Sparse multiplication calculating device, miller function calculating device, pairing arithmetic unit, cipher processing device, sparse multiplication calculating method, and sparse multiplication calculating program

Abstract

To efficiently calculate a sparse multiplication that appears in pairing calculation on an elliptic curve having a six-dimensional twist.SOLUTION: A sparse multiplication calculating device 10 calculates sparse multiplication used for calculation of a miller function in a pairing operation on an elliptic curve represented by using an embedding degree k. The sparse multiplication calculating device 10 calculates sparse multiplication of a k-th dimensional extension field. A resolution unit 21 resolves the k-th dimensional extension field to a two-dimensional extension field and a three-dimensional extension field. A sparse multiplication calculating unit 22 calculates sparse multiplication in the two-dimensional extension field and the three-dimensional extension field to calculate sparse multiplication in the k-th dimensional extension field.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to computational techniques for sparse multiplication in pairing operations. [Background technology]

[0002] Pairing operations are operations using elliptic curves that are processed inside encryption methods such as functional cryptography and private search. An elliptic curve that is suitable for efficient calculation of pairing operations is called a pairing-friendly curve. Until now, the BN curve was known as a pairing-friendly curve equivalent to 128-bit security. BN stands for Barret-Naehrig. However, since around 2016, its security has been reviewed, and interest in pairing operations using various pairing-friendly curves such as BLS curves and KSS curves has been increasing. BLS stands for Barreto-Lynn-Scott. KSS stands for Kachisa-Schaefer-Scott.

[0003] Pairing operations are roughly divided into the calculation of the Miller function and the calculation of the final exponent. Both the calculation of the Miller function and the calculation of the final exponent require complex calculation processes, and have a large impact on the overall computational complexity of cryptographic methods such as functional encryption and private search.

[0004] In recent research, there has been much research on BLS curves, which are considered to have good overall pairing calculation efficiency among the many pairing-friendly curves. In particular, pairing calculations for BLS curves with embedding degree k = 12, 24, 27, 42, and 48 have been well studied. Among these, pairing-friendly curves with a 6th-order twist, which includes an embedding degree that is a multiple of 6, are considered to be particularly computationally efficient, and their computational efficiency has been widely studied.

[0005] A curve parameterized by an elliptic curve family is an elliptic curve determined by polynomials r(x), p(x), t(x), embedding degree k, and an integer u. Polynomials r(x), p(x), and t(x) have different shapes depending on the embedding degree k. A curve E parameterized by an elliptic curve family of embedding degree k is an elliptic curve defined over a finite field Fp with p=p(x) elements. r=r(x) is the largest prime number that divides the order of the subgroup E(Fp) of the elliptic curve E. t=t(x) is the trace of the elliptic curve E.

[0006] The pairing operation on an elliptic curve E is performed by inputting two points P and Q on the elliptic curve E, calculating a rational function f called the Miller function, and then calculating (p(x) k -1) / r(x). In other words, the pairing operation on the elliptic curve E is calculated using the number 100.

number

[0007] In Non-Patent Document 1, an efficient sparse multiplication algorithm for the BN curve is described in order to efficiently calculate the Miller function. In this case, in order to explain the sparse multiplication corresponding to the 6th degree twist curve, the extension field Fp 12 Consider elements f and g of . The form of elements f and g changes depending on how the basis of the 12th degree extension field is chosen, but here we set the extension field as in number 101.

number

number

[0008] In this case, sparse multiplication of elements f and g refers to a situation where either element f or element g is sparse. A sparse element means that any of the coefficients of the elements is 0. In this case, it is known that the calculation efficiency is better than that of normal multiplication. [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] Mori Y, Akagi S, Nogami Y, Shirase M. (2014) Pseudo 8-Sparse Multiplication for Efficient Ate-Based Pairing on Barreto-Naehrig Curve. In: Cao Z, Zhang F. (eds) Pairing-Based Cryptography-Pairing 2013. Lecture Notes in Computer Science, vol 8365 Springer, Cham. Summary of the Invention [Problem to be solved by the invention]

[0010] In order to efficiently calculate sparse multiplication that appears in pairing calculations on elliptic curves with a sixth twist, an efficient sparse multiplication calculation algorithm that is compatible with elliptic curves with a sixth twist is required. The naively constructed sparse multiplication algorithm considered in Non-Patent Document 1 cannot be applied to curves with other embedding degrees, and there is still room for improvement in efficiency. The present disclosure aims to make it possible to efficiently compute sparse multiplication that appears in pairing calculations on elliptic curves with a sixth twist. [Means for solving the problem]

[0011] The sparse multiplication calculation device according to the present disclosure comprises: A sparse multiplication calculation device for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation device calculating a sparse multiplication of a k-th order extension field, a decomposition unit for decomposing the k-th order extension field into a quadratic extension field and a cubic extension field; a sparse multiplication calculation unit that calculates sparse multiplication in the k-th order extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by the decomposition unit; Equipped with. Effect of the Invention

