Processing device, acquisition method, and program

Abstract

This technology provides the ability to acquire appropriately used random rational points in a short processing time. [Solution] The processing device includes an acquisition unit. The acquisition unit acquires random rational points to be used, which are different from the rational points to be multiplied, based on a plurality of first rational points known to be located on the elliptic curve, for the purpose of randomizing the rational points to be multiplied in a scalar multiplication process in which a scalar multiplier is multiplied on the rational points to be multiplied on the elliptic curve defined on a finite field.

Description

[Technical Field]

[0001] This disclosure relates to a technique for obtaining random rational points on an elliptic curve. [Background technology]

[0002] Patent Document 1 discloses a technique for using random points on an elliptic curve as a countermeasure against side-channel attacks in a process of multiplying points on an elliptic curve by a scalar multiplier. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] International Publication No. 2006 / 077651 [Overview of the Initiative] [Problems that the invention aims to solve]

[0004] There is room for improvement in the technique for obtaining random points used in the process of multiplying points on an elliptic curve by a scalar multiplier.

[0005] This disclosure aims to provide a technology that enables the acquisition of appropriate random rational points in a short processing time. [Means for solving the problem]

[0006] One embodiment of the processing apparatus includes an acquisition unit. The acquisition unit acquires random rational points to be used, which are different from the rational points to be multiplied, based on a plurality of first rational points known to be located on the elliptic curve, for the purpose of randomizing the rational points to be multiplied in a scalar multiplication process in which a scalar multiplier is multiplied on the rational points to be multiplied.

[0007] One aspect of the acquisition method is an acquisition method in an apparatus. In a scalar multiplication process of multiplying a scalar multiplier to a rational point to be multiplied on an elliptic curve over a finite field, a usage random rational point different from the rational point to be multiplied is acquired based on a plurality of first rational points known to be located on the curve in order to randomize the rational point to be multiplied.

[0008] One aspect of the program is a program for causing a computer device to function as the acquisition unit that the above processing device has.

Advantages of the Invention

[0009] An appropriate usage random rational point can be acquired in a short processing time.

Brief Description of the Drawings

[0010] [Figure 1] It is a schematic diagram showing an example of the configuration of a processing device. [Figure 2] It is a schematic diagram showing an example of the algorithm of scalar multiplication processing. [Figure 3] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 4] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 5] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 6] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 7] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 8] It is a schematic diagram showing an example of the configuration of an acquisition unit. [Figure 9] It is a schematic diagram showing an example of the configuration of a system including a processing device. [Figure 10] It is a schematic diagram showing an example of the operation of a system including a processing device.

Embodiments for Carrying Out the Invention

[0011] Figure 1 is a schematic diagram showing an example of the configuration of the processing unit 1. The processing unit 1 is capable of performing scalar multiplication, which involves multiplying a scalar multiplier by a scalar multiplier on a rational point on an elliptic curve defined on a finite field used in elliptic curve cryptography. Furthermore, the processing unit 1 is capable of obtaining a random rational point (also called a random rational point used or a random rational point used for multiplication) that will be used in the scalar multiplication operation as the rational point to be multiplied.

[0012] As shown in Figure 1, the processing unit 1 comprises, for example, a processing unit 2, a storage unit 3, and a random number generator 4. The processing unit 1 can also be described as, for example, a computer device. Alternatively, the processing unit 1 can also be described as, for example, a processing circuit.

[0013] Random number generator 4 generates random numbers. Random number generator 4 can also be called a random number generation circuit. Random number generator 4 generates pseudorandom numbers using a hash function, for example. Random number generator 4 may generate pseudorandom numbers from data specific to processing unit 1 using a hash function, for example. Random number generator 4 inputs the generated random numbers to processing unit 2. Random number generator 4 outputs a different random number each time it outputs a random number, for example. Random number generator 4 may also generate true random numbers.

[0014] The processing unit 2 includes, for example, at least one processor 200. The at least one processor 200 in the processing unit 2 may include, for example, a CPU (Central Processing Unit). The processing unit 2 can also be described as, for example, a processing circuit.

[0015] The storage unit 3 includes, for example, a non-volatile memory 30 and a volatile memory 35. The non-volatile memory 30 and the volatile memory 35 can also be described as non-temporary recording media that can be read by the CPU of the processing unit 2. The non-volatile memory 30 may be, for example, a flash memory. The non-volatile memory 30 may be, for example, a NAND flash memory.

[0016] The volatile memory 35 functions as work memory for data processing by the processing unit 2. The volatile memory 35 may include, for example, SRAM (Static RAM) or DRAM (Dynamic RAM). RAM is an abbreviation for Random Access Memory.

[0017] The non-volatile memory 30 stores programs 31 that define the operation of the processing unit 2. Various functions of the processing unit 2 are realized, for example, when the CPU of the processing unit 2 executes programs 31.

[0018] The configuration of the processing unit 2 is not limited to the example above. For example, at least one processor 200 in the processing unit 2 may include multiple CPUs, or at least one DSP (Digital Signal Processor). Also, all or some of the functions of the processing unit 2 may be implemented by hardware circuits that do not require software to realize those functions. Furthermore, the storage unit 3 may include a small hard disk drive and an SSD (Solid State Drive), etc.

[0019] The processing unit 2 includes, for example, a scalar multiplication unit 20 and an acquisition unit 25 as functional blocks. The scalar multiplication unit 20 and the acquisition unit 25 are formed in the processing unit 2 by the CPU of the processing unit 2 executing program 31. Note that all or some of the functions of the scalar multiplication unit 20 may be implemented by hardware circuits that do not require software to implement those functions. The same applies to the acquisition unit 25.

[0020] The scalar multiplication unit 20 performs a scalar multiplication operation by multiplying the rational points to be multiplied on the elliptic curve defined on a finite field by a scalar multiplier. The acquisition unit 25 acquires the random rational points to be used in the scalar multiplication operation.

[0021] The elliptic curve used in the processing unit 1 (also called the elliptic curve used) can be expressed, for example, using the x and y coordinates of an affine coordinate system as follows (1):

[0022]

number

[0023] The elliptic curve represented by equation (1) is a Weierstrass-type elliptic curve defined over a finite field of characteristic p > 3. The rational points on the elliptic curve represented by equation (1) are integer points.

[0024] The scalar multiplier unit 20 performs a scalar multiplication operation by multiplying the rational point P on the elliptic curve used, represented by equation (1), by a scalar multiplier d (also called a scalar value d). The scalar multiplier d is set to be greater than or equal to 1 and less than the order of the rational point. The scalar multiplier d may be fixed or variable. The characteristic p, when expressed in binary, is set to a value of, for example, several tens to several hundreds of bits. The scalar multiplier d may be, for example, a random number.

[0025] Multiplication of a rational point P by a scalar multiplier d is also called scalar multiplication or scalar doubling. The result of multiplying the rational point P by a scalar multiplier d obtained in the scalar multiplication unit 20 is represented as the scalar multiplication point dP. The scalar multiplication point dP is also called the scalar multiplier value.

[0026] In elliptic curve cryptography, a scalar multiplier d is used as the secret key, and the scalar multiplication point dP is used as the public key, which is used for key sharing or digital signatures. ECDH is a well-known key exchange method using elliptic curves. ECDH is an abbreviation for Elliptic curve Diffie-Hellman key exchange. ECDSA is a well-known digital signature method using elliptic curves. ECDSA is an abbreviation for Elliptic Curve Digital Signature Algorithm. In elliptic curve cryptography, a rational point called the base point G, which is the starting point of the cryptographic process, may be used as the rational point P to be multiplied, or a rational point other than the base point G may be used as the rational point P to be multiplied.

[0027] The processing unit 1 may share keys with other devices using a scalar multiplier d and a scalar multiplication point dP. Furthermore, the processing unit 1 may perform digital signatures using a scalar multiplier d and a scalar multiplication point dP. Note that the scalar multiplication point dP may be used by other devices instead of the processing unit 1.

[0028] The acquisition unit 25 acquires a random rational point R used in the scalar multiplication process in the scalar multiplication unit 20 as a countermeasure against side-channel attacks. The random rational point R is a rational point different from the rational point P to be multiplied, used to randomize the rational points obtained during the scalar multiplication process and to conceal the calculation process of the scalar multiplication process. The scalar multiplication unit 20 performs the scalar multiplication process using the random rational point R on the elliptic curve acquired by the acquisition unit 25. In the scalar multiplication process, the rational point P to be multiplied is randomized based on the random rational point R. This reduces the possibility that the scalar multiplier d, which should be kept secret, can be recovered through a side-channel attack on the scalar multiplication process. The random rational point R can also be said to be a rational point used to randomize the rational point P to be multiplied.

[0029] Figure 2 is a schematic diagram showing an example of a scalar multiplication algorithm. The add-chain algorithm shown in Figure 2 is called BRIP and is one of the algorithms that performs scalar multiplication with side-channel attack resistance by using random rational points. In the example in Figure 2, the scalar multiplier d is represented as an I-bit binary number (where I is an integer greater than or equal to 1). Also, the bit value of the i-th bit from the bottom of the scalar multiplier d (where i is an integer greater than or equal to 0 and less than or equal to (I-1)) is d i This is represented as follows. The numbers 1 to 8 shown on the left side of Figure 2 indicate the execution step numbers.

