Scalar multiplication system, scalar multiplication device, scalar multiplication method and program

Abstract

A scalar multiplication device according to an embodiment is a scalar multiplication system which computes scalar multiplication for a point on an elliptic curve, and comprises: a pre-computation unit which computes, with respect to a point P on the elliptic curve and d integers ei (I∈[1, d]), a pre-computation table T composed of d points eiP having the same Z coordinate in a Jacobian coordinate system, by using elliptic curve addition or elliptic curve doubling via the Co-Z method; a conversion unit which converts a scalar value k into a scalar value k' expressed as k'=k0'20+k1'21+…+kn-1'2n-1(ki'∈{0, ±e1, …, ±ed}); and an evaluation unit which computes a scalar multiple k'P by using the pre-computation table T, the scalar value k', and the elliptic curve addition based on the Co-Z method.

Description

[Technical Field]

[0001] The present invention relates to a scalar multiplication system, a scalar multiplication device, a scalar multiplication method, and a program. [Background technology]

[0002] In cryptography using elliptic curve cryptography and pairing cryptography, the computational cost of scalar multiplication / multi-scalar multiplication on elliptic curves is dominant. For this reason, various methods for efficiently performing scalar multiplication / multi-scalar multiplication have been proposed.

[0003] Methods for efficiently executing scalar multiplication / multi-scalar multiplication can be broadly divided into methods that use a precomputed table and methods that do not. Methods that use a precomputed table are called precomputed scalar multiplication / multi-scalar multiplication (or online precomputed scalar multiplication / multi-scalar multiplication), and known methods include the w-NAF method, the Window method, and the Sliding Window method. In addition, a method is known that uses the Co-Z method to perform precomputation processing in precomputed scalar multiplication (Non-Patent Document 1). The Co-Z method is a method for efficiently calculating elliptic curve addition in a Jacobian coordinate system. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yoshitaka Nagai, Masaaki Shirase, Tetsuya Izu, and Yumi Sakami, "Accelerating Scalar Multiplication Using the Co-Z Method," SCIS 2014, 2014. Summary of the Invention [Problem to be solved by the invention]

[0005] However, in conventional precomputed scalar multiplication / multi-scalar multiplication using the Co-Z algorithm, for example, some processes require elliptic curve addition in the Jacobian coordinate system without using the Co-Z algorithm, or require transformation from the Jacobian coordinate system to an affine coordinate system, which makes some elliptic curve additions inefficient and requires additional computational costs for coordinate system transformation.

[0006] An embodiment of the present invention has been made in view of the above points, and has as its object to efficiently execute pre-computed scalar multiplication / multi-scalar multiplication. [Means for solving the problem]

[0007] In order to achieve the above object, a scalar multiplication device according to one embodiment is a scalar multiplication system for calculating scalar multiplication of a point on an elliptic curve, the scalar multiplication device including a point P on the elliptic curve and d integers e i For (i∈[1,d]), we use the Co-Z method to find d points e with the same Z coordinate in the Jacobian coordinate system. i A pre-calculation part calculates a pre-calculation table T consisting of P, and a scalar value k is calculated as k'=k0'2 0 +k1'2 1 +···+k n-1 '2 n-1 (k i '∈{0,±e1,···,±e d}), and an evaluation unit that uses the pre-calculation table T and the scalar value k' to calculate the scalar multiplication k'P using elliptic curve addition according to the Co-Z method. [Effects of the Invention]

[0008] It is possible to efficiently perform precomputed scalar multiplication / multi-scalar multiplication. [Brief explanation of the drawings]