[0012] In this disclosure, a k-th order extension field is decomposed into a quadratic extension field and a cubic extension field, and sparse multiplication in the k-th order extension field is calculated by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field. This makes it possible to efficiently calculate sparse multiplication that appears in pairing calculations on elliptic curves with a sextic twist. [Brief description of the drawings]

[0013] [Figure 1] 1 is a configuration diagram of a sparse multiplication calculation device 10 according to a first embodiment. [Diagram 2] 3 is a flowchart showing the overall operation of the sparse multiplication calculation device 10 according to the first embodiment. [Diagram 3] 4 is a flowchart of the calculation process of Equation 10 by the equation formulation unit 25 according to the first embodiment. [Figure 4] 13 is a flowchart of the calculation process of Equation 11 by the equation formulation unit 25 according to the first embodiment. [Diagram 5] 4 is a flowchart of calculation processing by a solution finding unit 26 according to the first embodiment. [Figure 6] 4 is a flowchart of calculation processing by a solution finding unit 26 according to the first embodiment. [Figure 7] FIG. 1 is a configuration diagram of a sparse multiplication calculation device 10 according to a first modified example. [Figure 8] FIG. 13 is a configuration diagram of a Miller function calculating device 30 according to a third modification. [Figure 9] FIG. 13 is a configuration diagram of a pairing calculation device 40 according to a fourth modified example. [Figure 10] FIG. 11 is a configuration diagram of a cryptographic processing device 50 according to a second embodiment. [Figure 11] 10 is a flowchart showing the operation of the cryptographic processing device 50 according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Embodiment 1

[0015] ***Configuration Description*** The configuration of a sparse multiplication calculation device 10 according to the first embodiment will be described with reference to FIG. The sparse multiplication calculation device 10 is a computer. The sparse multiplication calculation device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these other hardware components.

[0016] The processor 11 is an IC that performs processing. IC is an abbreviation for Integrated Circuit. Specific examples of the processor 11 include a CPU, a DSP, and a GPU. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0017] The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 include SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0018] The storage 13 is a storage device that stores data. A specific example of the storage 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. The storage 13 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0019] The communication interface 14 is an interface for communicating with an external device. Specific examples of the communication interface 14 include Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition Multimedia Interface.

[0020] The sparse multiplication calculation device 10 includes, as functional components, a decomposition unit 21 and a sparse multiplication calculation unit 22. The sparse multiplication calculation unit 22 includes a first calculation unit 23 and a second calculation unit 24. The second calculation unit 24 includes an equation formulation unit 25 and a solution finding unit 26. The functions of the functional components of the sparse multiplication calculation device 10 are realized by software. The storage 13 stores a program that realizes the function of each functional component of the sparse multiplication calculation device 10. The program is loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the function of each functional component of the sparse multiplication calculation device 10 is realized.

[0021] 1 shows only one processor 11. However, there may be a plurality of processors 11, and the plurality of processors 11 may cooperate to execute programs that realize the respective functions.

[0022] ***Explanation of Operation*** The operation of the sparse multiplication calculation device 10 according to the first embodiment will be described with reference to FIGS. The operation procedure of the sparse multiplication calculation device 10 according to the embodiment 1 corresponds to the sparse multiplication calculation method according to the embodiment 1. Moreover, the program that realizes the operation of the sparse multiplication calculation device 10 according to the embodiment 1 corresponds to the sparse multiplication calculation program according to the embodiment 1.

[0023] In the first embodiment, the sparse multiplication calculation device 10 is k / Fp k / 2 / Fp k / 6 Here, k is a natural number divisible by 6. Fq represents a finite field with q elements. k is a representation of a polynomial ring Fp k =Fp k / 2 [w] / (w 2 -v). Note that w 2 -v is a polynomial ring Fp k / 2 [w] is an irreducible polynomial, and v is an element of Fp k / 2 belongs to the finite field Fp k / 2 is a representation of a polynomial ring Fp k / 2 =Fp k / 6 [v] / (v 3 -u). Note that v 3 -u is a polynomial ring Fp k / 6 [v] is an irreducible polynomial, and element u is Fp k / 6 Belongs to. Extension field Fp k Sparse multiplication in is a calculation that appears multiple times in the calculation of Miller functions when considering pairing calculations of elliptic curves with a sixth twist. k Sparse multiplication in appears in pairing computations on the BN curve, BLS-12 curve, BLS-24 curve, BLS-48 curve, etc.

[0024] The overall operation of the sparse multiplication calculation device 10 according to the first embodiment will be described with reference to FIG. First, before performing various calculations, in step S11, the decomposition unit 21 decomposes the extension field Fp kIn the first embodiment, the decomposition unit 21 performs decomposition of the extension field Fp k is decomposed from above. Next, in step S12, the first calculation unit 23 performs sparse multiplication calculations corresponding to the quadratic extension field part. Next, in step S13, the second calculation unit 24 performs sparse multiplication calculations corresponding to the cubic extension field part.