[0030] In execution step 1, the scalar multiplication unit 20 receives the random rational point R to be used from the acquisition unit 25. Next, in execution step 2, the scalar multiplication unit 20 sets the parameters T[0], T[1], and T[2]. Specifically, the scalar multiplication unit 20 sets the random rational point R received from the acquisition unit 25 as the initial value for parameter T[0]. The value of parameter T[0] (i.e., the rational point) changes as it occurs during the execution of the scalar multiplication process. The scalar multiplication unit 20 also sets the inverse of the random rational point R to parameter T[1]. The inverse of the random rational point R can also be called a random rational point. Then, the scalar multiplication unit 20 sets the result of adding the rational point P to be multiplied and the inverse of the random rational point R to parameter T[2]. In other words, the scalar multiplication unit 20 sets the result of subtracting the random rational point R to be used from the rational point P to be multiplied to parameter T[2]. The result of adding the inverse of the rational point P to be multiplied and the random rational point R used can also be called a random rational point. The values ​​of parameters T[1] and T[2] (i.e., rational points) are fixed.

[0031] The addition of two rational points in scalar multiplication is performed by an operation on a finite field using the coordinates of those two rational points. As a result of the addition of the two rational points, the coordinates of the new rational point obtained by the addition of those two rational points are determined.

[0032] The scalar multiplication unit 20 sets the parameters T[0], T[1], and T[2], and then obtains the bit value di of the scalar multiplier d, expressed in binary, one bit at a time from the most significant to the least significant, and obtains the bit value d i Each time a value is obtained, the calculation process consisting of execution steps 4-6 is performed. The calculation process consisting of execution steps 4-6 randomizes the multiplicative rational point P based on the random rational point R used.

[0033] In execution step 4, the scalar multiplication unit 20 sets the parameter T[0] to a new value obtained by doubling the rational point currently set in parameter T[0]. After execution step 4, the scalar multiplication unit 20 returns the acquired bit value d I If is 0, in execution step 5, the result of adding the rational point currently set in parameter T[0] and the rational point (-R) set in parameter T[1] is newly set in parameter T[0]. Meanwhile, the scalar multiplication unit 20 takes the acquired bit value d I If the value is 1, in execution step 6, the result of adding the rational points currently set in parameter T[0] and the rational points (PR) set in parameter T[2] is newly set in parameter T[0].

[0034] The scalar multiplication unit 20 multiplies each bit value d of the I bit of the scalar multiplier d. i When the calculation process consisting of execution steps 4 to 6 is performed, the parameter T[0] is set to (dP+R). In execution step 8, the scalar multiplication unit 20 adds the rational point (dP+R) set in parameter T[0] and the rational point (-R) set in parameter T[1] to obtain the scalar multiplication point dP.

[0035] As can be understood from the above explanation, in scalar multiplication, the bit value d i Whether it is 0 or 1, the rational points of parameter T[0] are added together (in other words, doubled), and the rational points of parameter T[0] are added together with other rational points. As a result, the bit value d iThe power consumption of processing unit 2 when d is 0, and the bit value d i The difference in power consumption of processing unit 2 when is 1 is reduced. As a result, the likelihood of the scalar multiplier d, which should be kept secret, being recovered by an SPA (Simple Power Analysis) attack, a type of side-channel attack, is reduced.

[0036] Furthermore, in scalar multiplication, the variable parameter T[0] is always influenced by a random rational point R, and a random rational point is always assigned to the parameter T[0]. As a result, the rational point obtained during scalar multiplication is always a random rational point. Consequently, the likelihood of the secret scalar multiplier d being recovered by a DPA (Differential Power Analysis) attack, a type of side-channel attack, is reduced.

[0037] The elliptic curve used may be a Montgomery curve, a twisted Edwards curve, or any other elliptic curve.

[0038] <Example of the configuration of the acquisition unit> The acquisition unit 25 acquires a random rational point R that is different from the rational point P to be multiplied, based on a plurality of rational points known to be located on the elliptic curve used. For example, the acquisition unit 25 acquires a random rational point R that is different from the rational point P to be multiplied based on rational points S1 and S2 that are known to be located on the elliptic curve used. Hereafter, rational points that are known to be located on the elliptic curve used may be referred to as known rational points.

[0039] Figure 3 is a schematic diagram showing an example of the configuration of the acquisition unit 25. As shown in Figure 3, the acquisition unit 25 includes, for example, a selection unit 50, a comparison unit 51, a coordinate acquisition unit 52, a randomization unit 53, and a coordinate transformation unit 54.

[0040] The acquisition unit 25 receives a scalar multiplier d and the affine coordinates P(x,y) of the rational point P to be multiplied as input. The coordinate transformation unit 54 transforms the affine coordinates P(x,y) of the rational point P to be multiplied into projective coordinates P(X,Y,Z). At this time, the Z coordinate of the projective coordinates P(X,Y,Z) may be set to 1, for example, or to another value. In this example, the affine coordinates are represented by lowercase x and y coordinates, and the projective coordinates are represented by uppercase X, Y and Z coordinates. In this example, the projective coordinate system used by the processing unit 2 is projective coordinates, but it may also be Jacobian coordinates. In this case, the coordinate transformation unit 54 transforms the affine coordinates P(x,y) of the rational point P to be multiplied into Jacobian coordinates.

[0041] The projected coordinates P(X,Y,Z) of the rational point P to be multiplied, obtained by the coordinate transformation unit 54, are input to the scalar multiplication unit 20. The scalar multiplication unit 20 performs scalar multiplication using the projected coordinates P(X,Y,Z) of the rational point P to be multiplied.

[0042] The selection unit 50 selects one of the known rational points S1 and S2 based on the comparison result in the comparison unit 51. For example, the x-coordinate S1(x) of the affine coordinates of known rational point S1 and the x-coordinate S2(x) of the affine coordinates of known rational point S2 are input to the selection unit 50. The x-coordinates S1(x) and S2(x) are stored in advance in a non-volatile memory 30, for example. The selection unit 50 selects one of the known rational points S1 and S2 by selecting one of the x-coordinates S1(x) and S2(x) based on the comparison result in the comparison unit 51. Known rational point S1 is selected when x-coordinate S1(x) is selected, and known rational point S2 is selected when x-coordinate S2(x) is selected.

[0043] A known rational point S1 is, for example, the rational point with the smallest x-coordinate among the finite number of rational points (in other words, integer points) on the elliptic curve used, defined over a finite field. Therefore, the x-coordinate S1(x) of the known rational point S1 is the smallest x-coordinate among the finite number of rational points on the elliptic curve used.

[0044] A known rational point S2 is, for example, the rational point with the second smallest x-coordinate among the finite number of rational points on the elliptic curve used. Therefore, the x-coordinate S2(x) of the known rational point S2 is the second smallest x-coordinate among the finite number of rational points on the elliptic curve used.

[0045] The comparison unit 51 compares, for example, the x-coordinate S1(x) of the affine coordinates of a known rational point S1 with the x-coordinate P(x,y) of the affine coordinates P(x,y) of the rational point P to be multiplied, and determines whether the two are the same. If the comparison unit 51 determines that the x-coordinate S1(x) of the known rational point S1 and the x-coordinate P(x) of the rational point P to be multiplied do not match, the selection unit 50 selects the x-coordinate S1(x) to select the known rational point S1. In this case, the selected known rational point S1 is different from the rational point P to be multiplied. On the other hand, if the comparison unit 51 determines that the x-coordinate S1(x) of the known rational point S1 and the x-coordinate P(x) of the rational point P to be multiplied match, the selection unit 50 selects the x-coordinate S2(x) to select the known rational point S2. In this case, the selected known rational point S2 is different from the rational point P to be multiplied.

[0046] Hereafter, the x-coordinate S1(x) and the x-coordinate S2(x) selected by the selection unit 50 will be called the selected x-coordinate S(x). The selected x-coordinate S(x) is different from the x-coordinate P(x) of the rational point P to be multiplied. Also, the known rational point S1 and the known rational point S2 selected by the selection unit 50 will be called the selected known rational point S. The selected known rational point S is different from the rational point P to be multiplied.

[0047] The block consisting of the selection unit 50 and the comparison unit 51 can also be said to select a known rational point from a plurality of known rational points that is different from the rational point P to be multiplied. This selected known rational point becomes the selected known rational point S. The block consisting of the selection unit 50 and the comparison unit 51 compares the coordinate of one axis of the known rational point S1 (the x-coordinate in the above example) with the coordinate of the same axis of the rational point P to be multiplied. If the two coordinates are different, the block consisting of the selection unit 50 and the comparison unit 51 selects a known rational point S2 that is different from the known rational point S1 as a known rational point different from the rational point P to be multiplied.

[0048] The coordinate acquisition unit 52 uses the selected x-coordinate S(x) and the above-mentioned equation (1) to obtain the affine coordinate S(x,y) of the selected known rational point S (known rational point S1 or known rational point S2). Specifically, the coordinate acquisition unit 52 substitutes the selected x-coordinate S(x) into the variable x in equation (1) to find the y-coordinate that corresponds to the selected x-coordinate S(x). Since the y-coordinate that corresponds to the selected x-coordinate S(x) is the y-coordinate of the affine coordinate S(x,y) of the selected known rational point S, the affine coordinate S(x,y) of the selected known rational point S is obtained.

[0049] The comparison unit 51 may also compare x-coordinate S2(x) and x-coordinate P(x). In this case, if the comparison unit 51 determines that x-coordinate S2(x) and x-coordinate P(x) do not match, the selection unit 50 selects x-coordinate S2(x) to select a known rational point S2. On the other hand, if the comparison unit 51 determines that x-coordinate S2(x) and x-coordinate P(x) match, the selection unit 50 selects x-coordinate S1(x) to select a known rational point S1.

[0050] The randomization unit 53 randomizes the coordinates of the selected known rational point S based on the random number r generated by the random number generator 4, and obtains a first random rational point Ra to be used as the random rational point R for multiplication. It can also be said that the randomization unit 53 obtains the first random rational point Ra based on the random number r and the selected known rational point S. In this example, the random number r is an integer between 1 and (p-1).