[0009] [Figure 1]FIG. 1 is a diagram illustrating an example of a conventional multi-scalar multiplication algorithm using the Binary method. [Figure 2] FIG. 1 is a diagram illustrating an example of an algorithm for pre-computed scalar multiplication using a conventional w-NAF method. [Figure 3] FIG. 10 is a diagram illustrating an example of an algorithm for pre-calculation processing according to the present embodiment. [Figure 4] FIG. 10 is a diagram illustrating an example of an algorithm for evaluation processing according to the present embodiment. [Figure 5] FIG. 1 is a diagram illustrating an example of a hardware configuration of a scalar multiplication device according to an embodiment of the present invention. [Figure 6] FIG. 2 is a diagram illustrating an example of the functional configuration of a scalar multiplication device according to the present embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of a flowchart of pre-computation scalar multiplication according to the present embodiment. [Figure 8] FIG. 10 is a diagram illustrating an algorithm for pre-computation processing of pre-computed scalar multiplication using the w-NAF method in an embodiment. [Figure 9] FIG. 10 is a diagram illustrating an algorithm for evaluation of pre-computed scalar multiplication using the w-NAF method in the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will be described below. In this embodiment, a scalar multiplication device 10 capable of efficiently executing precomputed scalar multiplication / multi-scalar multiplication using the Co-Z algorithm will be described. The scalar multiplication device 10 according to this embodiment can be realized in various devices, such as a general-purpose server, a PC (personal computer), a smartphone, a tablet terminal, an embedded device, and a wearable device.

[0011] <Preparation> First, we will prepare some terms and concepts.

[0012] For a prime number p and a positive integer c, q=p c Let F be a finite fieldq Although F is actually written in bold letters (blackboard typeface), it is written as "F" in the text of the specification.

[0013] finite field F q For the elliptic curve E defined above, F on the elliptic curve q The set of rational points is defined below.

[0014] E(F q )={(x,y)∈E|x,y∈F q}∪O where O is the point at infinity.

[0015] In this case, E(F q ) is known to be an additive group. That is, E(F q ), then for any P,Q∈E(F q ), elliptic curve addition R = P + Q (where P ≠ ± Q) and elliptic curve doubling R = 2P can be calculated. Also, the point O at infinity is the zero element of the additive group, and any point P ∈ E(F q ), P+O=P. Note that hereinafter, elliptic curve addition and elliptic curve doubling are also referred to as elliptic curve addition and elliptic curve doubling, respectively.

[0016] <Coordinate System> An affine coordinate system is a coordinate system of a point P∈E(F q ) to P=(x,y)(x,y∈F q ) on the other hand, the Jacobian coordinate system is a coordinate system that expresses a point P∈E(F q ) to P=(X,Y,Z)(X,Y,Z∈F q ) is a coordinate system that expresses the point P = (X, Y, Z) (where Z ≠ 0) in the Jacobian coordinate system as (X / Z 2 ,Y / Z 3 ) = (x, y) can be converted into a point in the affine coordinate system. In the following, any point P∈E(F q ) are the X, Y and Z coordinates in the Jacobian coordinate system of P X , P Y and P Z It is expressed as:

[0017] ≪Co-Z method≫ Points P,Q∈E(F q ) in the Jacobian coordinate system is P=(P X ,P Y ,P Z ),Q=(Q X ,Q Y ,Q Z ) In this case, the Co-Z method is Z =Q Z It is a method that can efficiently calculate elliptic curve addition P+Q.

[0018] Using the Co-Z algorithm, the following elliptic curve addition can be efficiently computed in Jacobian coordinates:

[0019] (R,P',t)←P+Q Here, point R is the result of adding P+Q, point P' is equivalent to P, and point P' Z =R Z (i.e., the Z coordinate of P' is the same as the Z coordinate of R), and t is the point where R Z =tP Z It is an auxiliary output that satisfies the following.

[0020] Similarly, the Co-Z algorithm can be used to efficiently compute the following elliptic curve doubling in Jacobian coordinates:

[0021] (R,P',t)←2P Here, point R is the result of 2P, and point P' is equivalent to P, so P' Z =R Z t is the point where R Z =tP Z It is an auxiliary output that satisfies the following.

[0022] For details of the Co-Z method, please refer to, for example, the above-mentioned Non-Patent Document 1 and Reference Document 1 "N. Meloni, "New Point Addition Formulae for ECC Applications," WAIFI 2007, LNCS 4547, pp. 189-201, 2007."

