Parameter generation device, parameter generation method and parameter generation program

Abstract

A parameter generator (10) generates a seed. A precomputation unit (11) computes a condition for an integer, such that at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial p(x) and a second polynomial r(x) is a composite number, as a composite number condition. A seed candidate generator (12) searches for an integer whose Hamming weight, in a signed binary representation in a non-adjacent form, is contained within a weight range (W). The seed candidate generator (12) deletes an integer satisfying the composite number condition from a set of integers obtained by the search to obtain a set of seed candidates (T).A prime number decision unit (13) extracts from the set of seed candidates T integers for which both a first polynomial and a second polynomial become prime when the integers are substituted into the first polynomial and the second polynomial, and considers the integers as a set (S).

Description

Technical area

[0001] The present disclosure relates to a parameter generation device, a parameter generation method, and a parameter generation program. More specifically, the present disclosure relates to a parameter generation device, a parameter generation method, and a parameter generation program for generating a parameter of a pairing calculation. State of the art

[0002] Pairing calculus is an arithmetic operation used in feature-rich encryption schemes such as searchable encryption and attribute-based encryption. Pairing calculus is broadly divided into the calculation of a Miller function and the calculation of exponentiations on a finite field. The first is referred to as the Miller loop, and the second is referred to as the final exponentiation. The calculations of the Miller loop and the final exponentiation require complex computational processes. For encryption schemes that use pairing calculus, both calculations must be optimized.

[0003] An elliptic curve used in matching calculations is selected from a family of elliptic curves suitable for matching calculations. This family of elliptic curves is also called matching-friendly curves. Examples include matching-friendly curves, BN curves, BLS curves, and KSS curves. BN is an abbreviation for Barreto-Naehrig. BLS is an abbreviation for Barreto-Lynn-Scott. KSS is an abbreviation for Kachisa-Schaefer-Scott. In Non-Patent Literature 1, an elliptic curve corresponding to the 256-bit security level is selected from BLS 27 curves.

[0004] The matching-friendly curve consists of a polynomial p(x), a polynomial r(x), a polynomial t(x), and an embedding degree k. An elliptic curve E used in matching calculus is an elliptic curve defined on a finite field Fp with the number of elements p = p(u). r = r(u) is the largest prime number that divides the order of a group E(Fp). t = t(u) is the trace of the elliptic curve E. In this case, k is the smallest positive integer satisfying (p^k-1) = 0(mod r).

[0005] As described, the elliptic curve used for the pairing calculation is selected by determining an integer u. This integer u is also called the seed. However, it is required that the integer p and the integer r are prime numbers, and that the integer r has a size that satisfies a certain level of certainty.

[0006] The integer u has a great influence on the computational complexity of the pairing calculation. Specifically, the smaller the number of digits in a signed binary representation and the Hamming weight of the integer u, the lower the computational complexity. Meanwhile, depending on the pairing algorithm, the fewer digits -1 there are in the signed binary representation of the integer u, the lower the computational complexity.

[0007] Non-patent literature 2 refers to a method for generating parameters for the pairing calculation. Reference listPatent literature Non-patent literature 1: X. Zhang, D. Lin, “Analysis of Optimum Pairing Products at High Security Levels”, INDOCRYPT 2012, pp. 412-430, 2012 Non-patent literature 2: S. Duquesne, N. EI Mrabet, S. Haloui and F. Rondepierre, “Choosing and generating parameters for pairing implementation on BN curves,” Algebra Eng. Commun. Comput., vol. 29, pp. 113-147, 2018 Summary of the inventionTechnical problem

[0008] In Non-Patent Literature 1, an elliptic curve corresponding to the security level of 256 bits is selected from BLS 27 curves.

[0009] Furthermore, in Non-Patent Literature 2, as the integer u, an integer whose Hamming weight s is specified and which satisfies a specified condition cond is selected from a specified range. Furthermore, it is confirmed that an integer p = p(u) and an integer r = r(u) are prime numbers with respect to the selected integer u. However, the specified condition under which the integer u is selected is a condition to improve the efficiency of computation on the finite field. In addition, there is no reference to a generation method of the integer u where the Hamming weight is a specified value h. Furthermore, since signed binary representations of an integer are generally not uniquely specified, the parameter generation method of Non-Patent Literature 2 results in duplication of the integers u to be generated.

