Isogeny mapping calculation device, isogeny mapping calculation method and program

Abstract

To improve the processing speed of isogeny calculation.SOLUTION: An isogeny calculation device includes a storage section and an isogeny calculation section. The storage section stores, as a pre-calculated value, an intermediate value, among a plurality of intermediate values used for isogeny calculation, which is determined from an elliptic point T obtained by repeatedly performing L-point multiplication (where L is a positive integer) and M-isogeny (where M is a positive integer) on an elliptic point S serving as a kernel of the isogeny. The isogeny calculation section identifies the elliptic point T serving as the kernel of the M-isogeny according to lower e digits (where e is a positive integer) of an L-adic representation of a secret key sk that determines the elliptic point S, reads the pre-calculated value determined from the elliptic point T from the storage section, and performs at least one of calculations of the L-point multiplication and the M-isogeny using the pre-calculated value read from the storage section.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an isogenous mapping calculation device, an isogenous mapping calculation method, and a program. [Background technology]

[0002] In recent years, research into quantum computers has accelerated with the entry of major IT companies. If a quantum computer capable of decrypting currently widely used public key cryptography such as RSA or elliptic curve cryptography were to be realized, information security systems using RSA or elliptic curve cryptography would no longer be secure. Therefore, research and development into quantum-resistant cryptography is underway in preparation for the need to transition from RSA or elliptic curve cryptography to quantum-resistant cryptography (also known as quantum-resistant public key cryptography or post-quantum cryptography). One of the leading candidates for quantum-resistant cryptography is isogenous mapping cryptography, whose security is based on the isogenous mapping problem. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] U.S. Patent No. 10,812,265 [Patent Document 2] U.S. Patent No. 11,032,074 [Non-patent literature]

[0004] [Non-Patent Document 1] Supersingular Isogeny Key Encapsulation, [online], [Retrieved May 11, 2022], Internet〈URL:https: / / csrc.nist.gov / CSRC / media / Projects / post-quantum-cryptography / documents / round-3 / submissions / SIKE-Round3.zip〉 Summary of the Invention [Problem to be solved by the invention]

[0005] However, with conventional techniques, it has been difficult to improve the processing speed of isogeny mapping calculations. [Means for solving the problem]

[0006] An isogenous mapping calculation device according to an embodiment includes a storage unit and an isogenous mapping calculation unit. The storage unit stores, as pre-computed values, intermediate values ​​determined from an elliptic point T obtained by repeatedly performing point L-multiplication (L is a positive integer) and M-isogeneic mapping (M is a positive integer) on an elliptic point S that is a kernel of the isogenous mapping, among multiple intermediate values ​​used in the isogenous mapping calculation. The isogenous mapping calculation unit identifies an elliptic point T that is a kernel of the M-isogeneic mapping according to the lowest e digits (e is a positive integer) of an L-adic representation of a secret key sk that determines the elliptic point S, reads from the storage unit the pre-computed value determined from the elliptic point T, and calculates at least one of the point L-multiplication and the M-isogeneic mapping using the pre-computed value read from the storage unit. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 10 is a diagram showing an example of a key sharing process of SIDH. [Figure 2] A diagram showing an example of the L^e_L-isogeny mapping calculation algorithm (when L=2). [Figure 3] A diagram showing an example of values ​​indicated by the variables of the algorithm in Figure 2 (when e_2=3). [Figure 4] A diagram showing an example of a tree structure showing the calculation order of L^e_L-isogene mapping calculation (when e_L=7). [Figure 5] FIG. 10 is a diagram showing an example of pre-calculated values ​​according to the embodiment. [Figure 6] FIG. 1 is a diagram showing an example of the functional configuration of an isogenous mapping calculation device according to an embodiment. [Figure 7] 10A to 10C are diagrams showing examples of variations of pre-calculated values ​​in the public key generation process according to the embodiment. [Figure 8] 10A to 10C are diagrams showing examples of variations of pre-calculated values ​​in the shared key establishment process of the embodiment. [Figure 9]FIG. 1 is a diagram illustrating an example of a hardware configuration of an isogenous mapping calculation apparatus according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, embodiments of an isogenous mapping calculation device, an isogenous mapping calculation method, and a program will be described in detail with reference to the accompanying drawings.

[0009] Isogeny cryptography is a quantum-resistant cryptography whose security is based on the isogeny problem. For example, SIKE (Supersingular Isogeny Key Encapsulation) is a candidate standard for quantum-resistant cryptography by the National Institute of Standards and Technology (NIST). In isogeny cryptography, scalar multiplication and isogeny calculation (realized by a combination of point L multiplication and L-isogeny calculation, where L is a positive integer) are performed on elliptic points on an elliptic curve.