[0025] Here, elements (multiplication f1g1 and multiplication f0g1 described later) used in the calculation of sparse multiplication corresponding to the part of the quadratic extension field in step S12 are obtained by the calculation of sparse multiplication corresponding to the part of the cubic extension field in step S13. That is, the sparse multiplication calculation unit 22 calculates the sparse multiplication in the k-th order extension field by calculating the sparse multiplication in the quadratic extension field using the result of the sparse multiplication in the cubic extension field.

[0026] Next, the detailed operation of the sparse multiplication calculation device 10 will be described. Sparse multiplication is performed in the finite field Fp k This refers to the multiplication f*g of two elements f and g as input, and refers to when either element f or element g is sparse. An element is sparse when any of the coefficients of the element is 0. In other words, an element f has k coefficients of Fp lined up, and if one or more of these coefficients are 0, the element f is said to be sparse. The same applies to element g. In the first embodiment, the discussion is the same regardless of whether the element f or g is sparse, so below we consider a situation where the element g is sparse.

[0027] In the mirror loop of the pairing of the sextic twist curve, an element of the form number 1 appears.

number

number

[0028] First, the decomposition unit 21 k Fp k =Fp k / 2 [w] / (w 2 -v), we decompose number 1 into two elements (corresponding to step S11 in FIG. 2). This allows us to express the element g in the form of number 3.

number

[0029] Consider multiplication with an element f. The element f can be expressed in the form of number 4.

number

number

[0030] The two Fps mentioned above k / 2 The multiplication is sparse. In fact, the element g1 has the form of the number 6.

number

number

[0031] The process of calculating the multiplications f1g1 and f0g1 by the second calculation unit 24 will be described. In this process, in order to simplify the symbols, multiplication of the number 8 will be considered.

number

number

number

number

[0032] The calculation process of Equation 10 by the equation formulation unit 25 according to the first embodiment will be described with reference to FIG. In step S21, the equation formulation unit 25 calculates the addition of coefficients f0 and f2 in the input f. In step S22, the equation formulation unit 25 adds coefficient f1 to the result calculated in step S21. This calculates f(1) in number 10. In step S23, the equation formulation unit 25 subtracts coefficient f1 from the result calculated in step S21. This calculates f(-1) in number 10. In step S24, the equation formulation unit 25 calculates u times the coefficient f1 in the input f and subtracts it from f0. In step S25, the equation formulation unit 25 calculates u times the coefficient f1 in the input f and subtracts it from f0. 2 The result is multiplied by u and added to the result of the calculation in step S24. In this way, f(-u) in equation (10) is calculated. Note that f(0) and f(∞) in equation 10 are obtained as coefficients at the input f.

[0033] The calculation process of Equation 11 by the equation formulation unit 25 according to the first embodiment will be described with reference to FIG. In step S31, the equation formulation unit 25 adds the coefficient g1 to the coefficient g0. This calculates g(1) in equation 11. In step S32, the equation formulation unit 25 subtracts the coefficient g1 from the coefficient g0. This calculates g(-1) in equation 11. In step S33, u times the coefficient g1 in the input g is calculated and subtracted from g0, thereby calculating g(-u) in equation 11. Note that g(0) and g(∞) in equation 11 are obtained as coefficients of the input g.

[0034] Next, in order to formulate a four-dimensional simultaneous linear equation, the equation formulation unit 25 formulates a linear equation for determining the coefficients of a polynomial in which sparse multiplication is expressed by v. Specifically, the equation formulation unit 25 calculates Equation 12.

number

number

number

number

number

number

[0035] The solution finding unit 26 calculates the coefficients h0, h1, and h2 using equation (17). The calculation process of the solution finding unit 26 according to the first embodiment will be described with reference to FIGS.

[0036] Solution finding unit 26 calculates each element of equation 17 by the process shown in FIG. In step S41, the solution finding unit 26 adds H0 and H0 to calculate 2H0. In step S42, the solution finding unit 26 multiplies 2H0 calculated in step S41 by u to calculate 2uH0. In step S43, the solution finding unit 26 multiplies 2uH0 calculated in step S42 by u to calculate 2u 2 In step S44, the solution finding unit 26 calculates 2u 2 Subtract 2H0 calculated in step S41 from H0 to get 2u 2 Calculate H0-2H0. In step S45, the solution finding unit 26 multiplies H1 by u to calculate uH1. In step S46, the solution finding unit 26 subtracts H1 from uH1 calculated in step S45 to calculate uH1-H1. In step S47, the solution finding unit 26 multiplies uH1-H1 calculated in step S46 by u to calculate u(uH1-H1). In step S48, the solution finding unit 26 multiplies u(uH1-H1) calculated in step S47 by u to calculate u 2 Calculate (uH1-H1). In step S49, the solution finding unit 26 multiplies H2 by u to calculate uH2. In step S50, the solution finding unit 26 adds H2 to the uH2 calculated in step S49 to calculate uH2+H2. In step S51, the solution finding unit 26 multiplies uH2+H2 calculated in step S50 by u to calculate u(uH2+H2). In step S52, the solution finding unit 26 multiplies u(uH2+H2) calculated in step S51 by u to calculate u 2 Calculate (uH2+H2). In step S53, the solution finding unit 26 adds H3 and H3 to calculate 2H3. In step S54, the solution finding unit 26 multiplies 2H3 calculated in step S53 by u to calculate 2uH3.

