Parameter generation device, parameter generation method, and parameter generation program

Abstract

A parameter generation device (10) generates a seed. A pre-calculation unit (11) calculates, as a composite number condition, a condition for an integer such that the first integer and / or the second integer obtained by substituting an integer into each of the first polynomial p(x) and the second polynomial r(x) is a composite number. A seed candidate generation unit (12) searches for an integer for which the Hamming weight in a signed binary representation expressed in a non-adjacent format is included in a weight range (W). The seed candidate generation unit (12) deletes integers that satisfy the composite number condition from the set of integers obtained through the search, and sets the set (T) of seed candidates. A primality determination unit (13) extracts, from the set T of seed candidates, integers for which the first polynomial and the second polynomial are both prime numbers by substitution, and sets the same as a set (S).

Description

[Technical field]

[0001] The present disclosure relates to a parameter generation device, a parameter generation method, and a parameter generation program, and in particular to a parameter generation device, a parameter generation method, and a parameter generation program that generate parameters for pairing calculation. [Background technology]

[0002] Pairing operations are used in feature-rich cryptographic schemes such as searchable encryption and attribute-based encryption. Pairing operations are broadly divided into calculations of mirror functions and exponentiation over finite fields. Hereafter, the former is called the mirror loop, and the latter is called the final power. The calculations of the mirror loop and the final power require complex computational processes. The efficiency of both computations is important for cryptographic schemes that use pairing operations.

[0003] The elliptic curve used in the pairing operation is selected from an elliptic curve family suitable for the pairing operation. An elliptic curve family is also called a pairing-friendly curve. For example, a BN curve, a BLS curve, or a KSS curve is known as a pairing-friendly curve. BN is an abbreviation for Barreto-Naehrig. BLS is an abbreviation for Barreto-Lynn-Scott. KSS is an abbreviation for Kachisa-Schaefer-Scott. In Non-Patent Document 1, an elliptic curve equivalent to 256-bit security is selected from the BLS27 curve.

[0004] A pairing-friendly curve consists of polynomial p(x), polynomial r(x), polynomial t(x), and embedding degree k. The elliptic curve E used in the pairing operation is an elliptic curve defined over a finite field Fp with the number of elements p=p(u). r=r(u) is the maximum prime number that divides the order of the group E(Fp). t=t(u) is the trace of the elliptic curve E. In this case, k is the smallest positive integer that satisfies (p^k-1)=0(mod r). In this way, the elliptic curve used in the pairing operation is selected by determining the integer u, which is also called the seed. Note that the integers p and r must be prime numbers, and the integer r must be a size that satisfies a certain security level.

[0005] The integer u has a large impact on the computational complexity of the pairing operation. More specifically, the fewer the number of digits and Hamming weights in the signed binary representation of the integer u, the smaller the computational complexity. Also, depending on the pairing operation algorithm, the fewer the -1 digits in the signed binary representation of the integer u, the smaller the computational complexity may be. Non-Patent Document 2 refers to a method for generating parameters suitable for pairing calculations. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] X. Zhang, D. Lin, “Analysis of Optimum Pairing Products at High Security Levels”, INDOCRYPT 2012, pp.412-430, 2012. [Non-Patent Document 2] S. Duquesne, N. El Mrabet, S. Haloui and F. Rondepierre, “Choosing and generating parameters for pairing implementation on BN curves”, Algebra Eng. Commun. Comput., vol. 29, pp.113-147, 2018. Summary of the Invention [Problem to be solved by the invention]

[0007] In Non-Patent Document 1, an elliptic curve equivalent to 256-bit security is selected from the BLS27 curves. In addition, in Non-Patent Document 2, an integer u having a Hamming weight of a predetermined value s and satisfying a predetermined condition cond is selected from a predetermined range. Then, it is confirmed that integers p=p(u) and r=r(u) for the selected integer u are prime numbers. However, the predetermined condition cond when selecting the integer u is a condition for efficient calculations on a finite field. In addition, there is no mention of a method for generating an integer u having a Hamming weight of a predetermined value h. In addition, since a signed binary representation of an integer is generally not unique, the parameter generation method in Non-Patent Document 2 generates duplicate integers u.

