3 (mod 4), and m is a real number. The point P=(x p , y p ) is on the elliptic curve, and the compressed representation is (y p , z p ), where z p is the right - most bit of x p . De - compression needs to use y p and z p to restore x p . SUMMARY OF THE INVENTION

[0006] (1) Technical problems to be solved

[0007] The technical problem to be solved by the present invention is how to provide a method for compressing and decompressing points on an elliptic curve in a prime field to solve the problems of public - key point compression and point decompression.

[0008] (2) Technical solutions

[0009] To solve the above - mentioned technical problems, the present invention proposes a method for compressing and decompressing points on an elliptic curve in a prime field. This method is a method for restoring x p , given the compressed value (y p , z p ) of the public key of the known elliptic curve, and includes the following steps:

[0010] S11、

[0011] S12、t2←a·t1

[0012] S13、t2←t2 - 1

[0013] S14、t3←t1 - 1

[0014] S15、t2←t2 -1

[0015] S16、t1←t2·t3, α←t1

[0016] Execute for 0≤i<m - 2

[0017] S18, compare the size of α and t1, if they are not equal, t1 does not have a square root, and the decompression terminates; if they are equal, determine z p Is it equal to the rightmost bit of t1? If so, x p ←t1, if not equal, x p ←p-t1.

[0018] (III) Beneficial effects

[0019] The present invention proposes a method for compressing and decompressing elliptic curve points on prime number fields. The present invention proposes a technical solution to solve the problem of public key point compression and point decompression. In the application scenario where the communication cost is high and the computing cost is low, when exchanging information data between the air and the ground, the public key only needs to transmit the compressed value, which reduces the data volume by about 50% and saves the transmission bandwidth. DETAILED DESCRIPTION

[0020] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with embodiments.

[0021] The purpose of the present invention is to propose a point compression and decompression method on the prime field that can save the storage space of elliptic curve points and support the compression method of solving the x coordinate by giving the y coordinate. 2 +y 2 =1+ax 2 y 2 The upper point is compressed to (y p ,z p ), z p is x p The rightmost bit of . By calculating the square root, it is converted into a square operation repeated (m-2) times, thus compressing the point (y p ,z p ) Recover the x coordinate x p .

[0022] 1. Basic Definition

[0023] In order to achieve point compression and point decompression, various data need to be defined, as follows:

[0024] 1) F p : A prime field containing p elements.

[0025] 2)a: Prime domain F p The elements in F p An elliptic curve E on .

[0026] 3)m: a positive integer.

[0027] 4)α: Prime domain F p An element in .

[0028] 5) modn: modulo n operation, for example 23mod4=3.

[0029] 6) x≡y(modn): x and y are congruent modulo n, that is, x modn=y modn.

[0030] 7) p≡3(mod4): p is congruent to 3 modulo 4, that is, p mod4=3mod4.

[0031] 8) O: A special point on the elliptic curve, called the point at infinity or the zero point, is the identity element of the additive group of the elliptic curve.

[0032] 9) P = (x p ,y p ):P is a point on the elliptic curve other than O, and its coordinates x p ,y p is a public key bit string of length m that satisfies the elliptic curve equation.

[0033] 10)x p : x-coordinate of point P.

[0034] 11)y p : y-coordinate of point P.

[0035] 2. Principle and process

[0036] 1) Principle of point compression and point decompression derivation

[0037] Known prime field F p An elliptic curve E:x 2 +y 2 =1+ax 2 y 2 , where a is a constant in the prime field and p is 2 m -1 and satisfies p≡3(mod4), m is a positive integer.

[0038] Point compression: Get x p The rightmost bit z p , and the y coordinate y p Composition compression value (y p ,z p ).

[0039] Point decompression: known compression value (y p ,z p ), solve for x p .

[0040] From the elliptic curve equation we can get Let t1 be an integer satisfying 0 ≤ t1 < p, and the square root of t1 modulo p be an integer x p , 0 ≤ x p < p, i.e., x p 2 ≡ t1 (mod p). The problem is transformed into solving the square root modulo a prime number. If t1 = 0, then there is only one square root, i.e., x p = 0; if t1 ≠ 0, then t1 has 0 or 2 square roots modulo p. If x p is one of the square roots, then the other square root is p - x p .

[0041] Given that p = 2 m - 1 satisfies p ≡ 3 (mod 4), that is, there exists a positive integer u such that p = 4u + 3, i.e., Calculate Then, by performing m - 2 squaring operations on t1, the value of x can be obtained. Calculate α = x p 2 , if α = t1, then x is one of the square roots; otherwise, t1 has no square root.

[0042] 2) Steps of point compression operation

[0043] Take the rightmost bit z p of x p , and form a compressed value (y p , z p ) with the y - coordinate y p .