[0010] Since, as described, the probability that a randomly selected integer u satisfies all conditions is not high, the problem is that the search for an integer u, which is one of the parameters in the pairing calculation, takes a lot of time.

[0011] The present disclosure aims to generate a suitable seed in a short time by efficiently searching for a seed suitable for the pairing computation. Solution to the problem

[0012] According to the present disclosure, a parameter generating device for generating a seed which is a parameter to determine an elliptic curve used for a pairing calculation is provided, the parameter generating device comprising a pre-calculation unit for calculating, as a composite number condition, a composite number condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected is a composite number; a seed candidate generation unit for searching for an integer whose Hamming weight in a signed binary representation represented in a non-adjacent form is included in a previously defined weight range, for deleting an integer satisfying the composite number condition from a set of integers obtained by the search, and for considering a set of remaining integers obtained by deleting the integer satisfying the composite number condition as a set of seed candidates;and a prime number decision unit for deciding whether both the first polynomial and the second polynomial become prime numbers when each integer from the set of seed candidates is substituted into the first polynomial and the second polynomial, and for extracting an integer for which both the first polynomial and the second polynomial become prime numbers from the set of seed candidates as the seed.; Advantageous effects of the invention

[0013] In a parameter generation device according to the present disclosure, a pre-calculation unit calculates, as a composite number condition, an integer condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting a family of elliptic curves is a composite number. A seed candidate generation unit searches for an integer whose Hamming weight of a signed binary representation represented in a non-adjacent form is included in a weight range. Then, the seed candidate generation unit deletes integers satisfying the composite number condition from a set of integers obtained by the search to form a set of seed candidates.Therefore, with the parameter generating device according to the present disclosure, a seed suitable for the pairing calculation can be searched for efficiently, and a suitable seed can be generated in a short time. Brief description of the drawings Fig. 1 is a diagram showing an example of a functional configuration of a parameter generating device according to a first embodiment; Fig. 2 is a flowchart showing an operation of a precalculation unit according to the first embodiment; Fig. 3 is a flowchart showing an operation of a seed candidate generation unit according to the first embodiment; Fig. 4 is a flowchart showing an operation of a prime number decision unit according to the first embodiment; Fig. 5 is a flowchart showing an operation of a seed representation generating unit according to the first embodiment; Fig. 6 is a diagram showing an example of a hardware configuration of the parameter generating device according to the first embodiment; and Fig. 7 is a diagram showing an example of a hardware configuration of a parameter generating device 10 according to a variant of the first embodiment. Description of embodiments

[0014] A present embodiment will be described below using diagrams. In the drawings, the same or corresponding elements are denoted by the same reference numerals. In the description of the embodiment, explanations of the same or corresponding elements are omitted or simplified as appropriate. The arrows in the diagrams mainly represent data or processing streams. First embodiment

[0015] A parameter generating means 10 according to the present embodiment generates a seed, which is a parameter for determining an elliptic curve used in the pairing calculation.

[0016] In the present embodiment, the seed to be searched can be referred to as an integer u. ***Description of the configuration***

[0017] Fig. 1 is a diagram showing an example of a functional configuration of the parameter generating device 10 according to the present embodiment.

[0018] The parameter generation device 10 comprises as functional elements a pre-calculation unit 11, a seed candidate generation unit 12, a prime number decision unit 13 and a seed representation generation unit 14.

[0019] Here we mainly describe the input and output of the individual functional elements.

[0020] The parameter generating device 10 accepts a search range U, a weight range W, a polynomial p(x), a polynomial r(x) and a threshold b.

[0021] The search range U is a range in which an integer u, i.e. a seed, is searched for.

[0022] The weight range W is a range of a Hamming weight of an integer in the non-adjacent form. In the present embodiment, the Hamming weight of an integer a in the non-adjacent form is denoted by HW (NAF(a)).

[0023] The polynomial p(x) and the polynomial r(x) are polynomials that form a family of elliptic curves, from which one elliptic curve is selected. Details are described below.

[0024] The threshold b is a threshold for prime numbers.

[0025] The pre-calculation unit 11 receives the polynomial p(x), the polynomial r(x), and the threshold b as elements for forming a mating-friendly curve. The pre-calculation unit 11 then outputs the threshold b and a generated set B to the seed candidate generation unit 12.