[0008] In this way, the probability that a randomly selected integer u satisfies all the conditions is not high, and therefore there is an issue that searching for the integer u, which is one of the parameters of the pairing operation, takes a lot of time.

[0009] An object of the present disclosure is to generate an appropriate seed in a short time by efficiently searching for a seed suitable for a pairing operation. [Means for solving the problem]

[0010] A parameter generation device according to the present disclosure generates a seed, which is a parameter for determining an elliptic curve used in a pairing calculation, comprising: a pre-calculation unit that calculates, as a composite number condition, an integer condition under which at least one of a first integer and a second integer obtained by substituting integers into a first polynomial and a second polynomial that constitute an elliptic curve family from which the elliptic curve is selected becomes a composite number; a seed candidate generation unit that searches for integers whose Hamming weights of signed binary representations expressed in a non-adjacent format are within a predetermined weight range, removes integers that satisfy the composite number condition from a set of integers obtained by the search, and sets a set of integers remaining after removing the integers that satisfy the composite number condition as a set of seed candidates; a prime number determination unit that determines whether or not the first polynomial and the second polynomial are both prime numbers by substitution for each integer in the set of seed candidates, and extracts an integer for which the first polynomial and the second polynomial are both prime numbers from the set of seed candidates as the seed; Equipped with. Effect of the Invention

[0011] In the parameter generation device according to the present disclosure, the pre-calculation unit calculates a composite number condition, which is a condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of a first polynomial and a second polynomial constituting an elliptic curve family is a composite number. The seed candidate generation unit searches for an integer whose Hamming weight of a signed binary representation expressed in a non-adjacent format is included in a weight range. Then, the seed candidate generation unit deletes integers that satisfy the composite number condition from a set of integers obtained by the search, and generates a set of seed candidates. Thus, the parameter generation device according to the present disclosure has an effect of being able to efficiently search for a seed suitable for a pairing operation and to generate an appropriate seed in a short time. [Brief description of the drawings]

[0012] [Figure 1] FIG. 2 is a diagram showing an example of a functional configuration of a parameter generating device according to the first embodiment. [Diagram 2] 4 is a flowchart showing the operation of a pre-calculation unit according to the first embodiment. [Diagram 3] 4 is a flowchart showing the operation of a seed candidate generating unit according to the first embodiment. [Figure 4] 4 is a flowchart showing the operation of a primality determining unit according to the first embodiment; [Diagram 5] 4 is a flowchart showing the operation of a seed expression generation unit according to the first embodiment. [Figure 6] FIG. 2 is a diagram showing an example of a hardware configuration of the parameter generating device according to the first embodiment. [Figure 7] FIG. 13 is a diagram showing an example of a hardware configuration of a parameter generating device 10 according to a modified example of the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are given the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

[0014] Embodiment 1 The parameter generating device 10 according to this embodiment generates a seed, which is a parameter that determines an elliptic curve to be used in a pairing calculation. In this embodiment, the seed to be searched for may be referred to as the integer u.

[0015] ***Configuration Description*** FIG. 1 is a diagram illustrating an example of a functional configuration of a parameter generating device 10 according to the present embodiment. The parameter generating device 10 includes, as functional elements, a pre-calculation unit 11, a seed candidate generating unit 12, a prime number determining unit 13, and a seed expression generating unit 14. Here, input and output of each functional element will be mainly explained.

[0016] The parameter generating device 10 receives a search range U, a weighting range W, a polynomial p(x), a polynomial r(x), and a threshold b. The search range U is the range in which to search for integers u, i.e., the seeds. The weight range W is the range of Hamming weights in the non-adjacent form of integers. In this embodiment, the Hamming weight in the non-adjacent form of integer a is represented as HW(NAF(a)). The polynomials p(x) and r(x) are the polynomials that constitute the elliptic curve family from which the elliptic curve is selected, as described in more detail below. The threshold b is a prime number threshold.