[0023] <Scalar multiplication / multi-scalar multiplication> Scalar multiplication on an elliptic curve is a multiplication of a point P∈E(F q ) and for an integer k greater than or equal to 0,

[0024]

number

[0025] Multiscalar multiplication is an extension of scalar multiplication, which is performed on m elliptic curve points P0, , P m-1 and m integers k0, ,k m-1 In contrast,

[0026]

number

[0027] a scalar value k i is an n-bit binary number

[0028]

number

[0029] At this time, the most basic multiscalar multiplication algorithm is known to use the binary method. This algorithm does not use a pre-calculated table. An example of the multiscalar multiplication algorithm using the binary method is shown in Figure 1. As shown in Figure 1, the multiscalar multiplication algorithm using the binary method is m-1 ∈E(F q ) and m scalar values ​​k0, ,k m-1It takes input and outputs the result of multi-scalar multiplication, R. After initializing R to O (line 1), it repeats the procedure from lines 3 to 8 while decreasing j by 1 from j = n-1 to j = 0 (line 2), and finally outputs R (line 10). In the procedure from lines 3 to 8, first R is set to 2R (line 3), then it repeats the procedure from lines 5 to 7 while increasing i by 1 from i = 0 to i = m-1 (line 4). In the procedure from lines 5 to 7, k i,j If =1 (line 5), then R←R+P i Update R by (line 6).

[0030] <Precomputed scalar multiplication / multiple scalar multiplication> For simplicity, the following description will be made on scalar multiplication with precomputation. As described above, multiscalar multiplication is an extension of scalar multiplication, so the following description can be easily extended to multiscalar multiplication.

[0031] Precomputed scalar multiplication is a scalar multiplication for a point P∈E(F q ) and a scalar value k, the scalar multiplication result kP is calculated using the following three processes.

[0032] Precalculation process: Point P∈E(F q ) and d integers e1, ,e d For point e i P(i∈[1,d]) and calculate the points where P(i∈[1,d]) is the pre-calculated table T={e1P, ,e d P}.

[0033] Scalar value conversion process: Scalar value k is converted to k0'2 0 +k1'2 1 +···+k n-1 '2 n-1 where k i '∈{0,±e1,···,±e d}.

[0034] In other words, in the scalar value conversion process, the base is 2, i(where i∈[0,n-1]) is the mantissa corresponding to k i ', and k is (k n-1 When expressed in the numeral system as ',...,k0', each digit is 0 or ±e i Convert to the value k' such that (i∈[1,d]).

[0035] Evaluation process: Using the precomputed table T and the scalar value k', k'P is calculated by elliptic curve addition and elliptic curve doubling.

[0036] The w-NAF method is known as one of the methods for fast execution of precomputed scalar multiplication. An example of the algorithm for precomputed scalar multiplication using the w-NAF method is shown in Figure 2. As shown in Figure 2, the algorithm for precomputed scalar multiplication using the w-NAF method is q ), a scalar value k∈N (where N is the set of all natural numbers), and a window width w∈N (where w>1) are input, and the scalar multiplication result R=kP is output. After performing pre-computation processing (lines 1 to 4), scalar value conversion processing (line 5), and evaluation processing (lines 6 to 16), R is finally output (line 17).

[0037] In the pre-calculation process, after initializing P[i]←P and A←2P for i=1 (line 1), w-2 Increment i by 1 up to -1 and set P[2i+1]←A+P[2i-1] (lines 2 to 4). This creates the pre-calculated table T={P[1],P[3],...,P[2 w-1 -1]}={P,3P,···,(2 w-1 -1)P} is obtained.

[0038] In the scalar value conversion process, the scalar value k is converted as k'=k0'2 0 +k1'2 1 +···+k n-1 '2 n-1 (However, k i '∈{0,±1,±3,···,±(2 w-1 -1)}) (line 5).

[0039] In the evaluation process, after initializing R←O (line 6), we repeat the procedure from line 8 to line 15 while decreasing i by 1 from i=n-1 to i=0 (line 7). In the procedure from line 8 to line 15, after setting R←2R (line 8), k i ' ≠ 0 and k i '>0, then R←R+P[k i '] (line 11), and i ' ≠ 0 and k i 'If ≦0, R←RP[-k i '] updates R (line 13), otherwise does nothing.

[0040] <Precomputed scalar multiplication / multi-scalar multiplication according to this embodiment> Next, the precomputed scalar multiplication / multi-scalar multiplication according to this embodiment will be described. For simplicity, the following mainly describes the precomputed scalar multiplication according to this embodiment. As described above, multi-scalar multiplication is an extension of scalar multiplication, and therefore the following description can be easily extended to multi-scalar multiplication.