[0010] Although isogenous mapping cryptography has the advantage of having a smaller key size than other quantum-computer-resistant cryptography (such as lattice cryptography and code cryptography), it has the disadvantage of requiring a large number of execution cycles for key generation, encryption, decryption, key encapsulation, and key decapsulation. Therefore, to alleviate this drawback, the isogenous mapping calculation device of the embodiment speeds up the isogenous mapping calculation, which is the main process of isogenous mapping cryptography.

[0011] In isogeny mapping cryptography, public key cryptography and key encapsulation mechanism (KEM) are constructed using a key agreement method. For example, in SIKE, SIDH (Supersingular isogeny Diffie-Hellman key exchange) is used as the key agreement method. The main processing of isogeny mapping cryptography algorithms is in the key agreement method. Therefore, we will first briefly explain an example of the key agreement process of SIDH.

[0012] FIG. 1 is a diagram illustrating an example of a key sharing process in SIDH.

[0013] In SIDH, a key (hereinafter referred to as a "shared key") is secretly shared between Alice and Bob. Note that Alice and Bob represent hypothetical parties (e.g., information processing devices) that perform encrypted communication, and according to convention, Alice and Bob are also used in the description of the embodiments.

[0014] The shared key is calculated using one's own private key and the other party's (communicating party's) public key (public parameters). The public parameters are a positive integer L, a positive integer e_L, an elliptic curve E_0, an elliptic point P_L, and an elliptic point Q_L. Elliptic point P_L and elliptic point Q_L are points on the elliptic curve E_0 of order L^e_L (L raised to the power of e_L, ^ represents the exponent). The private key space is K_L={0,1,2,...,L^e_L-1}.

[0015] For two positive integers L and L', the elliptic curve E_0 is an isogeny determined by the elliptic point S_L, and the elliptic curve E_0 / <S_L> Then, the elliptic curve E_0 / <S_L,S_L’> and the elliptic curve E_0 is mapped to E_0 / by an isogeny determined by the elliptic point S_L'.<S_L’> Then, the elliptic curve E_0 / <S_L, S_L’> and the elliptic curve E_0 / <S_L, S_L’> The j-invariants of the two are equal. This j-invariant is the shared key. The key agreement scheme includes two steps: public key generation and shared key establishment.

[0016] <Public key generation step> For example, let L = 2 and L' = 3. Elliptic curve E_0, elliptic point P_2, elliptic point Q_2, elliptic point P_3, and elliptic point Q_3 are given by public parameters.

[0017] Alice obtains a random number (private key) sk_2 from the private key space K_2, and calculates the elliptic point S_2=P_2+[sk_2]Q_2 determined by the random number sk_2 using scalar multiplication. Here, the scalar multiplication is expressed as [sk]Q for the scalar value sk and the elliptic point Q. Alice calculates the group generated by the elliptic point S_2.<S_2> The secret isogenous map φ_2^e_2:E_0→E_0 / with kernel<S_2> Calculate.

[0018] Bob obtains a random number sk_3 from the private key space K_3, and calculates the elliptic point S_3=P_3+[sk_3]Q_3 determined by the random number sk_3 using scalar multiplication. Bob then calculates the group generated by the elliptic point S_3.<S_3> The secret isogenous map φ_3^e_3:E_0→E_0 / with kernel<S_3> Calculate.

[0019] Alice has public key pk_2={E_0 / <S_2> ,φ_2^e_2(P_3),φ_2^e_2(Q_3)} and publish it, and Bob calculates and publishes the public key pk_3={E_0 / <S_3> ,φ_3^e_3(P_2),φ_3^e_3(Q_2)} and publish it.

[0020] <Shared key establishment step> Alice calculates the elliptic point φ_3^e_3(S_2)=φ_3^e_3(P_2)+[sk_2]φ_3^e_3(Q_2) determined by the random number sk_2 using scalar multiplication with the elliptic points φ_3^e_3(P_2) and φ_3^e_3(Q_2) of Bob's public key pk_3 and Alice's private key sk_2. Alice calculates the secret isogenous mapping φ'_2^e_2:E_0 / <S_3> →E_0 / <S_2,S_3> Calculate.

[0021] Bob calculates the elliptic point φ_2^e_2(S_3)=φ_2^e_2(P_3)+[sk_3]φ_2^e_2(Q_3) determined by the random number sk_3 using scalar multiplication with Alice's public keys φ_2^e_2(P_3), φ_2^e_2(Q_3) and Bob's private key sk_3. Bob calculates the secret isogeny map φ'_3^e_3:E_0 / with the kernel <φ_2^e_2(S_3)> generated by the elliptic point φ_2^e_2(S_3).<S_2> →E_0 / <S_2,S_3> Calculate.