[0044] 3) Steps of point decompression operation

[0045] Given the compressed value (y p , z p ) of the elliptic curve public key, the algorithm for recovering x p includes the following steps:

[0046] S11、

[0047] S12、t2 ← a · t1

[0048] S13、t2 ← t2 - 1

[0049] S14、t3 ← t1 - 1

[0050] S15、t2 ← t2 -1

[0051] S16、t1 ← t2 · t3, α ← t1

[0052] S17、Perform for 0 ≤ i < m - 2

[0053] S18. Compare α and t1. If they are not equal, t1 does not have a square root and the decompression terminates. If they are equal, determine z p Is it equal to the rightmost bit of t1? If so, x p ←t1, if not equal, x p ←p-t1.

[0054] The key points of the present invention are:

[0055] In general, the decompression of an elliptic curve point is to solve the y coordinate given the x coordinate of the point. In special cases, on a specific elliptic curve, the point decompression needs to solve the x coordinate given the y coordinate. The point decompression calculation is converted to solving the square root problem. Since the size of p satisfies p≡3(mod4), the square root problem is converted to repeated (m-2) square operations. Elliptic curve point (x p ,y p ) is compressed to y p and z p , z p is x p By reducing the rightmost bit of , the storage space is reduced by about 50%.

[0056] Effects of the present invention:

[0057] The present invention proposes a technical solution to solve the problem of public key point compression and point decompression. In the application scenario where the communication cost is high and the computing cost is low, when exchanging information data between the air and the ground, the public key only needs to transmit the compressed value, which reduces the data volume by about 50% and saves the transmission bandwidth.

[0058] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for decompressing compressed points of elliptic curves over prime number fields, characterized in that: This method is to compress the public key value of the known elliptic curve (y p ,z p ), restore x p The method comprises the following steps: S11、 S12, t2←a·t1 S13, t2←t2-1 S14, t3←t1-1 S15、t2←t2 -1 S16, t1←t2·t3, α←t1 S17. Perform for 0 ≤ i < m - 2 S18, compare the size of α and t1, if they are not equal, t1 does not have a square root, and the decompression terminates; if they are equal, determine z p Is it equal to the rightmost bit of t1? If so, x p ←t1, if not equal, x p ←p-t1.

2. The method for decompressing elliptic curve point compression points over prime number fields as claimed in claim 1, characterized in that: The elliptic curve is defined as: a known prime field F p An elliptic curve E:x 2 +y 2 =1+ax 2 y 2 , where a is a constant in the prime field and p is 2 m -1 and satisfies p≡3(mod4), m is a positive integer.

3. The method for decompressing elliptic curve point compression points over prime number fields as claimed in claim 2, characterized in that: The method also includes a point decompression process, specifically including: obtaining x p The rightmost bit z p , and the y coordinate y p Constitute the public key compression value (y p ,z p ).

4. The method for decompressing elliptic curve point compression points over prime number fields as claimed in claim 3, characterized in that: From the elliptic curve equation, it can be obtained that Let t1 is an integer satisfying 0 ≤ t1 < p, and the square root of t1 modulo p is an integer x p , 0 ≤ x p < p, that is, x p 2 ≡ t1 (mod p).

5. The method for decompressing elliptic curve point compression points over a prime number field as claimed in claim 4, characterized in that: Convert the point decompression problem into solving the square root of a prime number. If t1 = 0, there is only one square root, which is x p =0; if t1≠0, then t1 has 0 or 2 square roots modp, if x p is one of the square roots, then the other square root is px p .

6. The method for decompressing elliptic curve point compression points over a prime number field as claimed in claim 5, characterized in that: Given that p = 2 m -1 satisfies p≡3(mod4), that is, there exists a positive integer u such that p=4u+3, that is calculate Then the value of x can be obtained by squaring t1 m-2 times.

7. The method for decompressing elliptic curve point compression points over a prime number field as claimed in claim 6, characterized in that: Calculate α = x p 2 , if α=t1, then x is one of the square roots, otherwise, t1 does not have a square root.

8. The method for decompressing elliptic curve point compression points over a prime number field as claimed in claim 7, characterized in that: O is a special point on the elliptic curve, called the infinity point or the zero point, which is the identity element of the elliptic curve additive group. p ,y p ):P is a point on the elliptic curve other than O, and its coordinates x p ,y p is a public key bit string of length m that satisfies the elliptic curve equation.

9. The method for decompressing elliptic curve point compression points over prime number fields as claimed in claim 1, characterized in that: This method is applied to information data exchange between air and ground.

10. The method for decompressing elliptic curve point compression points over a prime number field as claimed in claim 9, characterized in that: This method is applied to Beidou short message communication.

Images