[0041] In the scalar multiplication according to this embodiment, elliptic curve addition and elliptic curve doubling by the Co-Z method are used to calculate all points e1P,...,e d A pre-calculation table T is created so that the Z coordinate of P has the same value. This makes it possible to efficiently calculate elliptic curve addition using the Co-Z method even in the evaluation process. Note that the scalar value conversion process is the same as conventional scalar multiplication with pre-calculation (for example, the conventional w-NAF method or Sliding Window method).

[0042] <<Pre-calculation processing>> Point P∈E(F q ), the set of d points to be calculated in the pre-calculation process is defined as {P(=e1P),e2P,...,e d P}. Also, let a be a natural number, and e i Let P be calculated as follows:

[0043] e i P←e i-1 P+aP or e i P←2e i-1 P In addition, each e i P may be a negative point if appropriate.

[0044] In this case, the Z coordinates of all points are the same in the pre-calculated table T = {P, e2P, , e d An example of the algorithm for the precomputation process to create point P∈E(F q ) and a natural number a as input, and the pre-calculated table T = {P, e2P, , e d P}. In Figure 3, for simplicity, P[e i ] (where i∈[1,d]) is denoted as P[i].

[0045] In the pre-computation process shown in Figure 3, first, in the procedure from line 1 to line 3, A←aP, P[1]←P, t1 is set to A Z =t1P Z However, in the procedure on the second line, A Z =P[1] Z (i.e., P[1] is the point whose Z coordinate is the same as the Z coordinate of A).

[0046] Next, we repeat the procedure from line 5 to line 10 while incrementing i by 1 from i=2 to i=d (line 4). In the procedure from line 5 to line 10, when performing elliptic curve addition, A Z ≠P[i-1] Z In the case of P[i-1], A is transformed to a point whose Z coordinate is the same as P[i-1] (line 6), and (P[i],A,t i )←A+P[i-1] (line 7). On the other hand, when performing elliptic curve doubling, (P[i], A ,t i )←2P[i-1] (line 9). Note that line 7 uses elliptic curve addition using the Co-Z method, and line 9 uses elliptic curve doubling using the Co-Z method.

[0047] Next, s←t d After that (line 12), we repeat the procedure from line 14 to line 17 while decreasing i by 1 from i=d-1 to i=1 (line 13). In the procedure from line 14 to line 17, P[i] X ←P[i] X ·s 2 and P[i] Y ←P[i] Y ·s 3 and P[i] Z ←P[i] Z ·s and s←s·t i This allows each P[i]=(P[i] X ,P[i] Y ,P[i] Z ) will have the same Z coordinate.

[0048] And finally, the pre-computed table T={P[1],P[e2],···,P[e d ]}={P,e2P,···,e d P} (line 19).

[0049] In addition, in the Co-Z method of elliptic curve addition, t i instead of t i 2 ,t i 3 can be calculated without any computational cost. Therefore, in the pre-calculation process shown in Figure 3, lines 14 and 15, 2 and s 3 It is also possible to improve efficiency by directly calculating the

[0050] In addition, the precomputation process shown in Figure 3 can be implemented as a multi-scalar multiplication k0P0+···+k m-1 P m-1 When applied to each P i After executing the procedures in lines 1 to 11 of Figure 3, all P i Execute the procedure from line 12 to line 19 in Figure 3 for i ≥ 1. i Before executing the procedures in lines 1 to 11 of Figure 3, i-1 [e d ] for the Z coordinate of PiZ =P i-1 [e d ] Z (i.e., P i The Z coordinate of P i-1 [e d ]) so that P i Convert.

[0051] <Scalar value conversion processing> As described above, the scalar value conversion process of the pre-computed scalar multiplication according to this embodiment is the same as the scalar value conversion process of the conventional pre-computed scalar multiplication. m-1 P m-1 When applied to each k i All that is required is to perform scalar value conversion processing on (i∈[0,m-1]).