[0022] Hereinafter, in the above public key generation step, the process of generating Alice's public key for her private key (public key generation process) will be represented as isogen_2(sk_2)→pk_2, and the process of generating Bob's public key for Bob's private key will be represented as isogen_3(sk_3)→pk_3.

[0023] In addition, in the shared key establishment step, the process (shared key establishment process) of calculating the shared key (j-invariant) using Bob's public key and Alice's private key is represented as isoex_2(pk_3,sk_2)→j, and the process of calculating the shared key using Alice's public key and Bob's private key is represented as isoex_3(pk_2,sk_3)→j.

[0024] As described above, in the public key generation process isogen_L(sk_L) → pk_L and the shared key establishment process isoex_L(pk_L',sk_L) → j, scalar multiplication using the private key sk_L as a scalar value and an L^e_L-isogeneous mapping calculation are performed. The L^e_L-isogeneous mapping calculation accounts for a large proportion of the number of execution cycles. In the following, the L^e_L-isogeneous mapping calculation in the public key generation process will be explained as an example, but the L^e_L-isogeneous mapping calculation in the shared key establishment process is similar.

[0025] In the L^e_L-isogene map calculation, a secret isogenous map φ_L^e_L:E_0→E_0 / with the elliptic point S_L determined by the secret key sk_L is calculated.<S_L> The L^e_L-isogeny calculation is realized by combining point L-multiplication and L-isogeny calculation.

[0026] Specifically, first, an L-isogeny map φ_L is calculated, with the elliptic point [L^(e_L-1)]S_L, which is obtained by multiplying the elliptic point S_L by point L (e_L-1) times, as the kernel.

[0027] Next, for the elliptic point φ_L(S_L) obtained by L-isogeny mapping the elliptic point S_L, an L-isogeny mapping φ_L is calculated with the kernel being the elliptic point [L^(e_L-2)]φ_L(S_L) obtained by point-L-multiplying the elliptic point φ_L(S_L) (e_L-2) times. Similarly, an L-isogeny mapping φ_L is calculated with the kernel being the elliptic point [L^(e_L-3)]φ_L^2(S_L) obtained by point-L-multiplying the elliptic point φ_L(S_L) (e_L-3) times. By repeating these operations a total of e_L times, the public key pk_L={E_0 / <S_L> ,φ_L^e_L(P_L'),φ_L^e_L(Q_L')} is obtained.

[0028] Figure 2 shows an example of an L^e_L-isogeneous mapping calculation algorithm (when L=2). Figure 3 shows an example of values ​​indicated by the variables of the algorithm in Figure 2 (when e_2=3). As shown in the examples in Figures 2 and 3, 2^3-isogeneous mapping calculation is realized by combining point doubling and 2-isogeneous mapping calculation.

[0029] In the L^e_L-isogeneous mapping calculation, it is essential to calculate the e_L kernel elliptic points [L^(e_L-1)]S_L, [L^(e_L-2)]φ_L(S_L), [L^(e_L-3)]φ_L^2(S_L), ...,φ_L^(e_L-1)(S_L), and the calculation order is not limited to the algorithm shown in Figure 2. For example, it is known that the isogenous mapping calculation is performed in a calculation order based on a tree structure in which the point L multiplication is the left side and the L-isogeneous mapping calculation is the right side, and the kernel elliptic points are the leaves (Non-Patent Document 1).

[0030] Figure 4 shows an example of a tree structure (when e_L=7) that shows the calculation order of L^e_L-isogeny mapping calculation. The points moving downward to the left in the tree structure represent ellipse points obtained by calculating point L multiplication. The points moving downward to the right in the tree structure represent ellipse points obtained by calculating L-isogeny mapping.

[0031] The leaves of the tree structure (the points of part 101 included in the tree structure in the example of FIG. 4) indicate the elliptic points used as the kernel in the calculation process of the isomorphic mapped points (P and Q). The points of part 102 included in the tree structure indicate the elliptic points obtained by calculating the L-isomorphic mapping.

[0032] A sequence of positive integers representing a tree structure, for example, (3, 2, 1, 1, 2, 1) when e_L = 7, is called a strategy. By the strategy, a tree structure indicating the elliptic points (hereinafter referred to as "intermediate values") used for the L^e_L-isomorphic mapping calculation is specified.

[0033] Improvements to the known L^e_L-isomorphic mapping calculation include devising the tree structure (a method enabling batch processing, Patent Document 1) and devising the intermediate values (a method of saving memory by sharing the Z coordinates of multiple intermediate values, Patent Document 2).

[0034] The embodiment is an embodiment related to an implementation technique of isomorphic mapping cryptography. Hereinafter, an embodiment for accelerating the L^e_L-isomorphic mapping calculation by precomputation will be described.