[0051] The randomization unit 53 converts the affine coordinates S(x,y) of a selected known rational point S to projective coordinates S(X,Y,Z). At this time, the randomization unit 53 generates projective coordinates S(X,Y,Z) by setting the Z coordinate to a random number r. Projective coordinates with the Z coordinate set to a random number r are called randomized projective coordinates. The X and Y coordinates of the randomized projective coordinates become random numbers based on the random number r(Z coordinate). The process of converting affine coordinates to randomized projective coordinates is also called, for example, randomized projection transformation.

[0052] In this example, a selected known rational point S having randomized projected coordinates S(X,Y,Z), in other words, a selected known rational point S represented by randomized projected coordinates S(X,Y,Z), becomes the first random rational point Ra. Since the first random rational point Ra is used as the random rational point R, the selected known rational point S represented by randomized projected coordinates S(X,Y,Z) becomes the random rational point R. It can also be said that the randomization unit 53 obtains the first random rational point Ra represented by projected coordinates based on a random number r and the selected known rational point S represented by affine coordinates. The first random rational point Ra is obtained by randomizing the coordinate representation of the selected known rational point S.

[0053] The projected coordinates Ra(X,Y,Z) of the first random rational point Ra obtained by the randomization unit 53 (in other words, the randomized projected coordinates S(X,Y,Z)) are input to the scalar multiplication unit 20 as the projected coordinates R(X,Y,Z) of the random rational point R used. The scalar multiplication unit 20 performs scalar multiplication using the projected coordinates P(X,Y,Z) of the rational point P to be multiplied and the projected coordinates R(X,Y,Z) of the random rational point R used. The scalar multiplication unit 20 performs scalar multiplication using the rational points represented by projected coordinates.

[0054] The scalar multiplication unit 20 performs scalar multiplication multiple times, for example. At least one of the rational point P to be multiplied and the scalar multiplier d changes each time the scalar multiplication is performed. The acquisition unit 25 acquires a different first random rational point Ra for each scalar multiplication. The randomization unit 53 uses a different random number r for each scalar multiplication. This allows the scalar multiplication unit 20 to use a different random rational point R each time it performs a scalar multiplication. As a result, the possibility of the scalar multiplier d being recovered by a side-channel attack is reduced.

[0055] As shown in Figure 4, the selection unit 50 may be input with the y-coordinate S1(y) of the affine coordinates of a known rational point S1 and the y-coordinate S2(y) of the affine coordinates of a known rational point S2. In this case, the selection unit 50 selects one of the known rational points S1 and S2 by selecting either the y-coordinate S1(y) or S2(y). The y-coordinates S1(y) and S2(y) are stored in the non-volatile memory 30 beforehand.

[0056] In the example in Figure 4, the known rational point S1 may be, for example, the rational point with the smallest y-coordinate among the finite number of rational points on the elliptic curve used, defined over a finite field. In this case, the y-coordinate S1(y) of the known rational point S1 is the smallest y-coordinate among the finite number of rational points on the elliptic curve used. Similarly, the known rational point S2 may be the rational point with the second smallest y-coordinate among the finite number of rational points on the elliptic curve used. In this case, the y-coordinate S2(y) of the known rational point S2 is the second smallest y-coordinate among the finite number of rational points on the elliptic curve used.

[0057] In the example in Figure 4, the comparison unit 51 compares, for example, the y-coordinate S1(y) with the y-coordinate P(y) of the affine coordinate P(x,y) of the rational point P to be multiplied. If the comparison unit 51 determines that the y-coordinate S1(y) and the y-coordinate P(y) do not match, the selection unit 50 selects the y-coordinate S1(y) and selects the known rational point S1. On the other hand, if the comparison unit 51 determines that the y-coordinate S1(y) and the y-coordinate P(y) match, the selection unit 50 selects the y-coordinate S2(y) and selects the known rational point S2. The coordinate acquisition unit 52 substitutes the selected y-coordinate S(y) selected by the selection unit 50 from the y-coordinates S1(y) and S2(y) into the variable y in equation (1) to obtain the affine coordinate S(x,y) of the selected known rational point S.

[0058] In the example in Figure 4, the comparison unit 51 may compare the y-coordinate S2(y) with the y-coordinate P(y) of the rational point P to be multiplied. In this case, if the comparison unit 51 determines that the y-coordinate S2(y) and the y-coordinate P(y) do not match, the selection unit 50 selects the y-coordinate S2(y) to select the known rational point S2. On the other hand, if the comparison unit 51 determines that the y-coordinate S2(y) and the y-coordinate P(y) match, the selection unit 50 selects the y-coordinate S1(y) to select the known rational point S1.

[0059] As described above, in this example, the acquisition unit 25 acquires a random rational point R that is different from the rational point P to be multiplied, based on a plurality of rational points that are known to be located on the elliptic curve used.

[0060] Here, if the random rational point R used coincides with the rational point P to be multiplied, the parameter T[2] used in the scalar multiplication process will be set to a point at infinity. In this case, the scalar multiplication point dP cannot be properly determined in the scalar multiplication process.

[0061] In this example, since the random rational point R used is different from the rational point P to be multiplied, it is possible to avoid setting the parameter T[2] to a point at infinity. As a result, an appropriate random rational point R is obtained, and the scalar multiplication point dP is appropriately determined in the scalar multiplication process.

[0062] Furthermore, since the randomly selected rational point R is obtained based on multiple rational points known to be located on the elliptic curve used, the randomly selected rational point R can be obtained in a short processing time. For example, if we were to set the x-coordinate to a random number and try to find the y-coordinate using equation (1) in order to obtain the randomly selected rational point R, there is a possibility that a y-coordinate corresponding to the set x-coordinate cannot be found. In other words, there is a possibility that a rational point with the set x-coordinate does not exist on the elliptic curve. In this case, it may be necessary to repeatedly set the x-coordinate and calculate the y-coordinate. In contrast, in this example, since the randomly selected rational point R is obtained based on multiple rational points known to be located on the elliptic curve used, such repetitive processing does not occur, and the randomly selected rational point R can be obtained in a short processing time.

[0063] Furthermore, in this example, since the random rational point R used is obtained based on a known rational point different from the rational point P to be multiplied, it is easy to obtain a random rational point R that is different from the rational point P to be multiplied. Also, since the random rational point R used is obtained based on multiple rational points known to be located on the elliptic curve used, it is easy to obtain a random rational point R that is different from the rational point P to be multiplied.

[0064] In this example, the acquisition unit 25 compares the coordinate of one axis (x-coordinate or y-coordinate) of a known rational point with the coordinate of the same axis of the rational point P to be multiplied. If the two coordinates are different, the unit selects the known rational point as a known rational point different from the rational point P to be multiplied. In this way, by selecting a known rational point different from the rational point P to be multiplied by comparing the coordinates of one axis, the process of selecting a known rational point different from the rational point P to be multiplied can be simplified.

[0065] Furthermore, in this example, if the coordinate of one axis of a known rational point matches the coordinate of the same axis of the rational point P to be multiplied, the acquisition unit 25 selects a known rational point different from the one mentioned above as a known rational point different from the rational point P to be multiplied. This eliminates the need to compare coordinates when the coordinate of one axis of a known rational point matches the coordinate of the same axis of the rational point P to be multiplied, thus simplifying the process of selecting a known rational point different from the rational point P to be multiplied.

[0066] Furthermore, in this example, among the finite number of rational points on the elliptic curve defined on the finite field, the rational point S1 with the smallest coordinate on one axis (x or y coordinate) and the rational point S2 with the second smallest coordinate on that axis are used. This reduces the storage area in the non-volatile memory 30 for the coordinates on one axis of the known rational points S1 and S2. However, this does not apply to the known rational points used to obtain the random rational point R.

[0067] The scalar multiplication unit 20 may use the arithmetic functions used in scalar multiplication to obtain the affine coordinates S(x,y) of a selected known rational point S based on the selected x-coordinate S(x) or selected y-coordinate S(y). In this case, the scalar multiplication unit 20 functions as the coordinate acquisition unit 52.

[0068] Alternatively, the affine coordinates of known rational points S1 and S2 may be stored in the non-volatile memory 30 beforehand. In this case, the coordinate acquisition unit 52 may read the y coordinate paired with the selected x coordinate S(x), or the x coordinate paired with the selected y coordinate S(y), from the non-volatile memory 30 to obtain the affine coordinate S(x,y) of the selected known rational point S. In this case, the calculation using equation (1) in the coordinate acquisition unit 52 becomes unnecessary.

[0069] Furthermore, the acquisition unit 25 may select a known rational point from three or more known rational points that is different from the rational point P to be multiplied. Figure 5 is a schematic diagram showing an example of the configuration of the acquisition unit 25 in this case. In the example in Figure 5, the selection unit 50 is input with the x-coordinate S1(x) of the known rational point S1, the x-coordinate S2(x) of the known rational point S2, the x-coordinate S3(x) of the known rational point S3, and the x-coordinate S4(x) of the known rational point S4. The x-coordinates S1(x), S2(x), S3(x), and S4(x) are stored in the non-volatile memory 30 beforehand. The comparison unit 51 compares, for example, the x-coordinate S1(x) of the known rational point S1 with the x-coordinate P(x) of the rational point P to be multiplied. If the comparison unit 51 determines that the two coordinates are different, the selection unit 50 selects the x-coordinate S1(x) and selects the known rational point S1. On the other hand, if the comparison unit 51 determines that both coordinates match, the selection unit 50 selects an x-coordinate from among x-coordinates S2(x), S3(x), and S4(x) that is different from x-coordinate S1(x), and selects a known rational point from among known rational points S1, S2, and S3 that is different from known rational point S1. In other words, the selection unit 50 selects one of the known rational points S2, S3, and S4. For example, each time the selection unit 50 determines that x-coordinate S1(x) and x-coordinate P(x) match, it may sequentially select one of the known rational points S2, S3, and S4.