[0052] <Evaluation process> The pre-calculated table is T, and the scalar value after scalar value conversion is k'=k0'2 0 +k1'2 1 +···+k n-1 '2 n-1 (However, k i '∈{0,±e1,···,±e d}). At this time, the algorithm of the evaluation process of the precomputed scalar multiplication according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the evaluation process of the precomputed scalar multiplication according to this embodiment receives the precomputed table T and the scalar value k' after scalar value conversion as inputs, and outputs the result of the scalar multiplication R = k'P.

[0053] In the evaluation process shown in Figure 4, after first initializing R←O (line 1), the procedure from lines 3 to 12 is repeated while decreasing i by 1 from i=n-1 to i=0 (line 2), and finally R is output (line 14). In the procedure from lines 3 to 12, after R←2R (line 3), k i ' ≠ 0 and k i '>0, then A←P[k i '] (line 6), k i ' ≠ 0 and k i'If ≦0, A←-P[-k i '] (line 8), and A is R Z =A Z (i.e., the R and Z coordinates are the same) (line 10), and then R is updated by R←R+A (line 11). i If '=0, nothing is done. Note that line 11 uses elliptic curve addition using the Co-Z method, which makes scalar multiplication more efficient.

[0054] The evaluation process shown in FIG. 4 can be applied directly to multi-scalar multiplication.

[0055] <Hardware Configuration of Scalar Multiplication Unit 10> Next, the hardware configuration of the scalar multiplication device 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the hardware configuration of the scalar multiplication device 10 according to this embodiment.

[0056] 5, the scalar multiplication device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a processor 105, and a memory device 106. These pieces of hardware are connected to each other via a bus 107 so as to be able to communicate with each other.

[0057] The input device 101 is, for example, a keyboard, a mouse, a touch panel, various buttons, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the scalar multiplication device 10 does not necessarily have to include at least one of the input device 101 and the display device 102.

[0058] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0059] The communication I / F 104 is an interface for connecting the scalar multiplication device 10 to a communication network. The processor 105 is, for example, various types of arithmetic devices such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The memory device 106 is, for example, various types of storage devices such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), a RAM (Random Access Memory), a ROM (Read Only Memory), and a flash memory.

[0060] The scalar multiplication device 10 according to this embodiment can realize the precomputed scalar multiplication described below by having the hardware configuration shown in Fig. 5. However, the hardware configuration shown in Fig. 5 is just an example, and the hardware configuration of the scalar multiplication device 10 is not limited to this.

[0061] <Functional Configuration of Scalar Multiplication Device 10> Next, the functional configuration of the scalar multiplication device 10 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the scalar multiplication device 10 according to this embodiment.

[0062] 6, the scalar multiplication device 10 according to this embodiment includes a pre-calculation processing unit 201, a scalar value conversion processing unit 202, and an evaluation processing unit 203. These units are realized by processing that is executed by the processor 105 in accordance with one or more programs installed in the scalar multiplication device 10.

[0063] The pre-calculation processing unit 201 executes the pre-calculation processing according to the algorithm shown in Fig. 3. The pre-calculation table T created in the pre-calculation processing is stored in the memory device 106.

[0064] The scalar value conversion processing unit 202 converts the scalar value k into a scalar value k' by a conventional scalar value conversion process of scalar multiplication with pre-calculation.

[0065] The evaluation processing unit 203 executes the evaluation process using the algorithm shown in Fig. 4. This results in a scalar multiplication result (or a multi-scalar multiplication result when the algorithm shown in Fig. 3 is applied to the multi-scalar multiplication).

[0066] <Flow of precomputed scalar multiplication> Next, the flow of the pre-computation scalar multiplication according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of a flowchart of the pre-computation scalar multiplication according to this embodiment.

[0067] First, the precalculation processing unit 201 executes precalculation processing using the algorithm shown in Fig. 3 (step S101). Next, the scalar value conversion processing unit 202 converts the scalar value k into the scalar value k' using the scalar value conversion processing of conventional scalar multiplication with precalculation (step S102). Then, the evaluation processing unit 203 executes evaluation processing using the algorithm shown in Fig. 4 (step S103). However, steps S101 and S102 may be executed in any order, and step S101 may be executed after step S102.