[0017] The pre-calculation unit 11 receives polynomial p(x), polynomial r(x), and threshold b, which are elements constituting a pairing-friendly curve. Then, the pre-calculation unit 11 outputs threshold b and the generated set B to the seed candidate generation unit 12.

[0018] The seed candidate generation unit 12 receives a search range U of the integer u and a weight range W of the Hamming weight. The seed candidate generation unit 12 also receives as input a threshold b and a set B, which are outputs from the pre-calculation unit 11. The seed candidate generation unit 12 then outputs a set T of candidates for the generated integer u to the prime number determination unit 13.

[0019] The primality test unit 13 receives polynomial p(x) and polynomial r(x). The primality test unit 13 also receives set T, which is the output of the seed candidate generation unit 12. The primality test unit 13 then outputs set S of integers u, such that both integers p(u) and r(u) are prime numbers, to the seed expression generation unit 14.

[0020] The seed expression generation unit 14 receives the set S, which is the output of the primality determination unit 13. Then, the seed expression generation unit 14 calculates a set R of representations of an integer u that are suitable for a pairing operation, and transmits the set R.

[0021] Here, an integer u which is a seed generated in this embodiment, a signed binary representation of the integer, and a non-adjacent form of the signed binary representation will be described.

[0022] As described above, the elliptic curve used in the pairing calculation is selected from a family of elliptic curves suitable for the pairing calculation. In the following description, the family of elliptic curves is referred to as pairing-friendly curves. A pairing-friendly curve consists of polynomial p(x), polynomial r(x), polynomial t(x), and embedding degree k. The elliptic curve E used in the pairing operation is an elliptic curve defined over a finite field Fp with the number of elements p=p(u). r=r(u) is the maximum prime number that divides the order of the group E(Fp). t=t(u) is the trace of the elliptic curve E. In this case, k is the smallest positive integer that satisfies (p^k-1)=0(mod r). In this way, the elliptic curve used in the pairing operation is selected by determining the integer u. However, it is necessary that the integers p and r are prime numbers, and the integer r has a size that satisfies a predetermined security level.

[0023] The integer u has a large impact on the computational complexity of the pairing operation. More specifically, the fewer the number of digits and Hamming weights in the signed binary representation of the integer u, the smaller the computational complexity. Also, depending on the pairing operation algorithm, the fewer the -1 digits in the signed binary representation of the integer u, the smaller the computational complexity may be.

[0024] Here, the signed binary representation of integer a refers to a binary representation that allows -1. Also, the Hamming weight of integer a refers to the number of non-zero digits in the signed binary representation of integer a. For example, the decimal number 198 can be expressed in binary as (11000110)2. Here, if n is used as the -1 digit, then (11001n10)2 is one signed binary representation of 198, and its Hamming weight is 5.

[0025] One of the representation methods included in the signed binary representation is the non-adjacent form (NAF). In general, the signed binary representation of an integer a is not unique. However, the non-adjacent form of an integer a is unique and has the characteristic that its Hamming weight is the smallest. For example, the non-adjacent form of the decimal number 198 is (10n0010n0)2, and its Hamming weight is 4.

[0026] ***Explanation of Operation*** Next, an operation of the parameter generating device 10 according to the present embodiment will be described. The operation procedure of the parameter generating device 10 corresponds to a parameter generating method. Also, a program that realizes the operation of the parameter generating device 10 corresponds to a parameter generating program.

[0027] The operation of the parameter generating device 10 according to the present embodiment will be described with reference to FIG. To perform pairing operations, prime numbers p and r are required as parameters. Prime numbers p and r are generated by substituting integer u into polynomials p(x) and r(x), which are elements of the pairing-friendly curve. For this reason, the integer u must be fixed.

[0028] However, it is desirable that integer u has a small Hamming weight, and integers p(u) and r(u) are both prime numbers for polynomials p(x) and r(x). Condition 1 is that integers p(u) and r(u) are both prime numbers. Condition 2 is that integer u has a small Hamming weight. The seed integer u must satisfy conditions 1 and 2 for polynomial p(x) and polynomial r(x). Condition 1 is a necessary condition for the pairing calculation to be successful, and condition 2 is a condition for efficiently calculating the pairing calculation.