[0035] In the isomorphic mapping calculation device of the embodiment, by utilizing the fact that the elliptic point P_L and the elliptic point Q_L which are public parameters are known, among the e_L elliptic points [L^(e_L - 1)]S_L, [L^(e_L - 2)]φ_L(S_L), [L^(e_L - 3)]φ_L^2(S_L), …, φ_L^(e_L - 1)(S_L) that are the kernel of the L-isomorphic mapping, the elliptic points [L^(e_L - 1)]S_L, [L^(e_L - 2)]φ_L(S_L), [L^(e_L - 3)]φ_L^2(S_L), …, [L^(e_L - e)]φ_L^(e - 1)(S_L) are precomputed with a small positive integer e < e_L. In the isomorphic mapping calculation device of the embodiment, by reading out the precomputed values, the number of point L multiplications and the number of calculations of the L-isomorphic mapping in the L^e_L-isomorphic mapping calculation are reduced.

[0036] <L^e_L-Isomorphic Mapping Calculation> The tree structure is given as a strategy. The root of the tree structure corresponds to the elliptic point S_L=P_L+[sk_L]Q_L. The elliptic point S_L is determined by the private key sk_L. The elliptic point S_L is a point of order L^e_L on the elliptic curve E_0. From the private key space K_L={0,1,2,...,L^e_L-1}, the elliptic point S_L can take on L^e_L different values.

[0037] The leftmost leaf of the tree structure corresponds to the elliptic point [L^(e_L-1)]S_L. The order of the elliptic point S_L is L^e_L, so the order of the elliptic point [L^(e_L-1)]S_L is L. If the truncation of the lowest e digits of sk_L with respect to the base L is represented as trunc(sk_L, e), then the following formula (1) holds.

[0038] [L^(e_L-1)]S_L =[L^(e_L-1)]P_L+[L^(e_L-1)][sk_L]Q_L =[L^(e_L-1)]P_L +[trunc(sk_L,1)][L^(e_L-1)]Q_L…(1)

[0039] From the above formula (1), the elliptic point [L^(e_L-1)]S_L is determined by the lowest digit of the private key sk_L.

[0040] The second leaf from the left corresponds to the elliptic point [L^(e_L-2)]φ_L(S_L), and the order is L. The following equation (2) holds.

[0041] [L^(e_L-2)]φ_L(S_L) =[L^(e_L-2)]φ_L(P_L) +[L^(e_L-2)]φ_L([sk_L]Q_L) =φ_L([L^(e_L-2)]P_L) +[trunc(sk_L,2)]φ_L([L^(e_L-2)]Q_L)…(2)

[0042] From the above formula (2), the elliptic point [L^(e_L-2)]φ_L(S_L) is determined by the lowest two digits of the private key sk_L.

[0043] Similarly, the e-th leaf from the left corresponds to the elliptic point [L^(e_L-e)]φ_L^(e-1)(S_L), and the order of this elliptic point is L, which is determined by the lowest e digits of the private key sk_L.

[0044] For example, if L=2, the ellipse point [2^(e_2-1)]S_2 can have two values: [2^(e_2-1)]P_2+[0][2^(e_2-1)]Q_2 and [2^(e_2-1)]P_2+[1][2^(e_2-1)]Q_2.

[0045] The elliptic point [2^(e_2-2)]φ_2(S_2) can take on four values. Specifically, the first point is φ_2([2^(e_2-2)]P_2)+

[00] _2φ_2([2^(e_2-2)]Q_2). Here,

[00] _2 indicates scalar multiplication using the lowest two digits of the binary representation of the private key sk_2, and so on. The second point is φ_2([2^(e_2-2)]P_2)+

[10] _2φ_2([2^(e_2-2)]Q_2). However, the 2-isogenous map of these two points (φ_0 in Figure 5 described below) has a kernel of [2^(e_2-1)]P_2+[0][2^(e_2-1)]Q_2.

[0046] The third point is φ_2([2^(e_2-2)]P_2)+

[01] _2φ_2([2^(e_2-2)]Q_2). The fourth point is φ_2([2^(e_2-2)]P_2)+

[11] _2φ_2([2^(e_2-2)]Q_2). Note that the 2-isogenous map of these two points (φ_1 in Figure 5 below) has kernel [2^(e_2-1)]P_2+[1][2^(e_2-1)]Q_2.

[0047] In the embodiment, as described above, the ellipse points determined by the lowest e digits of the private key sk_L are stored as pre-computed values. If there is a limit to the memory for storing the pre-computed values, the ellipse points to be stored as pre-computed values ​​may be determined based on the number of possible value patterns among the ellipse points that can be taken by the leaves of the tree structure (ellipse points T that are the cores of the L-isogeneic mapping).