[0026] The seed candidate generation unit 12 receives the search range U for the integer u and the weight range W of the Hamming weight. Furthermore, the seed candidate generation unit 12 uses the threshold b and the set B output from the pre-calculation unit 11 as inputs. Subsequently, the seed candidate generation unit 12 outputs a set T of candidates of the generated integer u to the prime decision unit 13.

[0027] The prime number decision unit 13 receives the polynomial p(x) and the polynomial r(x). Furthermore, the prime number decision unit 13 uses the set T output from the seed candidate generation unit 12 as input. Then, the prime number decision unit 13 outputs a set S of integers u, where both the integer p(u) and the integer r(u) are prime numbers, to the seed representation generation unit 14.

[0028] The seed representation generation unit 14 uses the set S output from the prime number decision unit 13 as input. Subsequently, the seed representation generation unit 14 calculates a set R of representations of integers u suitable for the pairing calculation and transmits the set R.

[0029] Here, the integer u which is the seed generated in the present embodiment, the signed binary representations of the integer, and a non-adjacent form from the signed binary representations are described.

[0030] As described above, the elliptic curve used in the matching calculation is selected from the family of elliptic curves suitable for the matching calculation. Hereinafter, the family of elliptic curves is referred to as matching-friendly curves.

[0031] A matching-friendly curve consists of a polynomial p(x), a polynomial r(x), a polynomial t(x), and an embedding degree k. An elliptic curve E used in matching calculus is an elliptic curve defined on a finite field Fp with the number of elements p = p(u). r = r(u) is the largest prime number that divides the order of a group E(Fp). t = t(u) is the trace of the elliptic curve E. In this case, k is the smallest positive integer satisfying (p^k-1) = 0(mod r).

[0032] As described, the elliptic curve used for the pairing calculation is selected by determining the integer u. However, it is required that the integer p and the integer r are prime numbers, and that the integer r has a size that satisfies a certain level of certainty.

[0033] The integer u has a significant impact on the computational complexity of the pairing calculus. Specifically, the smaller the number of digits in a signed binary representation and the smaller the Hamming weight of the integer u, the lower the computational complexity. Furthermore, there is a case where the fewer digits -1 there are in a signed binary representation of the integer u, the lower the computational complexity.

[0034] A signed binary representation of an integer a is said to specify a binary representation that allows -1. Furthermore, the Hamming weight of the integer a is said to specify the number of non-zero digits in a signed binary representation of the integer a. For example, 198 in the decimal number system can be represented as (11000110)2 in the binary number system. For example, if n is used as the digit of -1, (11001n10)2 is one of the signed binary representations of 198, and the Hamming weight is 5.

[0035] There is a non-adjacent form (NAF) as a representation method inherent in signed binary representations. In general, the signed binary representations of the integer a are not uniquely specified. However, the non-adjacent form of the integer a has the properties of being uniquely specified and having a minimal Hamming weight. For example, the non-adjacent form of 198 in the decimal system is (10n0010n0)2, and the Hamming weight is 4. ***Description of the business***

[0036] Next, an operation of the parameter generation device 10 according to the present embodiment will be described. The operation of the parameter generation device 10 corresponds to a parameter generation method. A program for implementing the operation of the parameter generation device 10 further corresponds to a parameter generation program.

[0037] Next, the operation of the parameter generating device 10 according to the present embodiment will be described using Fig. 1. Implementing the pairing calculation requires the prime number p and the prime number r as parameters. The prime number p and the prime number r are generated by substituting the integer u into the polynomial p(x) and the polynomial r(x), which are elements of the pairing-friendly curve. Therefore, it is necessary to specify the integer u.

[0038] However, it is preferable that the integer u be such that, for the polynomial p(x) and the polynomial r(x), both the integer p(u) and the integer r(u) are prime numbers, and the Hamming weight of the integer u is small. Let the condition that both the integer p(u) and the integer r(u) are prime numbers be Condition 1. Let the condition that the Hamming weight of the integer u is small be Condition 2.

[0039] For the polynomial p(x) and the polynomial r(x) it is necessary that the integer u, which represents the seed, satisfies condition 1 and condition 2.

[0040] Condition 1 is a necessary condition for performing the pairing calculation. Furthermore, condition 2 is a condition for the efficient implementation of the pairing calculation.