[0029] If an integer u is selected randomly, in many cases, the probability that the integer u satisfies condition 1 or condition 2 is extremely low. Therefore, in this embodiment, the integer u is selected by narrowing down the integer u to an integer that has a higher probability of satisfying condition 1 or condition 2, thereby making the search process for the integer u more efficient.

[0030] First, integers that satisfy condition 2, i.e., that the Hamming weight of the integer is small, are generated using a non-adjacent format. As mentioned above, signed binary representations are generally not unique, so duplicates will occur for integers u that satisfy condition 2, increasing the search time. On the other hand, non-adjacent formats of signed binary representations are unique for integers. This makes it possible to minimize the search range for integer u, and because the Hamming weight is minimal, it is easy to check whether condition 2 is satisfied.

[0031] Next, in order to improve the probability of satisfying condition 1, i.e., that the integers p(u) and r(u) are both prime numbers, we pre-calculate the conditions for the integer u such that the integer p(u) or the integer r(u) has small prime factors. For example, if there exists an integer a such that p(a) = 0 (mod q) for some prime number q, then clearly if u = a (mod q), then p(u) = 0 (mod q). For some prime numbers q, the roots of p(x) mod q and the roots of r(x) mod q are calculated in advance, and if an integer u is congruent to the root modulo q, the integer u is removed from the search candidates. This makes it possible to confirm the existence of a prime factor q by performing a modulus calculation on the integer u prior to determining whether p(u) or r(u) is a prime number. In addition, as a pair of this prime number q and the root, a condition for efficient calculations on a finite field may be added, as in Non-Patent Document 2.

[0032] In addition, a sieving process using elements of set B may be used to eliminate search candidates for integer u. For example, when a prime number q and a root a of a polynomial f(x) mod q are obtained, f(a) has prime factor q. In addition, f(a+mq) for an integer m also has prime factor q. This means that when integer u is congruent to root a modulo q, u+mq can be eliminated from search candidates without performing modulus calculations.

[0033] Using a non-adjacent form as the signed binary representation of the integer u minimizes the Hamming weight, making the pairing operation more efficient. However, a non-adjacent form does not necessarily minimize the computational complexity of the pairing operation. For example, if the integer u is 198 in decimal, the non-adjacent form of u is (10n0010n0)2, and the Hamming weight is 4. Here, one of the signed binary representations of u, (110010n0)2, also has a Hamming weight of 4 and has one fewer digit than the non-adjacent form. Furthermore, (11000110)2, which is also one of the signed binary representations of u, also has a Hamming weight of 4 and is a representation with only the digits 0 and 1. Using the last signed binary representation rather than the non-adjacent form reduces the amount of computation required for pairing operations.

[0034] The pre-calculation unit 11 calculates the roots of a first polynomial p(x) and a second polynomial r(x) for a prime number q equal to or less than a threshold b, and generates a set B of pairs of q and the roots. The seed candidate generation unit 12 searches within the search range U for an integer u whose Hamming weight in the non-adjacent format is included in the weight range W, and generates a set T. Furthermore, by referring to set B, the integer u that does not satisfy condition 1 is deleted from set T. The prime number determination unit 13 determines whether integers p(u) and r(u) are both prime numbers for an integer u that is an element of the set T, and generates a set S of integers u for which the determination result is true. The seed representation generation unit 14 calculates, for each element u of the set S, a signed binary representation v that makes the pairing operation efficient, and generates a set R of pairs (u, v).

[0035] <Precalculation processing> FIG. 2 is a flow diagram showing the operation of pre-calculation unit 11 according to this embodiment. The pre-calculation process according to this embodiment will be described with reference to FIG.

[0036] In the pre-calculation process, the pre-calculation unit 11 calculates, as a composite number condition, an integer condition under which at least one of a first integer p and a second integer r obtained by substituting integers into a first polynomial p(x) and a second polynomial r(x) constituting an elliptic curve family from which an elliptic curve is selected is a composite number. Specifically, the pre-calculation unit 11 calculates the roots of p(x) mod q and r(x) mod q for a prime number q equal to or less than a threshold b. Then, the pre-calculation unit 11 generates a set B of pairs of q and a root a that is the root of p(x) mod q or r(x) mod q as a composite number condition. More specifically, it is as follows.