[0037] The solution finding unit 26 solves Equation 17 to calculate the coefficients h0, h1, and h2 by the process shown in FIG. In step S61, the solution finding unit 26 calculates u 2 (uH1-H1) and u calculated in step S52 2 Using (uH2+H2), -u 2 (uH1-H1)-u 2In step S62, the solution finding unit 26 calculates -uH2+H2 calculated in step S61. 2 (uH1-H1)-u 2 Add 2uH3 calculated in step S54 to (uH2+H2) to get -u 2 (uH1-H1)-u 2 Calculate (uH2+H2)+2uH3. This gives the first line of equation 17. In step S63, the solution finding unit 26 calculates 2u 2 H0-2H0 and u calculated in step S48 2 Using (uH1-H1), -(2u 2 H0-2H0)-u 2 In step S64, the solution finding unit 26 calculates -(2u 2 H0-2H0)-u 2 (uH1-H1) is the u calculated in step S52 2 Add (uH2+H2) to get -(2u 2 H0-2H0)-u 2 (uH1-H1)+u 2 In step S65, the solution finding unit 26 calculates -(2u 2 H0-2H0)-u 2 (uH1-H1)+u 2 Subtract 2uH3 calculated in step S54 from (uH2+H2) to obtain -(2u 2 H0-2H0)-u 2 (uH1-H1)+u 2 Calculate (uH2+H2)-2uH3. This gives the second line of equation 17. In step S66, the solution finding unit 26 subtracts the uH1 calculated in step S45 and the uH2 calculated in step S49 from the 2uH0 calculated in step S42 to calculate u(2H0-H1-H2). In step S67, the solution finding unit 26 multiplies the u(2H0-H1-H2) calculated in step S66 by u to obtain u 2 In step S68, the solution finding unit 26 calculates u 2Subtract (2H0-H1-H2) from (2H0-H1-H2) to get (u 2 In step S69, the solution finding unit 26 calculates (u 2 -1)(2H0-H1-H2) multiplied by u, and get u(u 2 -1)(2H0-H1-H2). This gives us the third line of equation 17.

[0038] As a result, the coefficients h0, h1, and h2 are calculated. This corresponds to the calculation of the multiplication f*g. The second calculation unit 24 calculates two multiplications f1g1 and f0g1 as the multiplication f*g. Therefore, the second calculation unit 24 calculates the two multiplications f1g1 and f0g1 by calculating the coefficients h0, h1, and h2 for each of the two multiplications f1g1 and f0g1.

[0039] ***Evaluation of computational cost*** The calculation cost of the sparse multiplication calculation unit 22 is evaluated. First, the calculation cost of the calculation process of the second calculation unit 24 is evaluated. For number 10, five additions and three u multiplications were performed. For number 11, three additions and one u multiplication were performed. Therefore, the calculation of numbers 10 and 11 is completed with eight additions and four u multiplications. This calculation cost is 8A e +4U, where A e is a finite field Fp e U is a finite field Fp e Represents the u multiplication above. For number 12, four multiplications were performed. For H4, the value is 0 regardless of the input, and no calculation is required, so it is not counted in the number of multiplications. The calculation cost is 4M e Here, M e is a finite field Fp e Represents the multiplication above. For number 17, a total of 9 additions and 12 u multiplications were performed. Therefore, the computational cost is 9A e +12U. However, subtraction is counted as an addition because, from the viewpoint of implementation, the calculation cost is almost the same as that of addition. Also, calculating the reciprocal of an addition of an element is ignored in the above evaluation because it costs almost nothing from the viewpoint of implementation. From these factors, the total calculation cost of one multiplication in the second calculation unit 24 is expressed by equation 18.

number

[0040] Here, the second calculation unit 24 performs two multiplications f1g1 and f0g1. The first calculation unit 23 performs two Fp k / 2 Therefore, the calculation cost of the sparse multiplication calculation unit 22 is expressed by Equation 19.

number

number

number

[0041] ***Curve Example*** A specific example of the curve will be described. As specific examples, the embedding degree k is one of 6, 12, 18, 24, 30, 36, 42, and 48.