[0041] When an integer u is randomly selected, the probability that Condition 1 or Condition 2 is satisfied is remarkably low in many cases. Therefore, in the present embodiment, the efficiency of the search process for the integer u is improved by selecting only integers u for which the probabilities that Condition 1 or Condition 2 is satisfied are higher.

[0042] First, an integer satisfying Condition 2, that is, the condition that the Hamming weight of the integer is small, is generated by using the non-adjacent form. As described above, since signed binary representations are not uniquely specified, duplication generally occurs in integers u satisfying Condition 2, and the search time increases. Meanwhile, the non-adjacent form among signed binary representations is uniquely specified with respect to an integer. Therefore, it is easy to confirm whether Condition 2 is satisfied because it is possible to minimize the search range for the integer u and the Hamming weight is minimal.

[0043] To increase the probability that condition 1 is satisfied, i.e. the condition that both the integer p(u) and the integer r(u) are prime numbers, a condition is previously calculated for the integer u under which the integer p(u) or the integer r(u) has a small prime factor.

[0044] For example, if an integer a is such that p(a) = 0(mod q) exists for a certain prime number q, it is obvious that p(u) = 0(mod q) if u = a(mod q).

[0045] If the root of p(x) mod q and the root of r(x) mod q are computed in advance for several prime numbers q, and an integer u is congruent with a root according to q as its modulus, the integer u is deleted from the candidates for search. In this way, it is possible to confirm the existence of the prime factor q by division to calculate a remainder for the integer u before deciding whether p(u) or r(u) is prime. Furthermore, it may be appropriate to add a condition to the pair of this prime number q and the root to improve the efficiency of the calculation on the finite field, as in Patent Literature 2.

[0046] Furthermore, it may be appropriate to use sieving using elements of a set B to delete an integer u from the search candidates. For example, given a prime number q and a root a of a polynomial f(x) mod q, f(a) has a prime factor q. Furthermore, for an integer m, f(a + mq) also has a prime factor q. In this way, if the integer u is congruent with the root a in accordance with q as the modulus, it is possible to delete (u + mq) from the search candidates without performing division to calculate a remainder.

[0047] When a non-adjacent form is used as the signed binary representation of the integer u, the Hamming weight is minimal, and the efficiency of the matching calculation can be improved. However, the non-adjacent form cannot always minimize the computational complexity of the matching calculation. For example, if the integer u is 198 in the decimal system, the non-adjacent form of u is (10n0010n0)2, and the Hamming weight is 4.

[0048] Since (110010n0)2 is one of the signed binary representations of u, the Hamming weight is also 4, and the number of digits is 1 smaller than in the non-adjacent form.

[0049] Furthermore, similar to (11000110)2, one of the signed binary representations of u, the Hamming weight is 4, and it is represented only by the digits 0 and 1. The computational complexity of the pairing calculation can be further reduced by using the last-given signed binary representation compared to the non-adjacent form.

[0050] In the pre-calculation unit 11, roots of the first polynomial p(x) and the second polynomial r(x) are calculated for a prime number q that is equal to or less than the threshold b, and a set B of pairs of q and the root is generated.

[0051] In the seed candidate generation unit 12, an integer u whose Hamming weight in the non-adjacent form is contained in the weight range W is searched in the search range U, and a set T is generated. Furthermore, an integer u that does not satisfy condition 1 is deleted from the set T by referring to the set B.

[0052] In the prime number decision unit 13, for an integer u, which is an element of the set T, it is decided whether both the integer p(u) and the integer r(u) are prime numbers, and a set S of integers u is generated for which the decision result is true.

[0053] In the seed representation generation unit 14, for each element u of the set S, a signed binary representation v is calculated in a manner that improves the efficiency of the pairing calculation, and a set R of pairs (u, v) is generated. <vorberechnungsprozess>

[0054] Fig. 2 is a flowchart illustrating an operation of the pre-calculation unit 11 according to the present embodiment.

[0055] A pre-calculation process according to the present embodiment is described by Fig. 2 described.

[0056] In the pre-calculation process, the pre-calculation unit 11 calculates, as a composite number condition, an integer condition under which at least one of a first integer p and a second integer r obtained by substituting an integer into each of the first polynomial p(x) and the second polynomial r(x) constituting a family of elliptic curves from which one elliptic curve is selected, is a composite number.