[0037] In step S111, the pre-calculation unit 11 receives the first polynomial p(x), the second polynomial r(x), and the threshold value b. In step S112, the pre-calculation unit 11 calculates a prime number q equal to or smaller than the threshold b. i For modulus q i Root a of polynomial p(x) and polynomial r(x) in i,j Calculate the root a i,jis the root of p(x) mod q or r(x) mod q. In this case, the subscripts i and j may be natural numbers or integers greater than or equal to 0. i represents the number of prime numbers, and j represents each prime number q i The root a corresponding to i Represents the number of. In step S113, the pre-calculation unit 11 calculates the calculated set (qi, a i,j ) is generated as a composite number condition. In step S114, the pre-calculation unit 11 transmits the threshold b and the set B to the seed candidate generation unit 12.

[0038] <Seed candidate generation process> FIG. 3 is a flow diagram showing the operation of the seed candidate generating unit 12 according to this embodiment. The seed candidate generation process according to the present embodiment will be described with reference to FIG.

[0039] In the seed candidate generation process, the seed candidate generation unit 12 searches for integers whose Hamming weights of signed binary representations expressed in a non-adjacent format are included in a predetermined weight range W. Then, the seed candidate generation unit 12 deletes integers that satisfy a composite number condition from a set T' of integers obtained by the search. Then, the seed candidate generation unit 12 sets the set of integers remaining after deleting the integers that satisfy the composite number condition as a set T of seed candidates.

[0040] Specifically, the seed candidate generation unit generates a pair of prime number q and u mod q for an integer u in a set T' of integers obtained by searching. Then, if the pair of prime number q and u mod q is included in a set B that is a composite number condition, the seed candidate generation unit deletes the integer u from the set T' of integers obtained by searching. In addition, an integer u satisfying the composite number condition means that the integer u is congruent to the root a modulus q. More specifically, it is as follows.

[0041] In step S121, the seed candidate generation unit 12 receives a search range U of an integer u, a weight range W which is a range of a Hamming weight, a threshold b, and a set B. In step S122, the seed candidate generation unit 12 searches within the search range U for integers whose non-adjacent format Hamming weights are included in the weight range W, and generates a set T' of the obtained integers. In step S123, the seed candidate generation unit 12 calculates a pair (qi, u mod qi) for each element u of the set T' and a prime number qi equal to or less than a threshold b. Then, the seed candidate generation unit 12 determines the set T' obtained by deleting an integer u such that the pair (qi, u mod qi) is included in the set B as the set T of seed candidates. In step S124, the seed candidate generation unit 12 transmits the set T to the primality test unit 13.

[0042] <Prime number determination process> FIG. 4 is a flow diagram showing the operation of the primality determining unit 13 according to this embodiment. The primality testing process according to this embodiment will be described with reference to FIG.

[0043] In the prime number determination process, the prime number determination unit 13 determines whether or not a first polynomial p(u) and a second polynomial r(x) are both prime numbers by substitution for each integer u in the seed candidate set T. The prime number determination unit 13 extracts an integer u for which both the first polynomial p(u) and the second polynomial r(x) are prime numbers from the seed candidate set T as a seed. Specifically, the following applies:

[0044] In step S131, the primality determination unit 13 receives the first polynomial p(x), the second polynomial r(x), and a set T of seed candidates. In step S132, the primality determination unit 13 determines, for each element u of the set T, whether an integer p=p(u) and an integer r=r(u) are both prime numbers, and generates a set S of integers u for which the determination result is true. In step S133, the primality determination unit 13 transmits the set S to the seed expression generation unit .

[0045] <Seed expression generation process> FIG. 5 is a flow diagram showing the operation of the seed expression generation unit 14 according to this embodiment. The seed expression generation process according to this embodiment will be described with reference to FIG.