[0042] <Example 1: Embedding degree 12> A case will be described where the embedding degree of the curve is 12. When the embedding degree is k=12, in order for the first embodiment to be effective, it is necessary that Equation 22 holds true.

number

[0043] <Example 2: Embedding degree 18> A case will be described where the embedding degree of the curve is 18. When the embedding degree is k=18, in order for the first embodiment to be effective, it is necessary that Equation 23 holds true.

number

number

number

number

[0044] From the above, it can be seen that for curves with a 6th-order twist and an embedding degree of 18 or more, such as BLS24 curves or BLS48 curves, the method of embodiment 1 is unconditionally more efficient than the method of non-patent document 1.

[0045] <Specific curve> In light of the above evaluation, the first embodiment is effective for the following curves. An elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using the polynomial parameters (T(x)) / h2(x), the polynomial p(x) = h1(x)r(x) + T(x), and the polynomial t(x) = T(x) + 1.

[0046] (Example 1) The embedding degree k is 12, and the polynomial parameters are polynomial t(x)=6x 2 +1, polynomial r(x)=36x 4 -36x 3 +18x 2 -6x+1, polynomial p(x)=36x 4 -36x 3 +24x 2 -6x+1.

[0047] (Example 2) The embedding degree k is 12, and the polynomial parameters are polynomial t(x)=x+1, polynomial r(x)=Φ 12 (x)=x 4 -x 2 +1, polynomial p(x)=1 / 3(x-1) 2 r(x)+x.

[0048] (Example 3) The embedding degree k is 12, and the polynomial parameters are polynomial t(x)=x+1, polynomial r(x)=Φ 12 (x)=x 4 -x 2 +1, polynomial p(x)=1 / 4(x-1) 2 (x 2 +1)r(x)+x.

[0049] (Example 4) The embedding degree k is 24, and the polynomial parameters are polynomial t(x)=x+1, polynomial r(x)=Φ 24 (x)=x8 -x 4 +1, polynomial p(x)=1 / 3(x-1) 2 r(x)+x.

[0050] (Example 5) The embedding degree k is 42, and the polynomial parameters are polynomial t(x)=x+1, polynomial r(x)=Φ 42 (x)=x 12 +x 11 -x 9 -x 8 +x 6 -x 4 -x 3 +x+1, polynomial p(x)=1 / 3(x-1) 2 (x 2 -x+1)r(x)+x.

[0051] (Example 6) The embedding degree k is 48, and the polynomial parameters are polynomial t(x)=x+1, polynomial r(x)=Φ 48 (x)=x 16 -x 8 +1, polynomial p(x)=1 / 3(x-1) 2 r(x)+x.

[0052] ***Advantages of the First Embodiment*** As described above, the sparse multiplication calculation device 10 according to the first embodiment decomposes a k-th extension field into a quadratic extension field and a cubic extension field in a pairing calculation on a curve of embedding degree k having a 6-degree twist. Then, the sparse multiplication calculation device 10 calculates sparse multiplication in the k-th extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field. This makes it possible to efficiently perform the pairing calculation.

[0053] In particular, the sparse multiplication calculation device 10 according to the first embodiment applies a Toom-Cook method-based sparse multiplication algorithm in the calculation of sparse multiplication in a cubic extension field. This makes it possible to reduce the number of multiplications at the expense of increasing the number of additions. As a result, for curves with an embedding degree of 12, the method is more efficient than the method of Non-Patent Document 1 when M1>4.33A1, and for curves with an embedding degree of 18 or more, the method is generally more efficient than the method of Non-Patent Document 1. Therefore, by using the first embodiment, pairing calculations can be more efficiently calculated for most curves.

[0054] ***Other configurations*** <Variation 1> In the first embodiment, each functional component is realized by software. However, as a first modification, each functional component may be realized by hardware. The following describes the first modification in terms of differences from the first embodiment.

[0055] The configuration of a sparse multiplication calculation device 10 according to the first modification will be described with reference to FIG. When each functional component is realized by hardware, the sparse multiplication calculation device 10 includes an electronic circuit 15 instead of the processor 11, the memory 12, and the storage 13. The electronic circuit 15 is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13.

[0056] The electronic circuit 15 may be a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit 15, or each functional component may be distributed across multiple electronic circuits 15.

[0057] <Variation 2> As a second modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0058] The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0059] <Modification 3> In the first embodiment, a sparse multiplication calculation device 10 for a certain sparse value g generated in the processing inside the Miller function has been described. A function for performing a function for calculating the Miller function may be added to the sparse multiplication calculation device 10 described in the first embodiment to configure a Miller function calculation device 30 that calculates the Miller function.

[0060] The configuration of a Miller function calculating device 30 according to the third modification will be described with reference to FIG. The Miller function calculation device 30 includes a Miller function calculation unit 31 in addition to the functional components included in the sparse multiplication calculation device 10. The Miller function calculation unit 31 is realized by software or hardware, like the functional components included in the sparse multiplication calculation device 10. The Miller function calculation unit 31 uses the result of the sparse multiplication calculated by the sparse multiplication calculation device 10 to calculate the Miller function.