[0048] FIG. 5 is a diagram showing an example of pre-calculated values ​​according to an embodiment. The example in FIG. 5 shows an example of an elliptic point determined by the lowest three digits of the private key sk_2. Note that the positions in FIG. 5 are unrelated to the arrangement in memory. With 128-bit security, an elliptic point is 434*2*2 bits (approximately 220 bytes).

[0049] [Example of functional configuration] 6 is a diagram illustrating an example of the functional configuration of an isogenous mapping calculation device 100 according to an embodiment. The isogenous mapping calculation device 100 includes a sampling unit 1, a scalar multiplication unit 2, and an isogenous mapping calculation unit 3. The isogenous mapping calculation unit 3 includes a control unit 31, a point L-multiplication unit 32, and an L-isogenous mapping calculation unit 33.

[0050] The sampling unit 1 obtains a private key sk from a private key space K included in the system parameters, and inputs the private key sk to the scalar multiplication unit 2. The sampling unit 1 also inputs the lowest e digits of the private key sk to the control unit 31.

[0051] The scalar multiplication unit 2 uses the secret key sk input from the sampling unit 1 and the elliptic points P and Q included in the system parameters to calculate the elliptic point S by scalar multiplication and inputs it to the isogeny mapping calculation unit 3.

[0052] The isogeny mapping calculation unit 3 calculates the L^e_L-isogeny mapping.

[0053] The control unit 31 controls the operations of the point \(L\)-multiplication unit 32 and the \(L\)-isogeny calculation unit 33 based on a positive integer \(e\lt e_L\), a tree structure given as a strategy (see FIG. 4), a precomputed value \(T\) (the possible values of the elliptic points \([L^{e_L - 1}]S_L\), \([L^{e_L - 2}]\varphi_L(S_L)\), \([L^{e_L - 3}]\varphi_L^2(S_L)\), \(\cdots\), \([L^{e_L - e}]\varphi_L^{e - 1}(S_L)\); for example, see FIG. 5), and the lower digits of the secret key input by the sampling unit 1 (the lower \(e\) digits of the secret key \(sk\)). Thereby, the control unit 31 calculates the point \(L\)-multiplication and the \(L\)-isogeny in the \(L^{e_L}\)-isogeny calculation. Note that the elliptic points \([L^{e_L - 1}]S_L\), \([L^{e_L - 2}]\varphi_L(S_L)\), \([L^{e_L - 3}]\varphi_L^2(S_L)\), \(\cdots\), \([L^{e_L - e}]\varphi_L^{e - 1}(S_L)\) are obtained by performing the point \(L\)-multiplication and the \(L\)-isogeny together \((e_L - 1)\) times on the elliptic point \(S_L\). Also, \([L^{e_L - e}]\varphi_L^{e - 1}(S_L)\) is obtained by performing the point \(L\)-multiplication \((e_L - e)\) times and the \(L\)-isogeny on the elliptic point \(S_L\).

[0054] The control unit 31 controls the operations of the point \(L\)-multiplication unit 32 and the \(L\)-isogeny calculation unit 33, for example, according to Algorithm A (FIG. 2). At this time, when the control unit 31 can use the precomputed value \(T\) (from iteration \(i = e_L - 1\) to \(i = e_L - e\) in FIG. 2), it does not calculate the point \(L\)-multiplication (processing step 3 in FIG. 2), reads out the precomputed value \(T\) determined by \(trunc(sk_L, e_L - i)\) as the core elliptic point \(T\), and inputs the precomputed value \(T\) to the point \(L\)-multiplication unit 32.

[0055] When the elliptic point \(S_L\) is input from the scalar multiplication unit 2 to the point \(L\)-multiplication unit 32, the point \(L\)-multiplication unit 32 calculates the elliptic point \(T\) by the point \(L\)-multiplication of the elliptic point \(S_L\), and inputs the elliptic point \(T\) to the \(L\)-isogeny calculation unit 33. Note that when the point \(L\)-multiplication unit 32 can use the precomputed value \(T\) (from iteration \(i = e_L - 1\) to \(i = e_L - e\)), it does not calculate the point \(L\)-multiplication and inputs the precomputed value \(T\) read by the control unit 31 to the \(L\)-isogeny calculation unit 33.

[0056] The L-isogene mapping calculation unit 33 performs an L-isogene mapping calculation using the elliptic curve E, the elliptic points S, P', and Q', and the elliptic point T input from the point L multiplication unit 32 (processing steps 4 to 6 in Figure 2).

[0057] When the pre-calculated value T is not available (repetition i=e_L-e-1 to i=0 in Figure 2), the control unit 31 performs the calculation of each processing step in Figure 2 as usual by operating the point L multiplication unit 32 and the L-isogene mapping calculation unit 33.