[0057] Specifically, the pre-calculation unit 11 calculates roots of p(x) mod q and r(x) mod q for a prime number q equal to or less than the threshold b. Then, the pre-calculation unit 11 generates a set B of pairs of q and a root a, which is the root of p(x) mod q or r(x) mod q, as the condition for a composite number.

[0058] More specifically as follows.

[0059] In step S111, the pre-calculation unit 11 receives the first polynomial p(x), the second polynomial r(x) and the threshold value b.

[0060] In step S112, the pre-calculation unit 11 calculates a root a i, j of the polynomial p(x) and the polynomial r(x) according to q i as modulus for a prime number q i , which is equal to or less than the threshold b. The root a i, j is a root of p(x) mod q or r(x) mod q. In this case, the subscripts i and j can be natural numbers or integers equal to or greater than 0. i stands for the number of prime numbers and j stands for the number of roots a i , which corresponds to each prime number q i are equivalent to.

[0061] In step S113, the pre-calculation unit 11 generates, as the condition for a composite number, a set B of calculated pairs (q i, a i, j ).

[0062] In step S114, the pre-calculation unit 11 transmits the threshold b and the amount B to the seed candidate generation unit 12. <seed-kandidat-erzeugungsprozess>

[0063] Fig. 3 is a flowchart illustrating an operation of the seed candidate generation unit 12 according to the present embodiment.

[0064] A seed candidate generation process according to the present embodiment is described by Fig. 3 described.

[0065] In the seed candidate generation process, the seed candidate generation unit 12 searches for an integer whose Hamming weight in a signed binary representation in the non-adjacent form is included in the previously determined weight range W. The seed candidate generation unit 12 then deletes an integer satisfying the composite number condition from a set T' of integers obtained by the search. The seed candidate generation unit 12 then considers a set of the remaining integers obtained by deleting the integer satisfying the composite number condition as the set T of seed candidates.

[0066] Specifically, the seed candidate generation unit generates a pair of a prime number q and u mod q for an integer u from the set T' of integers obtained by the search. If the pair of the prime number q and u mod q is contained in the set B, which represents the composite number condition, the seed candidate generation unit deletes the integer u from the set T' of integers obtained by the search.

[0067] The fact that an integer u satisfies the condition for a composite number means that the integer u is congruent with the root a according to q as its modulus.

[0068] More specifically as follows.

[0069] In step S121, the seed candidate generation unit 12 receives the search range U for the integer u, the weight range W which is the range of the Hamming weight, the threshold b and the set B.

[0070] In step S122, the seed candidate generation unit 12 searches in the search range U for an integer whose Hamming weight in the non-adjacent form is included in the weight range W, and generates the set T' of the obtained integers.

[0071] In step S123, the seed candidate generation unit 12 calculates a pair (qi, u mod qi) for each element u of the set T' and a prime number qi equal to or less than the threshold b. Then, the seed candidate generation unit 12 considers the set T', from which an integer u for which the pair (qi, u mod qi) is included in the set B is deleted, as a set T of seed candidates.

[0072] In step S124, the seed candidate generation unit 12 transmits the set T to the prime number decision unit 13. <primzahl-entscheidungsprozess>

[0073] Fig. 4 is a flowchart illustrating an operation of the prime number decision unit 13 according to the present embodiment.

[0074] A prime number decision process according to the present embodiment is carried out using Fig. 4 described.

[0075] In the prime number decision process, the prime number decision unit 13 decides whether both the first polynomial p(u) and the second polynomial r(x) become prime numbers when each integer from the set of seed candidates is substituted into the first polynomial p(u) and the second polynomial r(x). The prime number decision unit 13 extracts an integer u for which both the first polynomial p(u) and the second polynomial r(x) are prime numbers from the set T of seed candidates as a seed.

[0076] Specifically as follows.

[0077] In step S131, the prime number decision unit 13 receives the first polynomial p(x), the second polynomial r(x) and the set T of seed candidates.

[0078] In step S132, the prime number decision unit 13 decides whether both the integer p = p(u) and the integer r = r(u) are prime numbers for each element u of the set T, and generates a set S of integers u such that the decision result is true.

[0079] In step S133, the prime number decision unit 13 transmits the set S to the seed representation generation unit 14. <seed-darstellung-erzeugungsprozess>

[0080] Fig. 5 is a flowchart illustrating an operation of the seed representation generating unit 14 according to the present embodiment.

[0081] A seed representation generation process according to the present embodiment will be described with reference to Fig. 5 described.