[0061] <Variation 4> In the modified example 3, a Miller function calculation device 30 that calculates the Miller function has been described. A function for calculating the final power in the pairing calculation may be added to the Miller function calculation device described in the modified example 3 to configure a pairing calculation device 40 that performs the pairing calculation.

[0062] The configuration of a pairing calculation device 40 according to the fourth modification will be described with reference to FIG. The pairing calculation device 40 includes a final power calculation unit 41 in addition to the functional components included in the Miller function calculation device 30. The final power calculation unit 41 is realized by software or hardware, like the functional components included in the Miller function calculation device 30. The final power calculation unit 41 performs the final power calculation in the pairing calculation.

[0063] Embodiment 2 In the first embodiment, a calculation method of sparse multiplication in the calculation of the Miller function of the pairing operation is described. In the second embodiment, a process using the result of the pairing operation obtained based on the method described in the first embodiment is described. In the second embodiment, the points different from the first embodiment are described, and the description of the same points is omitted.

[0064] ***Configuration Description*** The configuration of a cryptographic processing device 50 according to the second embodiment will be described with reference to FIG. The cryptographic processing device 50 includes a cryptographic processing unit 51 in addition to the functional components included in the pairing calculation device 40 according to Modification 4. The cryptographic processing unit 51 is realized by software or hardware, similar to the functional components included in the pairing calculation device 40.

[0065] ***Explanation of Operation*** The operation of the cryptographic processing device 50 according to the second embodiment will be described with reference to FIG. An operation procedure of the cryptographic processing device 50 according to the second embodiment corresponds to a cryptographic processing method according to the second embodiment. Moreover, a program for realizing the operation of the cryptographic processing device 50 according to the second embodiment corresponds to a cryptographic processing program according to the second embodiment.

[0066] (Step S81: Pairing Calculation Processing) The result of the pairing calculation is calculated by the functional components included in the pairing calculation device 40 according to the modification 4. The result of the pairing calculation is written to the memory 12.

[0067] (Step S82: Encryption process) The cryptographic processing unit 51 performs cryptographic processing using the result of the pairing calculation obtained in step S81. The cryptographic processing is cryptographic primitive processing such as encryption, decryption, signing, and verification. The encryption process is a process of converting data in a plaintext state into ciphertext in order to conceal the data from third parties. The decryption process is a process of converting the ciphertext converted by the encryption process into data in a plaintext state. The signature process is a process of generating a signature for at least one of detecting data tampering and verifying the origin of the data. The verification process is a process of at least one of detecting data tampering and verifying the origin of the data using the signature generated by the signature process.

[0068] For example, the cryptographic processing unit 51 may generate a message by decrypting the ciphertext using the result of a pairing operation in which an element of the ciphertext and an element of the decryption key are input.

[0069] ***Effects of the second embodiment*** As described above, the cryptographic processing device 50 according to the second embodiment realizes cryptographic processing using the functional components of the sparse multiplication calculation device 10 according to the first embodiment. By using the sparse multiplication calculation device 10 according to the first embodiment, it is possible to efficiently calculate the pairing operation. Therefore, the cryptographic processing device 50 according to the second embodiment can efficiently perform cryptographic processing.