[0058] Next, variations 1 to 4 of the pre-computed values ​​held in the isogenous mapping calculation device 100 will be described. In the above description, an example was given in which the pre-computed value is an ellipse point T (a value that [L^(e_L-1)]S_L, [L^(e_L-2)]φ_L(S_L), [L^(e_L-3)]φ_L^2(S_L), ..., [L^(e_L-e)]φ_L^(e-1)(S_L), see FIG. 5 for example), but instead of this ellipse point T, an intermediate value determined from an ellipse point T obtained by repeatedly executing point L multiplication (L is a positive integer) and M-isogeneic mapping (M is a positive integer) on an ellipse point S, which is the kernel of the isogenous mapping, among a plurality of intermediate values ​​used in the isogenous mapping calculation, may be used as the pre-computed value.

[0059] In addition, the pre-computed values ​​in the embodiment may be read from a storage device inside the isogenous mapping calculation device 100 (for example, a storage unit of the isogenous mapping calculation device 100) or may be read from a storage device outside the isogenous mapping calculation device 100 (for example, a server device).

[0060] <Variation 1> In the example of Variation 1, in Algorithm A of Fig. 2, the isogeny mapping calculation device 100 pre-calculates (saves as pre-calculated values) not only the ellipse point T in processing step 3 but also the ellipse point (the ellipse point obtained by L^e-isogenically mapping the public parameter) used in processing step 6. In other words, the isogeny mapping calculation device 100 holds the ellipse point obtained by L^e-isogenically mapping the public ellipse point as an intermediate value determined from the ellipse point T.

[0061] The control unit 31 does not cause the L-isogeneous mapping calculation unit 33 to perform calculations in processing step 6 from iteration i = e_L-1 to i = e_L-e+1 in Fig. 2. Then, in processing step 6 of iteration i = e_L-e in Fig. 2, the control unit 31 reads out a pre-calculated value indicating the L^e-isogeneously mapped ellipse point determined by trunc(sk_L, e), and uses the pre-calculated value as the calculation result for processing step 6.

[0062] Variation 1 reduces the number of L-isogeneity mapping calculations by e for each elliptic point of the public parameters, enabling further speedup of L^e_L-isogeneity mapping calculations.

[0063] <Variation 2> In the example of variation 2, the isogeny mapping calculation device 100 pre-calculates (stores as pre-calculated values) not only the elliptic point T in processing step 3 of FIG. 2 but also intermediate values ​​AC corresponding to the coefficients of the elliptic curve in processing step 4.

[0064] The control unit 31 does not cause the L-isogeny mapping calculation unit 33 to calculate processing step 4 from iteration i = e_L-1 to i = e_L-e in Fig. 2. The control unit 31 reads a pre-calculated value indicating an intermediate value AC corresponding to the coefficient of the elliptic curve determined by trunc(sk_L, e_L - i), and uses the pre-calculated value as the calculation result of processing step 4.

[0065] According to variation 2, the number of calculations required for the intermediate value AC corresponding to the coefficient of the elliptic curve is reduced by e, and the L^e_L-isogene mapping calculation can be further accelerated.

[0066] <Variation 3> This will be described later in the description of FIG.

[0067] <Variation 4> Although processing step 4 in FIG. 2 is schematically represented as calculating the coefficients of an elliptic curve, in reality, intermediate value K used to calculate the L-isogeny mapping in processing step 5 and processing step 6, and intermediate value AC used to calculate the point L multiplication in processing step 3 of the next iteration, are calculated from elliptic point T in processing step 4.

[0068] In the example of Variation 4, the isogeny mapping calculation device 100 pre-calculates (saves as pre-calculated values) intermediate values ​​K and AC instead of elliptic point T. That is, the isogeny mapping calculation unit 3 stores the intermediate value K used in the calculation of the L-isogeny mapping as a pre-calculated value determined from the elliptic point T, so that the L-isogeny mapping can be calculated using the intermediate value K. Also, the isogeny mapping calculation unit 3 stores the intermediate value AC used in the calculation of the point L-multiplication as a pre-calculated value determined from the elliptic point T, so that the point L-multiplication can be calculated using the intermediate value AC. The intermediate value AC corresponds to the coefficient of the elliptic curve transferred by isogeny mapping the public elliptic curve including the elliptic point S.

[0069] The control unit 31 does not cause the L-isogeny mapping calculation unit 33 to calculate the intermediate value K of processing step 4 from iteration i = e_L-1 to i = e_L-e in Fig. 2. The control unit 31 reads a pre-calculated value indicating the intermediate value K determined by trunc(sk_L, e_L-i) and uses the intermediate value K as the calculation result of processing step 4.