[0070] <Other configuration examples for the acquisition unit> <Another example from the first point> Figure 6 is a schematic diagram showing another configuration example of the acquisition unit 25. The acquisition unit 25 shown in Figure 6 (also called acquisition unit 25A) is the acquisition unit 25 shown in Figure 3, further equipped with a selection unit 60, a comparison unit 61, a coordinate transformation unit 62, and a selection unit 63. The acquisition unit 25A acquires the random rational points R to be used based on multiple rational points obtained during the scalar multiplication process in the scalar multiplication unit 20 and multiple known rational points. Hereafter, rational points obtained during the scalar multiplication process may be called intermediate result rational points.

[0071] For example, the acquisition unit 25A, similar to the acquisition unit 25 described above, acquires a first random rational point Ra based on a plurality of known rational points. Then, the acquisition unit 25A acquires a random rational point R to be used based on the first random rational point Ra and a plurality of intermediate rational points. For example, the acquisition unit 25A selects an intermediate rational point that is different from the rational point P to be multiplied from a plurality of intermediate rational points obtained during the scalar multiplication process. Then, the acquisition unit 25A uses either the intermediate rational point that is different from the rational point to be multiplied, or the first random rational point Ra, as the random rational point R to be used in the next scalar multiplication process.

[0072] The selection unit 60 selects one of several different rational intermediate result points based on the comparison results from the comparison unit 61. The projection coordinates of the multiple rational intermediate result points are input to the selection unit 60. The selection unit 60 selects one of the multiple rational intermediate result points by selecting one of the projection coordinates of the multiple rational intermediate result points.

[0073] The selection unit 60 receives, for example, the projected coordinates M1(X,Y,Z) of an intermediate rational point M1 and the projected coordinates M2(X,Y,Z) of an intermediate rational point M2 that is different from the intermediate rational point M1. The projected coordinates M1(X,Y,Z) and M2(X,Y,Z) are obtained during the scalar multiplication process.

[0074] Intermediate result rational points M1 and M2 may be rational points set in parameter T[0] during the scalar multiplication process. Intermediate result rational point M1 may, for example, be a rational point set in parameter T[0] immediately before the end of the scalar multiplication process. In this case, intermediate result rational point M1 will be (dP+R). Intermediate result rational point M2 may, for example, be a rational point different from (dP+R) that is set in parameter T[0] during the scalar multiplication process. Since the rational points set in parameter T[0] are random rational points, intermediate result rational points M1 and M2 will be random rational points.

[0075] The selection unit 60 selects either the projected coordinates M1(X,Y,Z) of the intermediate rational point M1 or the projected coordinates M2(X,Y,Z) of the intermediate rational point M2, based on the comparison result in the comparison unit 61. If projected coordinates M1(X,Y,Z) are selected, the intermediate rational point M1 is selected; if projected coordinates M2(X,Y,Z) are selected, the intermediate rational point M2 is selected.

[0076] The coordinate transformation unit 62 transforms, for example, the projected coordinates M1(X,Y,Z) of the intermediate rational point M1 into affine coordinates M1(x,y). The comparison unit 61 compares the x-coordinate M1(x) of the affine coordinates M1(x,y) obtained by the coordinate transformation unit 62 with the x-coordinate P(x) of the rational point P to be multiplied, and determines whether the two are the same.

[0077] If the comparison unit 61 determines that the x-coordinate M1(x) of the intermediate result rational point M1 does not match the x-coordinate P(x) of the rational point P to be multiplied, the selection unit 60 selects the intermediate result rational point M1 by selecting the projected coordinate M1(X,Y,Z). In this case, the selected intermediate result rational point M1 is different from the rational point P to be multiplied. On the other hand, if the comparison unit 61 determines that the x-coordinate M1(x) of the intermediate result rational point M1 matches the x-coordinate P(x) of the rational point P to be multiplied, the selection unit 60 selects the intermediate result rational point M2 by selecting the projected coordinate M2(X,Y,Z). In this case, the selected intermediate result rational point M2 is different from the rational point P to be multiplied.

[0078] Hereafter, the projection coordinate M1(X,Y,Z) and the projection coordinate M2(X,Y,Z) selected by the selection unit 60 will be called the selected projection coordinate M(X,Y,Z). Also, the intermediate rational point M1 and M2 selected by the selection unit 60 will be called the selected intermediate rational point M. The selected intermediate rational point M is different from the multiplicative rational point P.

[0079] The selection unit 63 selects either the selected intermediate rational point M or the first random rational point Ra obtained by the randomization unit 53 as the random rational point R to be used. The selection unit 63 is input with the projected coordinates M(X,Y,Z) of the selected intermediate rational point M and the projected coordinates R(X,Y,Z) of the first random rational point Ra. The selection unit 63 selects the selected intermediate rational point M as the random rational point R by selecting the projected coordinates M(X,Y,Z) of the selected intermediate rational point M. The selected projected coordinates M(X,Y,Z) are input to the scalar multiplication unit 20 as the projected coordinates R(X,Y,Z) of the random rational point R to be used. The selection unit 63 also selects the first random rational point Ra as the random rational point R by selecting the projected coordinates Ra(X,Y,Z) of the first random rational point Ra. The selected projection coordinates Ra(X,Y,Z) are input to the scalar multiplication unit 20 as the projection coordinates R(X,Y,Z) of the randomly used rational point R.

[0080] When the scalar multiplication process is performed for the first time after the power supply to the processing unit 1 is turned on, no intermediate rational points can be obtained. Therefore, the selection unit 63 selects the first random rational point Ra, obtained based on a plurality of known rational points, as the random rational point R to be used in the initial scalar multiplication process. The scalar multiplication unit 20 uses the first random rational point Ra as the random rational point R in the initial scalar multiplication process.

[0081] After the initial scalar multiplication process is performed, the selection unit 60 selects either the intermediate rational point M1 or M2 obtained in the most recent scalar multiplication process. Then, the selection unit 63 selects either the selected intermediate rational point M or the first random rational point Ra obtained by the randomization unit 53 as the random rational point R to be used in the next scalar multiplication process.

[0082] After the initial scalar multiplication process is performed, the selection unit 63 may, for example, alternately select the selected intermediate result rational point M and the first random rational point Ra as the random rational point R to be used in the next scalar multiplication process. Also, if the random number generator 4 becomes inoperable due to an external attack on the processing unit 1, and the randomization unit 53 is unable to generate the first random rational point Ra (for example, if the first random rational point Ra stops changing), the selection unit 63 may select the selected intermediate result rational point M as the random rational point R to be used.

[0083] Furthermore, three or more intermediate rational points may be used to obtain the random rational point R to be used. In this case, the projection coordinates of the three or more intermediate rational points are input to the selection unit 60. Then, similar to how the selection unit 50 in Figure 5 above selects one of the three or more known rational points by selecting one of the x-coordinates of the three or more known rational points, the selection unit 60 selects one of the three or more intermediate rational points by selecting one of the projection coordinates of the three or more intermediate rational points. Also, in this example, as in the example in Figure 5, the selection unit 50 may select one of the three or more known rational points.

[0084] Thus, the acquisition unit 25A in this example acquires the random rational points R to be used based on a plurality of known rational points and a plurality of intermediate result rational points obtained during the scalar multiplication process, and can stably supply the random rational points R to the scalar multiplication unit 20.

[0085] The comparison unit 61 may also compare the y-coordinate M1(y) of the affine coordinate M1(x,y) obtained by the coordinate transformation unit 62 with the y-coordinate P(y) of the rational point P to be multiplied. In this case, if the comparison unit 61 determines that the y-coordinate M1(y) and the y-coordinate P(y) do not match, the selection unit 60 selects the projected coordinate M1(X,Y,Z) to select the intermediate rational point M1. On the other hand, if the comparison unit 61 determines that the y-coordinate M1(y) and the y-coordinate P(y) match, the selection unit 60 selects the projected coordinate M2(X,Y,Z) to select the intermediate rational point M2.

[0086] Furthermore, the coordinate transformation unit 62 may transform the projected coordinates M2(X,Y,Z) of the intermediate rational point M2 into affine coordinates M2(x,y). In this case, the comparison unit 61 may compare the x-coordinate M2(x) of the affine coordinates M2(x,y) obtained by the coordinate transformation unit 62 with the x-coordinate P(x) of the rational point P to be multiplied. If the comparison unit 61 determines that the x-coordinates M2(x) and P(x) do not match, the selection unit 60 selects the projected coordinates M2(X,Y,Z) to select the intermediate rational point M2. On the other hand, if the comparison unit 61 determines that the x-coordinates M2(x) and P(x) match, the selection unit 60 selects the projected coordinates M1(X,Y,Z) to select the intermediate rational point M1. Alternatively, the comparison unit 61 may compare the y-coordinate M2(y) of the affine coordinate M2(x,y) with the y-coordinate P(y) of the rational point P to be multiplied. In this case, if the comparison unit 61 determines that the y-coordinate M2(y) and the y-coordinate P(y) do not match, the selection unit 60 selects the projected coordinate M2(X,Y,Z) to select the intermediate rational point M2. On the other hand, if the comparison unit 61 determines that the y-coordinate M2(y) and the y-coordinate P(y) match, the selection unit 60 selects the projected coordinate M1(X,Y,Z) to select the intermediate rational point M1.

[0087] <Another example, part 2> Figure 7 is a schematic diagram showing another configuration example of the acquisition unit 25. The acquisition unit 25 shown in Figure 7 (also called acquisition unit 25B) is the same as the acquisition unit 25 shown in Figure 3, but with the addition of a coordinate transformation unit 70, a selection unit 71, a selection unit 72, and a comparison unit 73, and the addition of a coordinate acquisition unit 74 and a randomization unit 75 instead of the coordinate acquisition unit 52 and randomization unit 53.