[0070] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) A sparse multiplication calculation device for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation device calculating a sparse multiplication of a k-th order extension field, a decomposition unit for decomposing the k-th order extension field into a quadratic extension field and a cubic extension field; a sparse multiplication calculation unit that calculates sparse multiplication in the k-th order extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by the decomposition unit; 1. A sparse multiplication calculation device comprising: (Appendix 2) The sparse multiplication calculation unit calculates a sparse multiplication in the k-th order extension field by calculating a sparse multiplication in the quadratic extension field using a result of the sparse multiplication in the cubic extension field. 2. The sparse multiplication calculation apparatus of claim 1. (Appendix 3) the elliptic curve is a sextuplicate twisted curve having a sextuplicate twist, A finite field Fp that is a k-th order extension field k , w 2 -v is a polynomial ring Fp k / 2 [w] is an irreducible polynomial on Fp k / 2 Representation of polynomial ring Fp k =Fp k / 2 [w] / (w 2 -v), and the finite field Fp k / 2 v 3 -u is a polynomial ring Fp k / 6 [v] is an irreducible polynomial on Fp k / 6 Representation of polynomial ring Fp k / 2 =Fp k / 6 [v] / (v 3 -u), The decomposition unit decomposes the finite field Fp k , the quadratic extension field, finite field Fp k / 2 and the cubic extension field, finite field Fp k / 6 Decompose into 3. The sparse multiplication calculation apparatus of claim 2. (Appendix 4) The sparse multiplication calculation unit calculates sparse multiplication in the cubic extension field by formulating a linear equation for determining a coefficient of a polynomial in which the sparse multiplication in the cubic extension field is expressed by v, and solving the linear equation to determine the coefficient. 3. The sparse multiplication calculation apparatus of claim 2. (Appendix 5) The sparse multiplication calculation unit formulates the linear equations using four polynomials in which H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), and H3=f(-u)·g(-u), which are expressed using f(0), f(1), f(-1), f(-u), g(0), g(1), g(-1), and g(-u) with 0, 1, -1, and -u substituted for X, respectively, are associated with coefficients of a polynomial in which the sparse multiplication f*g is expressed by v. 5. The sparse multiplication calculation apparatus of claim 4. (Appendix 6) The embedding degree k is one of 6, 12, 18, 24, 30, 36, 42, and 48. 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 7) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding order k is 12, and the polynomial parameters are the polynomial t(x)=6x 2 +1, the polynomial r(x)=36x 4 -36x 3 +18x 2 -6x+1, the polynomial p(x)=36x 4 -36x 3 +24x 2 -6x+1 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 8) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ kIt is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding degree k is 12, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ 12 (x)=x 4 -x 2 +1, the polynomial p(x)=1 / 3(x-1) 2 r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 9) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding degree k is 12, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ 12 (x)=x 4 -x 2 +1, the polynomial p(x)=1 / 4(x-1) 2 (x 2 +1)r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 10) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding degree k is 24, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ 24 (x)=x 8 -x 4 +1, the polynomial p(x)=1 / 3(x-1) 2r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 11) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding degree k is 42, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ 42 (x)=x 12 +x 11 -x 9 -x 8 +x 6 -x 4 -x 3 +x+1, the polynomial p(x)=1 / 3(x-1) 2 (x 2 -x+1)r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 12) The elliptic curve is a cyclotomic polynomial Φ of degree d. k (x), polynomial T(x), polynomial h1(x), and polynomial h2(x) are used to express polynomial r(x)=Φ k It is expressed using polynomial parameters (T(x)) / h2(x), polynomial p(x)=h1(x)r(x)+T(x), and polynomial t(x)=T(x)+1, The embedding degree k is 48, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ 48 (x)=x 16 -x 8 +1, the polynomial p(x)=1 / 3(x-1) 2 r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5. (Appendix 13) A sparse multiplication calculation device according to any one of appendix 1 to 12, a Miller function calculation unit that calculates the Miller function using a result of the sparse multiplication of the k-th order extension field calculated by the sparse multiplication calculation device; A Miller function calculation device comprising: (Appendix 14) A Miller function calculation device according to claim 13; a final power calculation unit that performs a final power calculation in the pairing calculation; A pairing calculation device comprising: (Appendix 15) 15. A cryptographic processing device that performs cryptographic processing using a result of the pairing calculation calculated by the pairing calculation device according to claim 14. (Appendix 16) A sparse multiplication calculation method for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation method being a sparse multiplication calculation method for calculating a sparse multiplication of a k-th order extension field, A computer decomposes the k-th order extension field into a quadratic extension field and a cubic extension field; A sparse multiplication calculation method in which a computer calculates sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by decomposition, thereby calculating sparse multiplication in the k-th order extension field. (Appendix 17) A sparse multiplication calculation program for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation program being for calculating sparse multiplication of a k-th order extension field, A decomposition process for decomposing the k-th order extension field into a quadratic extension field and a cubic extension field; a sparse multiplication calculation process for calculating sparse multiplication in the k-th order extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by the decomposition process; A sparse multiplication calculation program that causes a computer to function as a sparse multiplication calculation device that performs the following:

[0071] In addition, the word "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0072] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0073] 10 sparse multiplication calculation device, 11 processor, 12 memory, 13 storage, 14 communication interface, 15 electronic circuit, 21 decomposition unit, 22 sparse multiplication calculation unit, 23 first calculation unit, 24 second calculation unit, 25 equation formulation unit, 26 solution finding unit, 30 Miller function calculation device, 31 Miller function calculation unit, 40 pairing calculation unit, 41 final power calculation unit, 50 encryption processing device, 51 encryption processing unit.

Claims

1. A sparse multiplication calculation device for calculating sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation device calculating sparse multiplication of a k-th order extension field, a decomposition unit for decomposing the k-th order extension field into a quadratic extension field and a cubic extension field; a sparse multiplication calculation unit that calculates sparse multiplication in the k-th order extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by the decomposition unit; 1. A sparse multiplication calculation device comprising:

2. The sparse multiplication calculation unit calculates a sparse multiplication in the k-th order extension field by calculating a sparse multiplication in the quadratic extension field using a result of the sparse multiplication in the cubic extension field.