[0082] In the seed representation generation process, the seed representation generation unit 14 represents a seed in a signed binary representation for which the computational complexity of a pairing calculation is lower than the computational complexity for a non-adjacent form.

[0083] Specifically as follows.

[0084] In step S141, the seed representation generation unit 14 receives the set S.

[0085] In step S142, the seed representation generation unit 14 generates a signed binary representation v for which the computational complexity of a pairing calculation with respect to each element u of the set S becomes smaller. Preferably, the seed representation generation unit 14 generates a signed binary representation v for which the computational complexity of a pairing calculation with respect to each element u of the set S is the smallest.

[0086] In step S143, the seed representation generation unit 14 generates a set R of the generated pair (u, v).

[0087] In step S144, the seed representation generation unit 14 transmits the set R. ***Description of the effect of the present embodiment***

[0088] As described above, in the present embodiment, an effective search method for an integer u suitable for pairing calculation is introduced. Specifically, in the parameter generation device according to the present embodiment, duplication of integers u is eliminated and search efficiency is improved by using a non-adjacent form in which a representation is uniquely specified as a signed binary representation. Further, in the parameter generation device according to the present embodiment, a list of x is generated such that the integer p = p(x) and the integer r = r(x) have small prime factors. Then, the parameter generation device according to the present embodiment reduces the computational complexity of the parameter search by removing elements of the list from the search range for the integer u.

[0089] Thus, with the parameter generation device according to the present embodiment, it is possible to eliminate duplication in integers u and improve search efficiency by generating an integer u with a specified Hamming weight using the non-adjacent form. Furthermore, with the parameter generation device according to the present embodiment, it is possible to reduce the computational complexity for deciding a prime number by replacing the decision of whether the integer p or the integer r has a small prime factor with a division decision for calculating a remainder for the integer u.Furthermore, by the parameter generating means according to the present embodiment, it is possible to reduce the computational complexity of a pairing calculation by generating a signed binary representation converted from the non-adjacent form of the integer u without changing the Hamming weight. ***Description of an example hardware configuration***

[0090] Fig. 6 is a diagram showing an example of a hardware configuration of the parameter generating device 10 according to the present embodiment.

[0091] The parameter generation device 10 is a computer. The parameter generation device 10 includes a processor 910 and further includes other hardware components such as a memory unit 921, an auxiliary storage device 922, an input and output interface 930, and a communication interface 950. The processor 910 is connected to other hardware components via a signal line 80 and controls these other hardware components.

[0092] As described above, the parameter generation device 10 includes the pre-calculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 as functional components. The functions of the pre-calculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 are implemented by software.

[0093] Hereinafter, the pre-calculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 may be referred to as each unit of the parameter generation device 10.

[0094] Processor 910 is a device for executing the parameter generation program. The parameter generation program is a program for implementing the functions of parameter generation device 10.

[0095] The processor 910 is an integrated circuit (IC) that performs arithmetic processing. A specific example of a processor 910 is a CPU, DSP, or GPU. IC stands for integrated circuit. CPU stands for central processing unit. DSP stands for digital signal processor. GPU stands for graphics processing unit.

[0096] The memory unit 921 is a memory device for temporarily storing data. A specific example of a memory unit 921 is an SRAM or a DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0097] The auxiliary storage device 922 is a storage device for storing data. A concrete example of the auxiliary storage device 922 is an HDD. Furthermore, the auxiliary storage device 922 may be a portable storage medium, such as an SD (registered trademark) type memory card, a CF, a NAND Flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. HDD is the abbreviation for Hard Disk Drive. SD (registered trademark) is the abbreviation for Secure Digital. CF is the abbreviation for CompactFlash (registered trademark). DVD is the abbreviation for Digital Versatile Disk.

[0098] The input / output interface 930 is an interface for connecting input and output devices. The input / output interface 930 is, for example, a USB port or an HDMI (registered trademark) port. USB is an abbreviation for Universal Serial Bus. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface.

[0099] The communication interface 950 is an interface for communicating with external devices. The communication interface 950 is an Ethernet port (registered trademark) or a device that, for example, performs wireless communication.