[0088] The acquisition unit 25B, similar to the acquisition unit 25A described above, acquires a random rational point R to be used based on a plurality of intermediate rational points obtained during the scalar multiplication process in the scalar multiplication unit 20 and a plurality of known rational points. For example, the acquisition unit 25B selects a known rational point from the plurality of known rational points that is different from the rational point P to be multiplied. For example, the acquisition unit 25B selects a known rational point from known rational points S1 and S2 that is different from the rational point P to be multiplied. Also, the acquisition unit 25B selects an intermediate rational point from a plurality of intermediate rational points obtained during the scalar multiplication process that is different from the rational point P to be multiplied. For example, the acquisition unit 25B selects an intermediate rational point from intermediate rational points M1 and M2 that is different from the rational point P to be multiplied. Then, the acquisition unit 25A acquires a random rational point R to be used based on a known rational point that is different from the rational point P to be multiplied, and an intermediate result rational point that is different from the rational point P to be multiplied.

[0089] The coordinate transformation unit 70 receives, for example, the projected coordinates M1(X,Y,Z) of an intermediate rational point M1 and the projected coordinates M2(X,Y,Z) of an intermediate rational point M2 as input. The coordinate transformation unit 70 transforms the projected coordinates M1(X,Y,Z) into affine coordinates M1(x,y) and the projected coordinates M2(X,Y,Z) into affine coordinates M2(x,y). The affine coordinates M1(x,y) of the intermediate rational point M1 and the affine coordinates M2(x,y) of the intermediate rational point M2 are stored in the non-volatile memory 30. As a result, the non-volatile memory 30 stores the intermediate rational points M1 and M2 along with the known rational points S1 and S2. Each time a scalar multiplication operation is performed, the non-volatile memory 30 is overwritten with the intermediate rational points M1 and M2 obtained from that scalar multiplication operation.

[0090] The selection unit 71 receives, for example, the x-coordinate M1(x) of the affine coordinate M1(x,y) stored in the non-volatile memory 30, and the x-coordinate M2(x) of the affine coordinate M2(x,y) stored in the non-volatile memory 30. The selection unit 71 selects one of the rational intermediate point M1 or M2 by selecting either the x-coordinate M1(x) or M2(x). If the x-coordinate M1(x) is selected, the rational intermediate point M1 is selected, and if the x-coordinate M2(x) is selected, the rational intermediate point M2 is selected.

[0091] The comparison unit 73, for example, compares the x-coordinate M1(x) of the affine coordinate M1(x,y) stored in the non-volatile memory 30 with the x-coordinate P(x) of the rational point P to be multiplied, and determines whether the two are the same.

[0092] If the comparison unit 73 determines that the x-coordinate M1(x) of the intermediate result rational point M1 does not match the x-coordinate P(x) of the rational point P to be multiplied, the selection unit 71 selects the intermediate result rational point M1 by selecting the x-coordinate M1(x). On the other hand, if the comparison unit 73 determines that the x-coordinate M1(x) of the intermediate result rational point M1 matches the x-coordinate P(x) of the rational point P to be multiplied, the selection unit 71 selects the intermediate result rational point M2 by selecting the x-coordinate M2(x).

[0093] Hereafter, the x-coordinate M1(x) and the x-coordinate M2(x) selected by the selection unit 71 will be called the selected x-coordinate M(x). Also, in this example, the intermediate rational point M1 and the intermediate rational point M2 selected by the selection unit 71 will be called the selected intermediate rational point M. The selected intermediate rational point M is different from the rational point P to be multiplied.

[0094] The selection unit 72 selects either the rational point M of the intermediate selection result or the rational point S of the selected known result selected by the selection unit 50. For example, the selection unit 72 selects either the rational point M of the intermediate selection result or the rational point S of the selected known result selected by the selection unit 71 by selecting either the selected x-coordinate S(x) selected by the selection unit 50 or the selected x-coordinate M(x) selected by the selection unit 71. The selection unit 72 selects the rational point S of the selected known result selected by selecting the x-coordinate S(x), and selects the rational point M of the intermediate selection result selected by selecting the x-coordinate M(x).

[0095] Hereafter, the x-coordinate S(x) and the x-coordinate M(x) selected by the selection unit 72 will be called the selected x-coordinate T(x). Also, the selected rational point T is the one selected by the selection unit 72 from the selected intermediate rational point M and the selected known rational point S. The selected rational point T is different from the rational point P to be multiplied.

[0096] The coordinate acquisition unit 74 acquires the affine coordinates T(x,y) of the selected rational point T using the selected x-coordinate T(x) and equation (1) described above, similar to how the coordinate acquisition unit 52 acquires the affine coordinates S(x,y).

[0097] The randomization unit 75 randomizes the coordinates of the selected rational point T based on the random number r generated by the random number generator 4, and obtains a random rational point R for multiplication. It can also be said that the randomization unit 75 obtains a random rational point R for multiplication based on the random number r and the selected rational point T.

[0098] The randomization unit 75 converts the affine coordinates T(x,y) of the selected rational point T to projective coordinates T(X,Y,Z). At this time, the randomization unit 75 generates randomized projective coordinates T(X,Y,Z) by setting the Z coordinate to a random number r. In this example, the selected rational point T represented by the randomized projective coordinates T(X,Y,Z) is used as the randomly selected rational point R. The projective coordinates R(X,Y,Z) of the randomly selected rational point R coincide with the randomized projective coordinates T(X,Y,Z).

[0099] If the selected rational point T is the selected known rational point S, then the randomized projected coordinates S(X,Y,Z) of the selected known rational point S become the randomized projected coordinates T(X,Y,Z). Therefore, the randomly used rational point R obtained by the randomization unit 75 coincides with the first randomly used rational point Ra obtained by the randomization unit 53.

[0100] On the other hand, if the selected rational point T is an intermediate result rational point M, the randomized projected coordinates of the intermediate result rational point M become the randomized projected coordinates T(X,Y,Z). Therefore, the used random rational point R obtained by the randomization unit 75 is the selected intermediate result rational point M expressed in randomized projected coordinates. Since the projected coordinates M1(X,Y,Z) and M2(X,Y,Z) output from the scalar multiplication unit 20 are coordinates based on the previous random number r, the projected coordinates R(X,Y,Z) of the used random rational point R (in other words, the randomized projected coordinates T(X,Y,Z)) are different from the projected coordinates M1(X,Y,Z) and M2(X,Y,Z).

[0101] When the scalar multiplication process is performed for the first time after the power to the processing unit 1 is turned on, no intermediate rational points can be obtained. Therefore, the selection unit 72 selects a known rational point S that is different from the rational point P to be multiplied. In this case, the random rational point R used in the first scalar multiplication process coincides with the first random rational point Ra.

[0102] After the initial scalar multiplication operation is performed, the selection unit 71 selects either the intermediate result rational point M1 or M2 obtained in the most recent scalar multiplication operation. Then, the selection unit 72 selects either the selected intermediate result rational point M or the selected known rational point S selected by the selection unit 50. When the selection unit 72 selects the selected intermediate result rational point M, the random rational point R to be used becomes the selected intermediate result rational point M represented in randomized projected coordinates. The selection unit 63 may, for example, alternately select the selected intermediate result rational point M and the selected known rational point S. Furthermore, if the random number generator 4 stops functioning due to an external attack on the processing unit 1 and the random number r stops changing, the selection unit 72 may select the selected intermediate result rational point M. This makes it possible to stably supply the random rational point R to be used to the scalar multiplication unit 20.

[0103] In this example as well, three or more intermediate rational points may be used to obtain the random rational point R to be used. In this case, the affine coordinates of the three or more intermediate rational points are stored in the non-volatile memory 30. For example, the x-coordinates of the affine coordinates of the three or more intermediate rational points stored in the non-volatile memory 30 are input to the selection unit 71. The selection unit 71 selects one of the three or more intermediate rational points by selecting one of the x-coordinates of the three or more intermediate rational points, similar to the selection unit 50 in Figure 5 above.

[0104] Furthermore, in this example as well, similar to the example in Figure 5, three or more known rational points may be used to obtain the random rational point R to be used.

[0105] Furthermore, in the example shown in Figure 7, the selection units 50 and 72 select a rational point by selecting its x-coordinate. However, as shown in the selection unit 50 in Figure 4, the rational point may also be selected by selecting its y-coordinate.

[0106] Thus, in this example, since the non-volatile memory 30 stores multiple known rational points and multiple intermediate result rational points, even if the power supply of the processing unit 1 is temporarily turned off, the acquisition unit 25B can acquire the random rational points R to be used based on the multiple known rational points and multiple intermediate result rational points in the non-volatile memory 30.

[0107] Figure 8 is a schematic diagram showing another configuration example of the acquisition unit 25. The acquisition unit 25 shown in Figure 8 (also called the acquisition unit 25C) is the same as the acquisition unit 25A shown in Figure 6, but with the addition of a selection unit 80, a comparison unit 81, a coordinate transformation unit 82, and a calculation unit 83, and a selection unit 84 instead of the selection unit 63.

[0108] The acquisition unit 25C calculates a plurality of second random rational points by combining at least a portion of the plurality of intermediate result rational points obtained during the scalar multiplication process with a first random rational point Ra obtained based on a plurality of known rational points. Then, the acquisition unit 25C selects a second random rational point from the plurality of second random rational points that is different from the rational point P to be multiplied. Then, the acquisition unit 25C obtains a random rational point R to be used based on the second random rational point that is different from the rational point P to be multiplied, the first random rational point Ra, and the intermediate result rational point that is different from the rational point P to be multiplied.