2. The sparse multiplication calculation apparatus of claim 1.

3. the elliptic curve is a sextic twisted curve having a sextic twist, A finite field Fp which is a k-th order extension field ｋ Ha, w ２ -v is a polynomial ring Fp ｋ／２ [w] is an irreducible polynomial on Fp ｋ／２ Representation Fp of a polynomial ring when elements belong to ｋ = Fp ｋ／２ [w] / (w ２ −v), and the finite field Fp ｋ／２ , v ３ -u is a polynomial ring Fp ｋ／６ [v] is an irreducible polynomial on Fp ｋ／６ Representation Fp of a polynomial ring when elements belong to ｋ／２ = Fp ｋ／６ [v] / (v ３ -u), The decomposition unit decomposes the finite field Fp ｋ , the quadratic extension field, finite field Fp ｋ／２ and the cubic extension field, a finite field Fp ｋ／６ Decompose into 3. A sparse multiplication calculation apparatus as claimed in claim 2.

4. The sparse multiplication calculation unit calculates sparse multiplication in the cubic extension field by formulating a linear equation for determining a coefficient of a polynomial in which the sparse multiplication in the cubic extension field is expressed by v, and solving the linear equation to determine the coefficient.

3. A sparse multiplication calculation apparatus as claimed in claim 2.

5. The sparse multiplication calculation unit formulates the linear equation using four polynomials in which H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), and H3=f(-u)·g(-u), which are expressed using f(0), f(1), f(-1), f(-u), g(0), g(1), g(-1), and g(-u) with 0, 1, -1, and -u substituted for X, respectively, and a coefficient of a polynomial expressing the sparse multiplication f*g, is associated with each of the four polynomials.

5. A sparse multiplication calculation apparatus as claimed in claim 4.

6. The embedding degree k is one of 6, 12, 18, 24, 30, 36, 42, and 48.

6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

7. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding order k is 12, and the polynomial parameters are the polynomial t(x)=6x ２ +1, said polynomial r(x)=36x ４ -36x ３ +18x ２ -6x+1, the polynomial p(x)=36x ４ -36x ３ +24x ２ -6x+1 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

8. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding degree k is 12, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ １２ (x)=x ４ -x ２ +1, the polynomial p(x)=1 / 3(x-1) ２ r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

9. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding degree k is 12, and the polynomial parameter is the polynomial t(x) = x + 1, the polynomial r(x) = Φ １２ (x) = x ４ −x ２ + 1, the polynomial p(x) = 1 / 4(x − 1) ２ (x ２ + 1)r(x) + x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

10. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding degree k is 24, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ ２４ (x)=x ８ -x ４ +1, the polynomial p(x)=1 / 3(x-1) ２ r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

11. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding degree k is 42, and the polynomial parameters are the polynomial t(x) = x + 1, the polynomial r(x) = Φ ４２ (x) = x １２ + x １１ - x ９ - x ８ + x ６ - x ４ - x ３ + x + 1, and the polynomial p(x) = 1 / 3(x - 1) ２ (x ２ - x + 1)r(x) + x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

12. The elliptic curve is a cyclotomic polynomial Φ of degree d. ｋ (x) and polynomial T(x) and polynomial h １ (x) and polynomial h ２ (x) and the polynomial r(x)=Φ ｋ (T(x)) / h ２ (x) and polynomial p(x) = h １ (x) is expressed using polynomial parameters r(x)+T(x) and the polynomial t(x)=T(x)+1, The embedding degree k is 48, and the polynomial parameters are the polynomial t(x)=x+1, the polynomial r(x)=Φ ４８ (x)=x １６ -x ８ +1, the polynomial p(x)=1 / 3(x-1) ２ r(x)+x 6. A sparse multiplication calculation apparatus according to any one of claims 1 to 5.

13. 2. A sparse multiplication calculation device according to claim 1 ; a Miller function calculation unit that calculates the Miller function using a result of the sparse multiplication of the k-th order extension field calculated by the sparse multiplication calculation device; A Miller function calculation device comprising:

14. A Miller function calculation device according to claim 13; a final power calculation unit that performs a final power calculation in the pairing calculation; A pairing calculation device comprising:

15. A cryptographic processing device that performs cryptographic processing using a result of the pairing calculation calculated by the pairing calculation device according to claim 14.

16. A sparse multiplication calculation method for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation method being for calculating a sparse multiplication of a k-th order extension field, A computer decomposes the k-th order extension field into a quadratic extension field and a cubic extension field; A sparse multiplication calculation method in which a computer calculates sparse multiplication in each of a quadratic extension field and a cubic extension field obtained by decomposition, thereby calculating sparse multiplication in the k-th order extension field.

17. A sparse multiplication calculation program for calculating a sparse multiplication used in calculating a Miller function in a pairing operation on an elliptic curve expressed using an embedding degree k, the sparse multiplication calculation program being for calculating sparse multiplication of a k-th order extension field, A decomposition process for decomposing the k-th order extension field into a quadratic extension field and a cubic extension field; a sparse multiplication calculation process for calculating sparse multiplication in the k-th order extension field by calculating sparse multiplication in each of the quadratic extension field and the cubic extension field obtained by the decomposition process; A sparse multiplication calculation program that causes a computer to function as a sparse multiplication calculation device that performs the following:

Images