[0070] Furthermore, the control unit 31 does not cause the L-isogeny mapping calculation unit 33 to calculate the intermediate value AC in processing step 4 from iteration i = e_L-1 to i = e_L-e+1 in Fig. 2. The control unit 31 reads out a pre-calculated value indicating the intermediate value AC determined by trunc(sk_L, e) in processing step 4 of iteration i = e_L-e in Fig. 2, and uses the intermediate value AC as the calculation result in processing step 4.

[0071] According to variation 4, the calculation of the intermediate value K and the intermediate value AC is reduced, and the L^e_L-isogene mapping calculation can be further accelerated.

[0072] Variations 1 to 4 above are summarized in Figure 7.

[0073] FIG. 7 is a diagram illustrating examples of variations of pre-calculated values ​​according to an embodiment. Example number 0 illustrates a pre-calculated value according to the embodiment described above. Example number 1 illustrates variation 1 of the pre-calculated value according to the embodiment described above. Example number 2 illustrates variation 2 of the pre-calculated value according to the embodiment described above. Example number 3 illustrates variation 3 of the pre-calculated value according to the embodiment described above. Example number 4 illustrates variation 4 of the pre-calculated value according to the embodiment described above.

[0074] Note that the examples of numbers 1 to 4 in FIG. 7 may be applied to any strategy, not just the strategy according to Algorithm A in FIG. 2. For example, a strategy indicating a tree structure that determines the calculation order of point L-multiplication and L-isogeny mapping and the number of calculations of point L-multiplication and L-isogeny mapping may be accepted, and the L-isogeny mapping and point L-multiplication may be calculated based on the strategy. However, in the example of number 4, intermediate values ​​of the intermediate value AC are not retained, so depending on the combination of the strategy and the positive integer e, the L^e_L-isogeny mapping may not be calculated correctly. To avoid incorrect calculation, in the example of number 4, only intermediate values ​​of the intermediate value AC necessary for calculation may be read, as in the example of number 3. Furthermore, when applying the example of number 4, combinations of strategies and positive integers e that may result in incorrect calculations may not be used.

[0075] For efficiency, SIKE uses only the x-coordinate of P_L,Q_L,R_L=P_L-Q_L instead of {P_L,Q_L}. Similarly, the x-coordinates of φ_L^e(P_L'), φ_L^e(Q_L'), φ_L^e(R_L') may be used for pre-calculated values ​​in the L^e-isogeneous mapping of public parameters.

[0076] Note that the intermediate value K is not limited to one value, but may be a set of multiple values. Similarly, the intermediate value AC is not limited to one value, but may be a set of multiple values. Also, depending on the positive integer L, the intermediate value K may not be calculated.

[0077] <Example of intermediate value K and intermediate value AC> A specific example of using Algorithm 1 for intermediate values ​​K and AC is shown below. When L=2, process step 4 of Algorithm A may be calculated using Algorithm 11 of Non-Patent Document 1. Furthermore, process steps 5 and 6 may be calculated using Algorithm 12 of Non-Patent Document 1. In Algorithm 11 of Non-Patent Document 1, a pair of two values ​​(A_24^+, C_24) is calculated as intermediate value AC instead of curve coefficients A and C. Here, A_24^+:C_24 = (A+2C):4C. (A_24^+, C_24) is used to calculate point doubling.

[0078] In another example, a pair of two values ​​(A_24^-, C_24) is calculated as the intermediate value AC. Here, A_24^-:C_24=(A-2C):4C. (A_24^-, C_24) is used to calculate the point doubling. In Algorithm 12 of Non-Patent Document 1, the intermediate value K is not used.

[0079] When L=4, processing step 4 of Algorithm A may be calculated using Algorithm 13 of Non-Patent Document 1, and processing steps 5 and 6 may be calculated using Algorithm 14 of Non-Patent Document 1. In Algorithm 13 of Non-Patent Document 1, a pair of two values ​​(A_24^+, C_24) is calculated as an intermediate value AC instead of the coefficients A and C of the curve.

[0080] In another example, there is a method in which a set of two values ​​(A_24^-, C_24) is calculated as the intermediate value AC. In Algorithm 14 of Non-Patent Document 1, a set of three values ​​(K_1, K_2, K_3) is used as the intermediate value K. Therefore, in Algorithm 13 of Non-Patent Document 1, (K_1, K_2, K_3) is calculated as the intermediate value K. If the kernel ellipse point is T, then K_1 = 4Z_T^2, K_2 = X_T - Z_T, and K_3 = X_T + Z_T. Here, X_T is the X coordinate of ellipse point T in projective coordinates, and Z_T is the Z coordinate of ellipse point T.