[0109] The calculation unit 83 calculates between the intermediate result rational point and the first random rational point Ra obtained by the randomization unit 53 to obtain a second random rational point that is different from the intermediate result rational point and the first random rational point Ra. For example, the calculation unit 83 calculates between the intermediate result rational point M1 and the first random rational point Ra to obtain the second random rational point Rb1. The calculation unit 83 also calculates between the intermediate result rational point M2 and the first random rational point Ra to obtain the second random rational point Rb2.

[0110] The calculation unit 83, for example, adds the intermediate result rational point M1 and the first random rational point Ra, and takes the result of this addition as the second random rational point Rb1. The calculation unit 83, for example, uses the projected coordinates M1(X,Y,Z) of the intermediate result rational point M1 and the projected coordinates Ra(X,Y,Z) of the first random rational point Ra to obtain the projected coordinates Rb1(X,Y,Z) of the second random rational point Rb1. However, the calculation method for the intermediate result rational point M1 and the first random rational point Ra to obtain the second random rational point Rb1 is not limited to this.

[0111] Furthermore, the calculation unit 83 adds, for example, the intermediate result rational point M2 and the first random rational point Ra, and the result of this addition is set to the second random rational point Rb2. The calculation unit 83 obtains the projected coordinates Rb2(X,Y,Z) of the second random rational point Rb2 using, for example, the projected coordinates M2(X,Y,Z) of the intermediate result rational point M2 and the projected coordinates Ra(X,Y,Z) of the first random rational point Ra. However, the method of calculation between the intermediate result rational point M2 and the first random rational point Ra to obtain the second random rational point Rb2 is not limited to this.

[0112] The selection unit 80 selects one of the second random rational points Rb1 and Rb2 based on the comparison result in the comparison unit 81. The selection unit 80 is input with the projected coordinates Rb1(X,Y,Z) of the second random rational point Rb1 and the projected coordinates Rb2(X,Y,Z) of the second random rational point Rb2. The selection unit 80 selects one of the second random rational points Rb1 and Rb2 by selecting either the projected coordinates Rb1(X,Y,Z) or Rb2(X,Y,Z). If the projected coordinates Rb1(X,Y,Z) are selected, the second random rational point Rb1 is selected, and if the projected coordinates Rb2(X,Y,Z) are selected, the second random rational point Rb2 is selected.

[0113] The coordinate transformation unit 82 transforms, for example, the projected coordinates Rb1(X,Y,Z) of the second random rational point Rb1 into affine coordinates Rb1(x,y). The comparison unit 81 compares the x-coordinate Rb1(x) of the affine coordinates Rb1(x,y) obtained by the coordinate transformation unit 62 with the x-coordinate P(x) of the rational point P to be multiplied, and determines whether the two are the same.

[0114] If the comparison unit 81 determines that the x-coordinate Rb1(x) of the second random rational point Rb1 does not match the x-coordinate P(x) of the rational point P to be multiplied, the selection unit 80 selects the second random rational point Rb1 by selecting the projected coordinates Rb1(X,Y,Z). On the other hand, if the comparison unit 81 determines that the x-coordinates Rb1(x) and P(x) match, the selection unit 80 selects the second random rational point Rb2 by selecting the projected coordinates Rb2(X,Y,Z).

[0115] Hereafter, the projection coordinate Rb1(X,Y,Z) and the projection coordinate Rb2(X,Y,Z) selected by the selection unit 80 will be called the selected projection coordinate Rb(X,Y,Z). Also, the second random rational point Rb1 and Rb2 selected by the selection unit 80 will be called the selected second random rational point Rb. The selected second random rational point Rb is different from the rational point P to be multiplied.

[0116] The selection unit 84 selects one of the following as the randomly generated rational point R to be used: the intermediate rational point M selected by the selection unit 60, the second randomly generated rational point Rb selected by the selection unit 80, and the first randomly generated rational point Ra obtained by the randomization unit 53.

[0117] The selection unit 84 receives the selected projection coordinates M(X,Y,Z), the selected projection coordinates Rb(X,Y,Z), and the projection coordinates Ra(X,Y,Z) of the first random rational point Ra as input. By selecting the selected projection coordinates M(X,Y,Z), the selection unit 84 selects the intermediate result rational point M as the random rational point R to be used. The selected projection coordinates M(X,Y,Z) selected by the selection unit 84 are input to the scalar multiplication unit 20 as the projection coordinates R(X,Y,Z) of the random rational point R to be used. The selection unit 84 also selects the selected projection coordinates Rb(X,Y,Z) to select the second random rational point Rb as the random rational point R to be used. The selected projection coordinates Rb(X,Y,Z) selected by the selection unit 84 are input to the scalar multiplication unit 20 as the projection coordinates R(X,Y,Z) of the random rational point R to be used. Furthermore, the selection unit 84 selects the first random rational point Ra as the random rational point R by selecting the projection coordinates Ra(X,Y,Z) of the first random rational point Ra. The projection coordinates Ra(X,Y,Z) selected by the selection unit 84 are input to the scalar multiplication unit 20 as the projection coordinates R(X,Y,Z) of the random rational point R used.

[0118] When the scalar multiplication process is performed for the first time after the power to the processing unit 1 is turned on, no intermediate rational points can be obtained. Therefore, the selection unit 84 selects the first random rational point Ra, obtained based on a plurality of known rational points, as the random rational point R to be used in the initial scalar multiplication process. The scalar multiplication unit 20 uses the first random rational point Ra as the random rational point R in the initial scalar multiplication process.

[0119] After the initial scalar multiplication operation is performed, the selection unit 60 selects one of the intermediate rational points M1 and M2 (also called the most recent intermediate rational points M1 and M2) obtained in the most recent scalar multiplication operation. The calculation unit 83 then calculates the second random rational points Rb1 and Rb2 by combining each of the most recent intermediate rational points M1 and M2 with the first random rational point Ra obtained by the randomization unit 53. The selection unit 80 selects one of the second random rational points Rb1 and Rb2. Then, the selection unit 84 selects one of the selected intermediate rational point M, the selected second random rational point Rb, and the first random rational point Ra as the random rational point R to be used in the next scalar multiplication operation.

[0120] After the initial scalar multiplication process is performed, the selection unit 84 may, for example, select the selected intermediate result rational point M, the selected second random rational point Rb, and the first random rational point Ra in order as the random rational point R to be used in the next scalar multiplication process.

[0121] Furthermore, if the selected intermediate rational point M becomes an infinity point, for example, by setting the scalar multiplier d to a value greater than or equal to the order of the scalar multiplication unit 84, and the selected intermediate rational point M is selected, then the infinity point will be used as the random rational point R in the scalar multiplication process. In this case, countermeasures against side-channel attacks will be rendered ineffective. On the other hand, even if the intermediate rational point M1 becomes an infinity point, the second random rational point Rb1 obtained by the operation between the intermediate rational point M1 and the first random rational point Ra will be less likely to be an infinity point. Similarly, even if the intermediate rational point M2 becomes an infinity point, the second random rational point Rb2 obtained by the operation between the intermediate rational point M2 and the first random rational point Ra will be less likely to be an infinity point. Therefore, even if the selected intermediate rational point M becomes an infinity point, the second selected random rational point Rb will be less likely to be an infinity point. Therefore, if the selection unit 84 finds that the intermediate selection result rational point M is at infinity, it may select either the second random rational point Rb or the first random rational point Ra as the random rational point R to use.

[0122] Furthermore, if the random number generator 4 becomes inoperable due to an external attack on the processing unit 1, and the randomization unit 53 is unable to generate the first random rational point Ra, the selection unit 84 may select either the intermediate rational point M or the selected second random rational point Rb as the random rational point R to be used.

[0123] In this example as well, three or more intermediate rational points may be used to obtain the random rational point R. Here, the number of three or more intermediate rational points used to obtain the random rational point R is represented by N (where N is an integer greater than or equal to 3).

[0124] The selection unit 60 selects one of the N intermediate result rational points, similar to the selection unit 50 in Figure 5. The calculation unit 83 then calculates, for example, each of the N intermediate result rational points with the first random rational point Ra to obtain N second random rational points. The selection unit 80 then selects one of the N second random rational points obtained by the calculation unit 83.

[0125] Alternatively, the calculation unit 83 may perform calculations on a portion of the N intermediate rational points and the first random rational point Ra to obtain M (where M is an integer greater than or equal to 2 and less than N) second random rational points. In this case, the selection unit 80 selects one of the M second random rational points obtained by the calculation unit 83.

[0126] For example, consider the case where N=3. In this case, the calculation unit 83 may perform calculations with each of the two intermediate rational points out of the three intermediate rational points and the first random rational point Ra to obtain two second random rational points (M=2). As another example, consider the case where N=4. In this case, the calculation unit 83 may perform calculations with each of the two or three intermediate rational points out of the four intermediate rational points and the first random rational point Ra to obtain two or three second random rational points (M=2 or M=3).

[0127] Furthermore, in this example as well, similar to the example in Figure 5, three or more known rational points may be used to obtain the random rational point R to be used.

[0128] Thus, the acquisition unit 25C in this example acquires the random rational point R to be used based on a second random rational point different from the rational point P to be multiplied, a first random rational point Ra, and an intermediate result rational point different from the rational point P to be multiplied. As a result, the random rational point R to be used can be stably supplied to the scalar multiplication unit 20.

[0129] In the example shown in Figure 8, the x-coordinate of a rational point is used in the selection unit 50, comparison unit 51, coordinate acquisition unit 52, comparison unit 81, and coordinate transformation unit 82, but the y-coordinate of a rational point may be used, as in the selection unit 50 in Figure 4.