[0046] In the seed representation generation process, the seed representation generation unit 14 represents the seed in a signed binary representation in which the amount of computation required for pairing calculation is less than that in the non-adjacent format. Specifically, the following applies:

[0047] In step S141, the seed expression generation unit 14 receives a set S. In step S142, the seed representation generation unit 14 generates, for each element u of the set S, a signed binary representation v that reduces the amount of computation required for the pairing operation. It is preferable that the seed representation generation unit 14 generates, for each element u of the set S, a signed binary representation v that reduces the amount of computation required for the pairing operation. In step S143, the seed expression generation unit 14 generates a set R of the generated pairs (u, v). In step S144, the seed expression generation unit 14 transmits the set R.

[0048] ***Explanation of the Effects of the Present Embodiment*** As described above, in this embodiment, an efficient search method for an integer u suitable for pairing calculation is introduced. Specifically, the parameter generation device according to this embodiment uses a unique non-adjacent format as a signed binary representation to eliminate duplication of the integer u and make the search more efficient. Also, in the parameter generation device according to this embodiment, a list of x is created such that the integers p=p(x) and r=r(x) have small prime factors. Then, in the parameter generation device according to this embodiment, the elements of the list are removed from the search range of the integer u to reduce the amount of calculation in the parameter search.

[0049] Therefore, according to the parameter generation device of this embodiment, by generating an integer u with a predetermined Hamming weight using the non-adjacent format, it is possible to eliminate duplication of integer u and make the search more efficient. Also, according to the parameter generation device of this embodiment, the calculation amount of the prime number determination can be reduced by replacing the determination of whether integer p or integer r has a small prime factor with a determination by a remainder calculation on integer u. Furthermore, according to the parameter generation device of this embodiment, it is possible to reduce the calculation amount of the pairing operation by generating a signed binary representation converted from the non-adjacent format of integer u without changing the Hamming weight.

[0050] ***Explanation of Hardware Configuration Example*** FIG. 6 is a diagram illustrating an example of a hardware configuration of the parameter generating device 10 according to the present embodiment.

[0051] The parameter generating device 10 is a computer. The parameter generating device 10 includes a processor 910 and other hardware such as a memory 921, an auxiliary storage device 922, an input / output interface 930, and a communication interface 950. The processor 910 is connected to the other hardware via a signal line 80 and controls the other hardware.

[0052] As described above, the parameter generation device 10 includes, as functional elements, a pre-calculation unit 11, a seed candidate generation unit 12, a primality test unit 13, and a seed expression generation unit 14. The functions of the pre-calculation unit 11, the seed candidate generation unit 12, the primality test unit 13, and the seed expression generation unit 14 are realized by software. In the following, the pre-calculation unit 11, the seed candidate generation unit 12, the primality determination unit 13, and the seed expression generation unit 14 may be referred to as each unit of the parameter generation device 10.

[0053] The processor 910 is a device that executes a parameter generation program. The parameter generation program is a program that realizes the functions of the parameter generation device 10. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0054] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that stores data. A specific example of the auxiliary storage device 922 is a HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0055] The input / output interface 930 is an interface for connecting an input / output device. Specific examples of the input / output interface 930 include a USB and an HDMI (registered trademark) port. USB is an abbreviation for Universal Serial Bus. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface.

[0056] The communication interface 950 is an interface for communicating with an external device. Specific examples of the communication interface 950 include an Ethernet (registered trademark) port, or a device for performing wireless communication.

[0057] The parameter generation program is executed in the parameter generation device 10. The parameter generation program is read into the processor 910 and executed by the processor 910. In addition to the parameter generation program, an OS is also stored in the memory 921. The OS is an abbreviation for Operating System. The processor 910 executes the parameter generation program while executing the OS. The parameter generation program and the OS may be stored in an auxiliary storage device 922. The parameter generation program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that a part or all of the parameter generation program may be incorporated into the OS.

[0058] The parameter generating device 10 may include a plurality of processors that replace the processor 910. These plurality of processors share the task of executing the parameter generating program. Each of the processors is a device that executes the parameter generating program, just like the processor 910.

[0059] Data, information, signal values ​​and variable values ​​utilized, processed or output by the parameter generation program are stored in memory 921, secondary storage device 922, or in registers or cache memory within processor 910.