[0100] The parameter generation program is executed in the parameter generation device 10. The parameter generation program is read into the processor 910 and executed by the processor 910. The memory unit 921 stores not only the parameter generation program but also an OS. OS is an abbreviation for Operating System. The processor 910 executes the parameter generation program while executing the OS. The parameter generation program and the OS may be stored in the auxiliary storage device 922. The parameter generation program and the OS stored in the auxiliary storage device 922 are loaded into the memory unit 921 and executed by the processor 910. The parameter generation program may be integrated in whole or in part into the OS.

[0101] The parameter generation device 10 may include a plurality of processors that replace the processor 910. The plurality of processors share the execution of the parameter generation program. Just like the processor 910, each processor is a device for executing the parameter generation program.

[0102] The data, information, signal and variable values ​​used, processed or output by the parameter generation program are stored in the memory unit 921, the auxiliary storage device 922 or a register or cache memory device within the processor 910.

[0103] The "unit" of the precalculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 may be replaced by "circuit," "step," "procedure," "process," or "circuit." The parameter generation program causes a computer to perform a precalculation process, a seed candidate generation process, a prime number decision process, and a seed representation generation process. The "process" of the precalculation process, the seed candidate generation process, the prime number decision process, and the seed representation generation process may be replaced by "program," "program product," "a computer-readable storage medium on which a program is stored," or "a computer-readable recording medium on which a program is recorded."Further, the parameter generation method is a method performed by executing the parameter generation program by the parameter generation device 10.

[0104] The parameter generation program may be provided by storing it on a computer-readable recording medium. Furthermore, the parameter generation program may be provided as a program product. ***Other configurations*** <variante>

[0105] In the present embodiment, the functions of the pre-calculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 are implemented by software. Alternatively, the functions of the pre-calculation unit 11, the seed candidate generation unit 12, the prime number decision unit 13, and the seed representation generation unit 14 may be implemented by hardware.

[0106] In particular, the parameter generating device 10 has an electronic circuit 909 instead of the processor 910.

[0107] Fig. 7 is a diagram showing an example of a hardware configuration of the parameter generating device 10 according to the variant of the present embodiment.

[0108] The electronic circuit 909 is a dedicated electronic circuit for implementing the functions of each unit of the parameter generation device 10. The electronic circuit 909 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic integrated circuit, a GA, an ASIC, or an FPGA. GA is an abbreviation for gate array. ASIC is an abbreviation for application-specific integrated circuit. FPGA is an abbreviation for field-programmable gate array.

[0109] The functions of each unit of the parameter generating device 10 may be realized by a single electronic circuit or may be realized distributed by a plurality of electronic circuits.

[0110] Another variant is that some of the functions of each unit of the parameter generation device 10 can be implemented by an electronic circuit, and the remaining functions can be implemented by software. Furthermore, some or all of the functions of each unit of the parameter generation device 10 can be implemented by firmware.

[0111] Each of the processors and electronic circuits is also referred to as a processing circuit. That is, the functions of each unit of the parameter generation device 10 are implemented by a processing circuit.

[0112] In the above first embodiment, each unit of the parameter generating device 10 was described as an independent functional block. However, the parameter generating device 10 does not need to be configured as in the above embodiment. The functional blocks of the parameter generating device 10 can be configured in any manner as long as the functional blocks can realize the functions described in the above embodiment. Furthermore, the parameter generating device 10 may be a system configured by a plurality of devices rather than just one device.

[0113] Furthermore, a plurality of parts of the first embodiment may be combined and implemented. Otherwise, only part of the embodiment may be implemented. Furthermore, the embodiment may be combined and implemented in any combination, in whole or in part.

[0114] That is, in the first embodiment, it is possible to freely combine each embodiment, deform any component of each embodiment, or omit any component in each embodiment.

[0115] The above-described embodiment is essentially a preferred example and is not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the range of use of the present disclosure. It is possible to modify the above-described embodiment as needed. The procedures explained by means of the flowcharts and sequence diagrams may be modified as needed. List of reference symbols

[0116] 10: Parameter generation unit; 11: Precalculation unit; 12: Seed candidate generation unit; 13: Prime number decision unit; 14: Seed representation generation unit; U: Search range; W: Weight range; b: Threshold; T, B, S, R: Quantity; 80: Signal line; 909: Electronic circuit; 910: Processor; 921: Working memory unit; 922: Auxiliary storage unit; 930: Input and output interface; 950: Communication interface. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited non-patent literature