[0130] Furthermore, even in the example of Figure 8, as in the example of Figure 7, the intermediate rational points M1 and M2 may be stored in the non-volatile memory 30 together with the known rational points S1 and S2. In this case, for example, the projected coordinates M1(X,Y,Z) of the intermediate rational point M1 and the projected coordinates M2(X,Y,Z) of the intermediate rational point M2 may be stored in the non-volatile memory 30, and the selection unit 60 and the calculation unit 83 may be input with the projected coordinates M1(X,Y,Z) and M2(X,Y,Z) from the non-volatile memory 30.

[0131] Furthermore, the acquisition unit 26C does not necessarily have to include a selection unit 60, a comparison unit 61, and a coordinate transformation unit 62. In this case, the selection unit 84 selects either the second random rational point Rb or the first random rational point Ra. Such an acquisition unit 26C will acquire the random rational point R to be used based on the second random rational point, which is different from the rational point P to be multiplied, and the first random rational point Ra.

[0132] In the example above, the processing unit 1 includes an acquisition unit 25 and a scalar multiplication unit 20, but it may also include only the acquisition unit 25. In this case, the random rational points R acquired by the processing unit 1 are used by other devices that perform scalar multiplication.

[0133] The processing unit 1 described above can be used in various systems. Figure 9 is a schematic diagram showing an example of a system equipped with the processing unit 1. In the example in Figure 9, the processing unit 1 is installed in a data processing system 100. The data processing system 100 comprises the processing unit 1 and a host device 110 capable of communicating with the processing unit 1. The data processing system 100 can also be considered a communication system.

[0134] The host device 110 is a higher-level device that controls the processing unit 1. The host device 110 comprehensively manages the operation of the entire data processing system 100. The host device 110 can be said to be the main unit of the data processing system 100.

[0135] The data processing system 100 may be, for example, a portable electronic device such as a smartphone or tablet, or it may be another system. If the data processing system 100 is a portable electronic device, the host device 110 functions as the main body of the portable electronic device.

[0136] In the data processing system 100, the processing unit 1 functions, for example, as a memory device. The host device 110 can read data from the processing unit 1 as a memory device and write data to the processing unit 1. For example, when the host device 110 issues a data read command to the processing unit 1, the processing unit 1 reads the data from the non-volatile memory 30 and outputs it to the host device 110. Also, when the host device 110 issues a data write command to the processing unit 1, the processing unit 1 writes the data from the host device 110 into the non-volatile memory 30. The non-volatile memory 30 is also called, for example, a memory core.

[0137] The host device 110 includes, for example, a control unit 120, a storage unit 130, a random number generator 140, and an interface 150. The host device 110 can also be described as, for example, a computer device.

[0138] The random number generator 140 generates random numbers in the same way as the random number generator 4 provided in the processing unit 1. Interface 150 can communicate directly with interface 5, described later, provided in the processing unit 1. Interface 150 can also be called, for example, an interface circuit. Interface 150 can also be called, for example, a communication unit or a communication circuit. Interface 150 may communicate with interface 5 via wired communication or wireless communication.

[0139] The control unit 120 can comprehensively manage the operation of the host device 110 by controlling other components of the host device 110. The control unit 120 can also be called a control circuit, for example. The control unit 120 includes, for example, at least one processor 121. The at least one processor 121 included in the control unit 120 may include, for example, a CPU.

[0140] The control unit 120 can issue write and read commands to the processing unit 1 via the interface 150. The control unit 120 can generate data to be written to the processing unit 1 and transmit the generated data to the interface 150. The control unit 120 can acquire data output by the processing unit 1 upon receiving a read command via the interface 150. The control unit 120 performs processing using the data received by the interface 150 from the processing unit 1.

[0141] The memory unit 130 includes, for example, non-volatile memory and volatile memory. The non-volatile memory and volatile memory can also be described as non-temporary recording media that can be read by the CPU of the control unit 120. The non-volatile memory may be, for example, flash memory. The non-volatile memory may be, for example, NAND flash memory. The volatile memory functions as work memory when the control unit 120 processes data. The volatile memory may include SRAM or DRAM.

[0142] The non-volatile memory stores programs such as the program 131 that defines the operation of the control unit 120. Various functions of the control unit 120 are realized, for example, when the CPU of the control unit 120 executes the program 131.

[0143] The configuration of the control unit 120 is not limited to the example described above. For example, at least one processor 121 in the control unit 120 may include multiple CPUs or at least one DSP. Also, all or some of the functions of the control unit 120 may be implemented by hardware circuits that do not require software to realize those functions. Furthermore, the storage unit 130 may include a small hard disk drive and an SSD, etc.

[0144] Furthermore, the host device 110 may include a display unit such as a liquid crystal display. In this case, the host device 110 may display the data read from the processing unit 1 on the display unit. The host device 110 may also include an input unit for receiving user input. The input unit may include, for example, a mouse and keyboard, a touch sensor for detecting user touch operations, or a microphone for receiving user voice input.

[0145] In the example shown in Figure 9, the processing unit 1 includes, in addition to the processing unit 2, storage unit 3, and random number generator 4, an interface 5 for communicating with, for example, the host device 110. Interface 5 can also be called, for example, an interface circuit. Interface 5 can also be called, for example, a communication unit or communication circuit.

[0146] The processing unit 2 functions as a control unit that comprehensively manages the operation of the processing unit 1 by controlling other components of the processing unit 1. In this example, the processing unit 2 may be referred to as the control unit 2. The control unit 2 can also be called a control circuit. The control unit 2 can control the interface 5 and can control the non-volatile memory 30 and volatile memory 35 of the storage unit 3. The control unit 2 can also be called a memory controller.

[0147] When the control unit 2 receives a read instruction from the host device 110 through the interface 5, it reads data from the non-volatile memory 30. Then, the control unit 2 causes the read data to be transmitted to the interface 5. Also, when the control unit 2 receives a write instruction and data from the host device 110 through the interface 5, it writes the received data to the non-volatile memory 30.

[0148] The control unit 2 of the processing device 1 performs processing using the scalar multiplication point dP obtained by the scalar multiplication unit 20. The processing device 1 performs encrypted communication with the host device 110 based on, for example, a common key encryption method. The processing device 1 performs a key sharing process for sharing the common key used in the encrypted communication with the host device 110. The processing device 1 uses the scalar multiplier d and the scalar multiplication point dP in the key sharing process with the host device 110.

[0149] FIG. 10 is a schematic diagram showing an example of the key sharing process between the processing device 1 and the host device 110. The control unit 120 of the host device 110 has, as functional blocks, for example, an acquisition unit and a scalar multiplication unit similar to the acquisition unit 25 and the scalar multiplication unit 20 of the control unit 2 of the processing device 1. The control unit 120 acquires a scalar multiplication point using the same elliptic curve as the elliptic curve used by the control unit 2.

[0150] In the key sharing process, the control unit 120 of the host device 110, in step s1, acquires the scalar multiplier d as the secret key a based on, for example, a random number generated by the random number generator 140. Next, in step s2, the control unit 120 multiplies the base point G used in the key sharing process by the scalar multiplier d a as the multiplication target rational point to obtain the scalar multiplication point d a G as the public key Q a . Then, in step s3, the control unit 120 transmits the acquired public key Q a (that is, the scalar multiplication point d a G) to the processing device 1 through the interface 150. The public key Q aThese are rational points on the elliptic curve used by the control unit 120.

[0151] On the other hand, in step s11, the control unit 2 of the processing unit 1 uses a scalar multiplier d as the secret key (here, a scalar multiplier d b The scalar multiplier d is obtained, for example, based on the random number r generated by the random number generator 14. Next, in step s12, the control unit 2 uses the base point G used in the key sharing process as the rational point R to be multiplied, and multiplies the base point G by a scalar multiplier d. b Multiply by the public key Q b d as a scalar multiplication point b G is obtained. The base point G is shared between the host device 110 and the processing unit 1. Then, in step s13, the control unit 2 obtains the public key Q b (that is, scalar multiplication point d) b G b The public key Q is sent to the host device 110 via interface 5. b This is a rational point on the elliptic curve used by the control unit 2.

[0152] Public Key Q b In the host device 110 that received the public key Q, in step s4, the control unit 120 sends the public key Q b Let Q be a rational point to be multiplied by, and the public key Q b d is a scalar multiplier a Multiply by this to obtain the scalar multiplication point Q as the common key Z. b d a Obtain the shared key Z is d a d b It is represented by Q.

[0153] On the other hand, public key Q a In the processing unit 1 that received the public key Q, in step s14, the control unit 2 determines the public key Q a Let P be the rational point to be multiplied, and Q be the public key. a d is a scalar multiplier b Multiply by this to obtain the scalar multiplication point Q as the common key Z. a d b (that is, d a d b Get Q).

[0154] As described above, a key sharing process is performed between the host device 110 and the processing device 1, and the common key Z is shared between the host device 110 and the processing device 1. In the host device 110, the control unit 120 encrypts the data to be sent to the processing device 1 with the common key Z, and sends the resulting encrypted data to the processing device 1 through the interface 150. Upon receiving the encrypted data, the processing device 1's control unit 2 decrypts the encrypted data with the common key Z to obtain the plaintext data. The control unit 2 then writes the obtained plaintext data to, for example, the non-volatile memory 30. Meanwhile, in the processing device 1, the control unit 2 encrypts the data read from the non-volatile memory 30 with the common key Z, and sends the resulting encrypted data to the host device 110 through the interface 5. Upon receiving the encrypted data, the host device 110's control unit 120 decrypts the encrypted data with the common key Z to obtain the plaintext data. The control unit 120 then performs processing using the obtained plaintext data.

[0155] When the control unit 2 of the processing device 1 transmits data to the host device 110, it may add an electronic signature generated based on a scalar multiplier d and a scalar multiplication point dP to the data. The control unit 120 of the host device 110, upon receiving the electronically signed data, verifies the electronic signature.