[0060] The "parts" of the pre-calculation unit 11, the seed candidate generation unit 12, the primality determination unit 13, and the seed expression generation unit 14 may be read as "circuits," "steps," "procedures," "processing," or "circuitry." The parameter generation program causes a computer to execute a pre-calculation process, a seed candidate generation process, a primality determination process, and a seed expression generation process. The "processing" of the pre-calculation process, the seed candidate generation process, the primality determination process, and the seed expression generation process may be read as a "program," "program product," "a computer-readable storage medium storing a program," or a "computer-readable recording medium recording a program." The parameter generation method is a method performed by the parameter generation device 10 executing the parameter generation program. The parameter generating program may be provided by being stored in a computer-readable recording medium, or may be provided as a program product.

[0061] ***Other configurations*** <Modification> In this embodiment, the functions of the pre-calculation unit 11, the seed candidate generation unit 12, the primality test unit 13, and the seed expression generation unit 14 are realized by software. As a modification, the functions of the pre-calculation unit 11, the seed candidate generation unit 12, the primality test unit 13, and the seed expression generation unit 14 may be realized by hardware. Specifically, the parameter generating device 10 includes an electronic circuit 909 instead of a processor 910 .

[0062] FIG. 7 is a diagram showing an example of a hardware configuration of a parameter generating device 10 according to a modified example of the present embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of each part of the parameter generating device 10. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0063] The functions of each unit of the parameter generating device 10 may be realized by one electronic circuit, or may be distributed and realized by multiple electronic circuits.

[0064] As another modification, some of the functions of each unit of the parameter generating device 10 may be realized by electronic circuits and the remaining functions may be realized by software. Also, some or all of the functions of each unit of the parameter generating device 10 may be realized by firmware.

[0065] Each of the processor and the electronic circuit is also called a processing circuitry. In other words, the functions of each part of the parameter generating device 10 are realized by the processing circuitry.

[0066] In the above first embodiment, each unit of the parameter generation device 10 has been described as an independent functional block. However, the configuration of the parameter generation device 10 does not have to be the same as that of the above-mentioned embodiment. The functional blocks of the parameter generation device 10 may have any configuration as long as they can realize the functions described in the above-mentioned embodiment. Furthermore, the parameter generation device 10 may not be a single device, but may be a system composed of multiple devices. In addition, a plurality of parts of the first embodiment may be combined and implemented. Alternatively, only one part of this embodiment may be implemented. In addition, this embodiment may be combined in any manner as a whole or in part and implemented. That is, in the first embodiment, the embodiments can be freely combined, or any of the components in each embodiment can be modified, or any of the components in each embodiment can be omitted.

[0067] The above-described embodiment is essentially a preferred example, and is not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, and the scope of use of the present disclosure. The above-described embodiment can be modified in various ways as necessary. For example, the procedure described using a flow chart or sequence chart may be modified as appropriate. [Explanation of symbols]

[0068] 10 parameter generation device, 11 pre-computation unit, 12 seed candidate generation unit, 13 primality determination unit, 14 seed representation generation unit, U search range, W weight range, b threshold, T, B, S, R sets, 80 signal line, 909 electronic circuit, 910 processor, 921 memory, 922 auxiliary storage device, 930 input / output interface, 950 communication interface.

Claims

1. A parameter generation device for generating a seed which is a parameter for determining an elliptic curve used in a pairing operation, comprising: a pre-calculation unit that receives a first polynomial and a second polynomial that constitute an elliptic curve family from which the elliptic curve is selected and a predetermined threshold value, calculates a root of the first polynomial and the second polynomial modulo a prime number equal to or less than the threshold value, and calculates, as a composite number condition, an integer condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of the first polynomial and the second polynomial becomes a composite number, using the root obtained by the calculation and the prime number equal to or less than the threshold value; a seed candidate generation unit that searches for integers whose Hamming weights of signed binary representations expressed in a non-adjacent format are within a predetermined weight range, removes integers that satisfy the composite number condition from a set of integers obtained by the search, and sets a set of integers remaining after removing the integers that satisfy the composite number condition as a set of seed candidates; a prime number determination unit that determines whether or not the first polynomial and the second polynomial are both prime numbers by substitution for each integer in the set of seed candidates, and extracts an integer for which the first polynomial and the second polynomial are both prime numbers from the set of seed candidates as the seed; A parameter generating device comprising:

2. The parameter generating device comprises: The parameter generating device according to claim 1 , further comprising a seed representation generating unit that represents the seed in a signed binary representation in which the amount of calculation required for the pairing operation is smaller than that of the non-adjacent format.