[0068] <Example> Next, as an example of the pre-computed scalar multiplication according to this embodiment, a case where it is applied to the w-NAF method will be described. q 8 and 9 show the algorithms of the pre-computation process and the evaluation process when scalar multiplication device 10 is provided with scalar value k, scalar value k, and window width w. The pre-computation process is executed by pre-computation processing unit 201, and the evaluation process is executed by evaluation processing unit 203. The scalar value conversion process is executed by scalar value conversion processing unit 202, although a description thereof will be omitted since it is similar to the conventional w-NAF method.

[0069] <<Pre-calculation processing>> In the pre-calculation process shown in Figure 8, first, (A, P[1], t1)←2P (first line), and then, from i=1 to i=2 w-2 Increasing i by 1 until -1 (P[2i+1],A,t i+1 )←A+P[2i-1] (line 3). Note that the procedure in line 1 is elliptic curve doubling using the Co-Z method, and the procedure in line 3 is elliptic curve addition using the Co-Z method.

[0070] next,

[0071]

number

[0072] And finally, the precomputed table T={P[1],P[3],...,P[2 w-1 -1]}={P,3P,···,(2 w-1 -1)P} (line 13).

[0073] <Evaluation process> In the evaluation process shown in FIG. 9, first, R←O and Z←P[1] Z (lines 1 and 2), and then repeat the steps from lines 4 to 17 while decreasing i by 1 from i=n-1 to i=0 (line 3). Then, R←(R X ,R Y ,R ZIn the procedure from lines 4 to 17, after setting R ← 2R (line 4), k i ' ≠ 0 and k i '>0, then A←P[k i '] (line 7), k i ' ≠ 0 and k i 'If ≦0, A←-P[-k i '] (line 9). Also, k i '≠0, if R=0, then R←(A X ,A Y ,1) (line 12), and if R ≠ O, then A ← (R Z 2 A X ,R Z 3 A Y ,R Z ) and R←R+A (lines 14-15). On the other hand, k i If '=0, do nothing.

[0074] In the evaluation process shown in Figure 9, the Z coordinate is set to 1 when assigning the initial value of R on line 12 in order to use the Co-Z algorithm in the elliptic curve addition on line 15. This causes the Z coordinate of R to be 1 / Z of its original value, so on line 14, Z In addition, by multiplying the Z coordinate by Z on line 19, the change in the Z coordinate is corrected, and the correct calculation result is obtained.

[0075] <Comparison with conventional methods> Here, the pre-computation scalar multiplication using the Co-Z method described in Non-Patent Document 1 will be compared with the pre-computation scalar multiplication executed by the scalar multiplication device 10 according to this embodiment.

[0076] Non-Patent Document 1 describes a method for performing pre-computation processing using the Co-Z algorithm, and then performing two types of evaluation processing using the pre-computation table created in this pre-computation processing. The first method uses the pre-computation table as is, and calculates the result of scalar multiplication using elliptic curve addition and elliptic curve doubling in the Jacobian coordinate system in the evaluation processing. The second method converts the points that make up the pre-computation table from the Jacobian coordinate system to the affine coordinate system, and then calculates the result of scalar multiplication using elliptic curve doubling in the Jacobian coordinate system and elliptic curve addition in mixed coordinates using Jacobian coordinates and affine coordinates as inputs in the evaluation processing.

[0077] The first method described in Non-Patent Document 1 is fast because it uses the Co-Z method in the pre-calculation process, but the elliptic curve addition in the evaluation process is slow because it is elliptic curve addition in the normal Jacobian coordinate system that does not use the Co-Z method. On the other hand, the second method is also fast in the pre-calculation process and can use fast elliptic curve addition in mixed coordinates in the evaluation process, but it is necessary to convert the points that make up the pre-calculation table into an affine coordinate system. The conversion from the Jacobian coordinate system to the affine coordinate system requires F for each point. q This requires the above multiplication and inversion, which is inefficient.

[0078] In contrast, in the pre-calculated scalar multiplication performed by the scalar multiplication device 10 according to this embodiment, the Z coordinates of the points constituting the pre-calculated table are converted to the same value by utilizing the properties of the Co-Z algorithm, and the F q Coordinate transformation can be performed by performing the above multiplication several times. In addition, in the evaluation process, coordinate transformation and elliptic curve addition using the Co-Z method can be calculated with the same computational cost as that of mixed coordinate calculations.