[0156] The functions of the elements disclosed herein may be implemented using circuit configurations or processing circuit configurations, including general-purpose processors, dedicated processors, integrated circuits, ASICs ("Application-Specific Integrated Circuits"), conventional circuit configurations, and / or combinations thereof, configured to perform the disclosed elements or programmed to perform the disclosed functions. A processor is considered a processing circuit configuration or circuit configuration if it includes transistors and other circuit configurations within it. In this disclosure, a circuit configuration, unit, or means is hardware that performs the listed functions or hardware programmed to perform such functions. Hardware may be any hardware disclosed herein or other known hardware programmed to perform the listed functions or configured to perform such functions. When hardware is a processor that may be considered a type of circuit configuration, a circuit configuration, means, or unit is a combination of hardware and software, software used to configure the hardware, and / or a processor.

[0157] As described above, the processing apparatus has been explained in detail, but the above description is illustrative in all respects, and the invention is not limited thereto. Furthermore, the various examples described above can be combined and applied insofar as they do not contradict each other. And it is understood that countless examples not illustrated can be conceived without falling outside the scope of this disclosure.

[0158] This disclosure includes the following aspects:

[0159] The processing apparatus according to the first embodiment includes an acquisition unit that acquires random rational points to be used, which are different from the rational points to be multiplied, based on a plurality of first rational points known to be located on the elliptic curve, for randomizing the rational points to be multiplied in a scalar multiplication process in which a scalar multiplier is multiplied on the rational points to be multiplied on the elliptic curve.

[0160] The processing device according to the second embodiment is the processing device according to the first embodiment, wherein the acquisition unit selects a first rational point from the plurality of first rational points that is different from the multiplicative rational point, and acquires the random rational point to be used based on the first rational point that is different from the multiplicative rational point.

[0161] The processing apparatus according to the third embodiment is the processing apparatus according to the second embodiment, wherein the acquisition unit compares the first coordinate of one axis of one of the plurality of first rational points with the second coordinate of the one axis of the multiplicative rational point, and if the first coordinate and the second coordinate are different, selects the one first rational point as a first rational point different from the multiplicative rational point.

[0162] The processing apparatus according to the fourth embodiment is the processing apparatus according to the third embodiment, wherein the acquisition unit, when the first coordinate and the second coordinate coincide, selects a first rational point from among the plurality of first rational points that is different from the one first rational point as the first rational point that is different from the rational point to be multiplied.

[0163] The processing apparatus according to the fifth embodiment is a processing apparatus according to any one of the first to fourth embodiments, wherein the plurality of first rational points include, among the finite number of rational points on the elliptic curve defined on the finite field, the rational point with the smallest coordinate of one axis and the rational point with the second smallest coordinate of one axis.

[0164] The processing device according to the sixth embodiment is a processing device according to any one of the first to fifth embodiments, wherein the acquisition unit acquires the random rational points to be used based on the plurality of first rational points and a plurality of intermediate result rational points obtained during the scalar multiplication process.

[0165] The processing apparatus according to the seventh embodiment is the processing apparatus according to the sixth embodiment, wherein the acquisition unit selects a first rational point from the plurality of first rational points that is different from the multiplicative rational point, selects an intermediate rational point from the plurality of intermediate rational points that is different from the multiplicative rational point, and acquires the random rational point to be used based on the first rational point that is different from the multiplicative rational point and the intermediate rational point that is different from the multiplicative rational point.

[0166] The processing device according to the eighth embodiment is a processing device according to the sixth embodiment, wherein the acquisition unit acquires a first random rational point different from the multiplicative rational point based on the first rational point different from the multiplicative rational point, calculates a plurality of second random rational points using at least a portion of the plurality of intermediate result rational points and the first random rational point, selects a second random rational point different from the multiplicative rational point from the plurality of second random rational points, and acquires the random rational point to be used based on the second random rational point different from the multiplicative rational point and the first random rational point.

[0167] The processing apparatus according to the ninth embodiment is the processing apparatus according to the eighth embodiment, wherein the acquisition unit selects an intermediate rational point from the plurality of intermediate rational points that is different from the rational point to be multiplied, and acquires the random rational point to be used based on the second random rational point that is different from the rational point to be multiplied, the first random rational point, and the intermediate rational point that is different from the rational point to be multiplied.

[0168] The processing apparatus according to the tenth embodiment is a processing apparatus according to any one of the sixth to ninth embodiments, and includes a non-volatile memory for storing the plurality of first rational points and the plurality of intermediate result rational points.

[0169] The processing apparatus according to the 11th embodiment is a processing apparatus according to any one of the first to tenth embodiments, and comprises a scalar multiplication unit that performs the scalar multiplication processing.

[0170] The processing apparatus according to the 12th embodiment is the processing apparatus according to the 11th embodiment, comprising a non-volatile memory and a control unit that controls the non-volatile memory and has an acquisition unit and a scalar multiplication unit, wherein the control unit performs processing using the result of multiplying the scalar multiplier on the rational point to be multiplied, obtained by the scalar multiplication unit.

[0171] The acquisition method according to the 13th aspect is an acquisition method using a device, in which, in a scalar multiplication process in which a scalar multiplier is multiplied on a rational point to be multiplied on an elliptic curve defined on a finite field, random rational points to be used, which are different from the rational points to be multiplied, are acquired based on a plurality of first rational points known to be located on the elliptic curve, for the purpose of randomizing the rational point to be multiplied.

[0172] The program according to the 14th embodiment is a program that causes a computer device to function as the acquisition unit of a processing device according to any one of the first to tenth embodiments. [Explanation of Symbols]

[0173] 1 Processing Unit 2. Processing Unit (Control Unit) 20 Scalar Multiplication Section 25 Acquisition Department 30 Non-volatile memory 31, 131 Programs 110 Host device (processing device) 120 Control Unit

Claims

1. A processing device comprising an acquisition unit for acquiring random rational points to be used, which are different from the rational points to be multiplied, based on a plurality of first rational points known to be located on the elliptic curve, in order to randomize the rational points to be multiplied in a scalar multiplication process in which a scalar multiplier is multiplied on rational points to be multiplied on an elliptic curve defined on a finite field.

2. The apparatus according to claim 1, The acquisition unit is, From the plurality of first rational points, select a first rational point that is different from the rational point to be multiplied. A processing device that obtains the random rational point to be used based on the first rational point which is different from the rational point to be multiplied.

3. The apparatus according to claim 2, The acquisition unit compares the first coordinate of one axis of one of the plurality of first rational points with the second coordinate of the first axis of the multiplicative rational point, and if the first coordinate and the second coordinate are different, the processing unit selects the one first rational point as a first rational point different from the multiplicative rational point.

4. The apparatus according to claim 3, The acquisition unit, when the first coordinate and the second coordinate coincide, selects a first rational point from among the plurality of first rational points that is different from the one first rational point as the first rational point that is different from the rational point to be multiplied.

5. The processing apparatus according to any one of claims 1 to 4, A processing apparatus in which the plurality of first rational points include, among the finite number of rational points on the elliptic curve defined on the finite field, the rational point with the smallest coordinate of one axis and the rational point with the second smallest coordinate of one axis.

6. The processing apparatus according to any one of claims 1 to 4, The acquisition unit is a processing unit that acquires the randomly selected rational points to be used based on the plurality of first rational points and the plurality of intermediate rational points obtained during the scalar multiplication process.

7. The apparatus according to claim 6, The acquisition unit is, From the plurality of first rational points, select a first rational point that is different from the rational point to be multiplied. From the aforementioned plurality of rational intermediate result points, select a rational intermediate result point that is different from the rational point to be multiplied. A processing device that obtains the random rational points to be used based on the first rational point which is different from the rational point to be multiplied and the intermediate result rational point which is different from the rational point to be multiplied.

8. The apparatus according to claim 6, The acquisition unit is, Based on the first rational point which is different from the rational point to be multiplied, a first random rational point which is different from the rational point to be multiplied is obtained. A plurality of second random rational points are obtained by performing calculations on at least a portion of the plurality of intermediate rational points and the first random rational point. From the plurality of second random rational points, select a second random rational point that is different from the rational point to be multiplied. A processing device that obtains the random rational point to be used based on the first random rational point and the second random rational point which is different from the rational point to be multiplied.

9. The apparatus according to claim 8, The acquisition unit is, From the aforementioned plurality of rational intermediate result points, select a rational intermediate result point that is different from the rational point to be multiplied. A processing device that obtains the random rational point to be used based on the second random rational point which is different from the rational point to be multiplied, the first random rational point, and the intermediate result rational point which is different from the rational point to be multiplied.

10. The apparatus according to claim 6, A processing apparatus comprising a non-volatile memory for storing the plurality of first rational points and the plurality of intermediate result rational points.

11. The processing apparatus according to any one of claims 1 to 4, A processing apparatus comprising a scalar multiplication unit that performs the aforementioned scalar multiplication.

12. The apparatus according to claim 11, Non-volatile memory and Controlling the non-volatile memory, and a control unit having the acquisition unit and the scalar multiplication unit, Equipped with, The control unit is a processing device that performs processing using the result of multiplying the scalar multiplier on the rational point to be multiplied, which is obtained by the scalar multiplication unit.

13. A method of acquisition using a device, A method for obtaining random rational points to be used, which are different from the rational points to be multiplied, based on a plurality of first rational points known to be located on the elliptic curve, in order to randomize the rational points to be multiplied in a scalar multiplication operation in which a scalar multiplier is multiplied on the rational points to be multiplied.

14. A program for causing a computer device to function as the acquisition unit of the processing device described in any one of claims 1 to 4.

Images