3. The pre-calculation unit is For p(x) being the first polynomial, r(x) being the second polynomial, and a prime number q, a root a which is a root of p(x) mod q or r(x) mod q is calculated, and the pair of the prime number q and the root a is set as the composite number condition; The seed candidate generation unit 3. The parameter generating device according to claim 1, wherein for an integer u in the set of integers obtained by the search, a pair of a prime number q and u mod q is generated, and if the pair of the prime number q and u mod q is included in the composite number condition, the integer u is deleted from the set of integers obtained by the search.

4. The pre-calculation unit is receiving the threshold and computing a root a, which is a root of p(x) mod q or r(x) mod q for p(x), r(x), and a prime number q less than or equal to the threshold; The seed candidate generation unit The parameter generating device according to claim 3 , which generates a pair of a prime number q equal to or less than the threshold and u mod q.

5. The seed candidate generation unit 3. The parameter generating device according to claim 1, further comprising: a search range for searching the seed; and an integer within the search range for which the Hamming weight is included is searched for.

6. The seed candidate generation unit 3. The parameter generating device according to claim 1, further comprising: a weight range receiving unit configured to search for an integer whose Hamming weight is included in the weight range.

7. A parameter generation method for use in a parameter generation device that generates a seed, which is a parameter that determines an elliptic curve used in a pairing operation, comprising: a computer receives a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected and a predetermined threshold value, calculates a root of the first polynomial and the second polynomial modulo a prime number equal to or less than the threshold value, and calculates, as a composite number condition, an integer condition under which at least one of a first integer and a second integer obtained by substituting integers into each of the first polynomial and the second polynomial becomes a composite number, using the root obtained by the calculation and the prime number equal to or less than the threshold value; a computer searches for an integer whose Hamming weight of a signed binary representation expressed in a non-adjacent format is within a predetermined weight range, removes integers satisfying the composite number condition from a set of integers obtained by the search, and sets a set of integers remaining after the removal of the integers satisfying the composite number condition as a set of seed candidates; a parameter generation method in which a computer determines, for each integer in the set of seed candidates, whether or not the first polynomial and the second polynomial are both prime numbers by substituting an integer, and extracts, as the seed, an integer from the set of seed candidates such that the first polynomial and the second polynomial are both prime numbers.

8. A parameter generation program for use in a parameter generation device that generates a seed, which is a parameter that determines an elliptic curve used in a pairing operation, comprising: a pre-calculation process of receiving a first polynomial and a second polynomial constituting an elliptic curve family from which the elliptic curve is selected and a predetermined threshold value, calculating roots of the first polynomial and the second polynomial modulo a prime number equal to or less than the threshold value, and calculating, as a composite number condition, an integer condition under which at least one of a first integer and a second integer obtained by substituting an integer into each of the first polynomial and the second polynomial becomes a composite number, using the root obtained by the calculation and the prime number equal to or less than the threshold value; a seed candidate generation process for searching for integers whose Hamming weights of signed binary representations expressed in a non-adjacent format are within a predetermined weight range, deleting integers that satisfy the composite number condition from a set of integers obtained by the search, and setting a set of integers remaining after deleting the integers that satisfy the composite number condition as a set of seed candidates; a prime number determination process for determining whether or not the first polynomial and the second polynomial are both prime numbers by substitution for each integer in the set of seed candidates, and extracting an integer for which the first polynomial and the second polynomial are both prime numbers from the set of seed candidates as the seed; A parameter generation program that causes a computer to execute the above.

Images