[0079] Therefore, the pre-computation scalar multiplication performed by the scalar multiplication device 10 according to this embodiment overcomes the disadvantages of the pre-computation scalar multiplication described in Non-Patent Document 1, and can perform scalar multiplication at a higher speed.

[0080] <Summary> As described above, the scalar multiplication device 10 according to this embodiment can perform pre-computed scalar multiplication more efficiently than conventional methods. Furthermore, since multi-scalar multiplication is an extension of scalar multiplication, the scalar multiplication device 10 according to this embodiment can also perform multi-scalar multiplication efficiently.

[0081] Note that elliptic curve cryptography is used, for example, when performing secure communications such as SSL / TLS. Pairing cryptography is also used, for example, when establishing sophisticated cryptographic methods such as ID-based cryptography and functional cryptography. Therefore, the scalar multiplication device 10 according to the present embodiment can be applied to, for example, devices, apparatuses, or systems that communicate using SSL / TLS or the like, or to devices, apparatuses, or systems that perform key generation, encryption, decryption, and the like using ID-based cryptography, functional cryptography, or the like.

[0082] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0083] 10 Scalar multiplication unit 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 processors 106 Memory Device 107 Bus 201 Pre-computation processing unit 202 Scalar value conversion processing unit 203 Evaluation Processing Unit

Claims

1. A scalar multiplication system for calculating a scalar multiplication of a point on an elliptic curve, comprising: A point P on the elliptic curve and d integers e ｉ For (i ∈ [1, d]), use the Co-Z method to calculate elliptic curve addition or elliptic curve doubling to find d points e whose Z coordinates in the Jacobian coordinate system are all the same. ｉ P (where e １ A pre-calculation unit for calculating a pre-calculated table T consisting of P=P; Let the scalar value k be k'=k'. ０ '2 ０ +k １ '2 １ +...+k ｎ－１ '2 ｎ－１ (k ｉ '∈{0, ±e １ , ..., ±e ｄ }), an evaluation unit that uses the pre-calculation table T and the scalar value k' to calculate a scalar multiplication k'P using elliptic curve addition by the Co-Z method; having The pre-calculation unit is For a predetermined natural number a, A←aP, P[1]←P (where the Z coordinate of P[1] is the same as the Z coordinate of A), and t 1 is a value that satisfies A Z =t 1 P Z (where A Z is the Z coordinate of A, and P Z is the Z coordinate of P), When performing elliptic curve addition, for i = 2, ..., d, if the Z coordinate of P[i-1] is different from the Z coordinate of A, transform A to a point whose Z coordinate is the same as P[i-1], and then calculate (P[i], A, t i ) ← A + P[i-1] by elliptic curve addition using Co-Z. When performing elliptic curve doubling, for i = 2, ..., d, calculate (P[i], A, t i ) ← 2P[i-1] by elliptic curve doubling using Co-Z, Let P[i]X, P[i]Y, and P[i]Z be the X, Y, and Z coordinates of P[i], respectively, and set s←t d. Then, for i=d-1, ..., 1, perform P[i]X←P[i]X ·s 2, P[i]Y←P[i]Y ·s 3, P[i]Z←P[i]Z ·s, and s←s ·t i, A scalar multiplication system that calculates the pre-computed table T = {P[1], P[2], ..., P[d]} = {P, e2P, ..., edP}.

2. Multi-scalar multiplication k ０ P ０ +...+k ｍ－１ P ｍ－１ When calculating The pre-calculation unit calculates each point P ｉ For (i ∈ [0, m-1]), a pre-computed table T ｉ Calculate The converter converts each scalar value k ｉ (i∈[0,m-1]) ｉ '=k ｉ０ '2 ０ +k ｉ１ '2 １ +...+k ｉｎ－１ '2 ｎ－１ (k ｉｊ '∈{0, ±e １ , ..., ±e ｄ }), The evaluation unit evaluates the pre-calculated table T ｉ (i∈[0,m-1]) and the transformed scalar value k ｉ '(i∈[0,m-1]) and multi-scalar multiplication k ０ 'P ０ +...+k ｍ－１ 'P ｍ－１ The scalar multiplication system of claim 1 , which calculates:

3. A scalar multiplication device for calculating a scalar multiplication of a point on an elliptic curve, comprising: A point P on the elliptic curve and d integers e ｉ For (i ∈ [1, d]), use the Co-Z method to calculate elliptic curve addition or elliptic curve doubling to find d points e whose Z coordinates in the Jacobian coordinate system are all the same. ｉ P (where e １ A pre-calculation unit for calculating a pre-calculated table T consisting of P=P; Let the scalar value k be k'=k'. ０ '2 ０ +k １ '2 １ +...+k ｎ－１ '2 ｎ－１ (k ｉ '∈{0, ±e １ , ..., ±e ｄ }), an evaluation unit that uses the pre-calculation table T and the scalar value k' to calculate a scalar multiplication k'P using elliptic curve addition by the Co-Z method; having The pre-calculation unit is For a predetermined natural number a, A←aP, P[1]←P (where the Z coordinate of P[1] is the same as the Z coordinate of A), and t 1 is a value that satisfies A Z =t 1 P Z (where A Z is the Z coordinate of A, and P Z is the Z coordinate of P), When performing elliptic curve addition, for i = 2, ..., d, if the Z coordinate of P[i-1] is different from the Z coordinate of A, transform A to a point whose Z coordinate is the same as P[i-1], and then calculate (P[i], A, t i ) ← A + P[i-1] by elliptic curve addition using Co-Z. When performing elliptic curve doubling, for i = 2, ..., d, calculate (P[i], A, t i ) ← 2P[i-1] by elliptic curve doubling using Co-Z, Let P[i]X, P[i]Y, and P[i]Z be the X, Y, and Z coordinates of P[i], respectively, and set s←t d. Then, for i=d-1, ..., 1, perform P[i]X←P[i]X ·s 2, P[i]Y←P[i]Y ·s 3, P[i]Z←P[i]Z ·s, and s←s ·t i, A scalar multiplication device that calculates the pre-computed table T = {P[1], P[2], ..., P[d]} = {P, e2P, ..., edP}.

4. A computer that computes scalar multiplication of points on an elliptic curve A point P on the elliptic curve and d integers e ｉ For (i ∈ [1, d]), use the Co-Z method to calculate elliptic curve addition or elliptic curve doubling to find d points e whose Z coordinates in the Jacobian coordinate system are all the same. ｉ P (where e １ a pre-computation procedure for computing a pre-computed table T consisting of Let the scalar value k be k'=k'. ０ '2 ０ +k １ '2 １ +...+k ｎ－１ '2 ｎ－１ (k ｉ '∈{0, ±e １ , ..., ±e ｄ }), and an evaluation procedure for calculating a scalar multiplication k′P using the pre-calculation table T and the scalar value k′ by utilizing elliptic curve addition according to the Co-Z method; Run The pre-computation step comprises: For a predetermined natural number a, A←aP, P[1]←P (where the Z coordinate of P[1] is the same as the Z coordinate of A), and t 1 is a value that satisfies A Z =t 1 P Z (where A Z is the Z coordinate of A, and P Z is the Z coordinate of P), When performing elliptic curve addition, for i = 2, ..., d, if the Z coordinate of P[i-1] is different from the Z coordinate of A, transform A to a point whose Z coordinate is the same as P[i-1], and then calculate (P[i], A, t i ) ← A + P[i-1] by elliptic curve addition using Co-Z. When performing elliptic curve doubling, for i = 2, ..., d, calculate (P[i], A, t i ) ← 2P[i-1] by elliptic curve doubling using Co-Z, Let P[i]X, P[i]Y, and P[i]Z be the X, Y, and Z coordinates of P[i], respectively, and set s←t d. Then, for i=d-1, ..., 1, perform P[i]X←P[i]X ·s 2, P[i]Y←P[i]Y ·s 3, P[i]Z←P[i]Z ·s, and s←s ·t i, A scalar multiplication method for calculating the pre-computed table T = {P[1], P[2], ..., P[d]} = {P, e2P, ..., edP}.

5. A program for causing a computer to function as the scalar multiplication system according to claim 1 or 2.

Images