[0000] X. Zhang, D. Lin, „Analysis of Optimum Pairing Products at High Security Levels", INDOCRYPT 2012, S. 412-430, 2012

[0007] S. Duquesne, N. EI Mrabet, S. Haloui und F. Rondepierre, „Choosing and generating parameters for pairing implementation on BN curves", Algebra Eng. Commun. Comput., vol. 29, S. 113-147, 2018

[0007] < / variante> < / vorberechnungsprozess>

Claims

[1] A parameter generating device for generating a seed which is a parameter for determining an elliptic curve used for a pairing calculation, the parameter generating device comprising: a pre-calculation unit for calculating, as a composite number condition, a composite number condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected is a composite number; a seed candidate generation unit for searching for an integer whose Hamming weight in a signed binary representation represented in a non-adjacent form is included in a previously defined weight range, for deleting an integer satisfying the composite number condition from a set of integers obtained by the search, and for considering a set of remaining integers obtained by deleting the integer satisfying the composite number condition as a set of seed candidates; and a prime number decision unit for deciding whether both the first polynomial and the second polynomial become prime numbers when each integer from the set of seed candidates is substituted into the first polynomial and the second polynomial, and for extracting an integer for which both the first polynomial and the second polynomial become prime numbers from the set of seed candidates as the seed. [2] The parameter generating device according to claim 1, further comprising a seed representation generating unit for representing the seed in a signed binary representation for which the computational complexity of the pairing calculation is lower than for the non-adjacent form. [3] Parameter generating device according to claim 1 or claim 2, wherein the pre-calculation unit calculates a root a which is a root of p(x) mod q or r(x) mod q, where p(x) is the first polynomial, r(x) is the second polynomial and q is a prime number, and considers a pair of the prime number q and the root a as the condition for a composite number, and the seed candidate generation unit generates a pair of the prime number q and u mod q for the integer u of the set of integers obtained by the search, and deletes an integer u from the set of integers obtained by the search if the pair of the prime number q and u mod q is included in the composite number condition. [4] Parameter generating device according to claim 3, wherein the pre-calculation unit receives a previously defined threshold and calculates a root a which is a root of p(x) mod q or r(x) mod q for p(x), r(x) and a prime number q which is equal to or less than the threshold, and the seed candidate generation unit generates a pair of the prime number q equal to or less than the threshold and u mod q. [5] The parameter generating device according to any one of claims 1 to 4, wherein the seed candidate generating unit receives a range for searching for the seed as a search range and searches for an integer in the search range whose Hamming weight is included in the weight range. [6] The parameter generating device according to any one of claims 1 to 5, wherein the seed candidate generating unit receives the weight range and searches in the weight range for an integer whose Hamming weight is included in the weight range. [7] A parameter generation method for use by a parameter generation device for generating a seed which is a parameter for determining an elliptic curve used for a pairing calculation, the parameter generation method comprising: by a computer, calculating, as a composite number condition, a composite number condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected, is a composite number; by the computer, searching for an integer whose Hamming weight in a signed binary representation represented in a non-adjacent form is contained in a previously defined weight range that deletes an integer satisfying the composite number condition from a set of integers obtained by the search, and considering a set of remaining integers obtained by deleting the integer satisfying the composite number condition as a set of seed candidates; and by a computer, deciding whether both the first polynomial and the second polynomial become prime numbers when each integer from the set of seed candidates is substituted into the first polynomial and the second polynomial, and extracting an integer for which both the first polynomial and the second polynomial become prime numbers from the set of seed candidates as the seed. [8] A parameter generation program for use by a parameter generation device for generating a seed which is a parameter to determine an elliptic curve used for a pairing calculation, the parameter generation program causing a computer to execute: a pre-calculation process for calculating, as a composite number condition, a composite number condition for an integer under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected is a composite number; a seed candidate generation process for searching for an integer whose Hamming weight in a signed binary representation represented in a non-adjacent form is included in a previously defined weight range, for deleting an integer satisfying the composite number condition from a set of integers obtained by the search, and for considering a set of remaining integers obtained by deleting the integer satisfying the composite number condition as a set of seed candidates; and a prime number decision process for deciding whether both the first polynomial and the second polynomial become prime numbers when each integer from the set of seed candidates is substituted into the first polynomial and the second polynomial, and for extracting an integer for which both the first polynomial and the second polynomial become prime numbers from the set of seed candidates as the seed.

Images