[0081] When L=3, step 4 of Algorithm A may be calculated using Algorithm 15 in Non-Patent Document 1, and process steps 5 and 6 may be calculated using Algorithm 16 in Non-Patent Document 1. In Algorithm 15 in Non-Patent Document 1, a pair of two values ​​(A_24^+, A_24^-) is calculated as an intermediate value AC instead of the curve coefficients A and C. Here, A_24^+:A_24^- = (A+2C):(A-4C). (A_24^+, A_24^-) is used to calculate point tripling. In Algorithm 16 in Non-Patent Document 1, a pair of two values ​​(K_1, K_2) is used as the intermediate value K. Therefore, in Algorithm 15 in Non-Patent Document 1, (K_1, K_2) is calculated as the intermediate value K. If the core ellipse point is T, then K_1=X_T-Z_T and K_2=X_T+Z_T.

[0082] <Public key generation process> The isogenous mapping calculation device 100 of the embodiment performs the public key generation process by using the pre-computed values ​​shown in FIG. 7 in the public key generation process.

[0083] The sampling unit 1 inputs the private key sk_L to the scalar multiplication unit 2. The scalar multiplication unit 2 inputs the elliptic point S_L calculated from the private key sk_L by scalar multiplication to the isogenous mapping calculation unit 3, and the isogenous mapping calculation unit 3 calculates the public key pk_L={E_0 / <S_L> ,φ_L^e_L(P_L'),φ_L^e_L(Q_L')}. The public parameters are {E_0,P_L,Q_L,P_L',Q_L'}.<S_L> is determined by scalar multiplication S_L=P_L+[sk_L]Q_L, and φ_L^e_L is determined by L^e_L-isogeneric mapping calculation.

[0084] By using the pre-computed values ​​shown in Figure 7 for the L^e_L-isogeneous mapping calculation, which accounts for a large proportion of the number of execution cycles, the processing speed of the isogenous mapping calculation in the public key generation process can be improved.

[0085] The sampling unit 1 may sample the private key sk_L from the key space K_L as a random number sk_L, or may receive an input of the private key sk_L from outside.

[0086] <Shared key establishment process> Furthermore, the isogenous mapping computing device 100 of the embodiment performs the shared key establishment process by utilizing pre-computed values ​​shown in FIG. 8, which will be described later, in the shared key establishment process.

[0087] The isogenous mapping calculation unit 3 calculates the private key sk_L and the public key pk_L′={E_0 / <S_L’> ,φ_L'^e_L'(P_L),φ_L'^e_L'(Q_L)} and outputs a shared key j (j-invariant). Specifically, the shared key establishment process includes the calculation of scalar multiplication φ_L'^e_L'(S_L)=φ_L'^e_L'(P_L)+[sk_L]φ_L'^e_L'(Q_L), the calculation of L^e_L-isogeneous mapping φ'_L^e_L, and the calculation of the j-invariant.

[0088] In the public key generation process, the elliptic points obtained by performing point L-multiplication and L-isogene mapping on the public parameters are used as pre-computed values, but in the shared key establishment process, the elliptic points obtained by performing point L-multiplication and L-isogene mapping on the public key are used as pre-computed values.In the shared key establishment process, the public key is not output, so L^e-isogene mapping of the public parameters is not necessary.

[0089] 8 is a diagram showing examples of variations of pre-computed values ​​in the shared key establishment process of the embodiment. The example numbered 0' shows the pre-computed value of the above embodiment. The example numbered 2' shows variation 2' of the pre-computed value of the above embodiment. The example numbered 3' shows variation 3' of the pre-computed value of the above embodiment. The example numbered 4' shows variation 4' of the pre-computed value of the above embodiment.

[0090] The reason why the example of number 1' is not shown in FIG. 8 is that it is similar to the example of number 0'. The examples of number 2' to number 4' in FIG. 8 may be applied to any strategy. However, for number 4', since intermediate values ​​of the intermediate value AC are not held, it may not be possible to calculate correctly depending on the combination of the strategy and the positive integer e. To avoid incorrect calculation, in the example of number 4', as in the example of number 3', only the intermediate values ​​of the intermediate value AC that are necessary for calculation may be read out. Furthermore, when applying the example of number 4', it is possible to avoid using a combination of a strategy and a positive integer e that may not be possible to calculate correctly.

[0091] <Encryption, decryption, key encapsulation, and key decapsulation processes> The isogenous mapping calculation device 100 of the embodiment may perform encryption and decryption processes in isogenous mapping cryptography, and key encapsulation and key decapsulation processes in KEM, using the L^e_L-isogenous mapping calculation that reads out pre-computed values, as well as the public key generation process and the shared key establishment process. Furthermore, the isogenous mapping calculation device 100 of the embodiment may perform processes of other cryptographic algorithms using the L^e_L-isogenous mapping calculation that reads out pre-computed values.

[0092] <Variations in calculation methods> The isogenous mapping calculation unit 3 of the embodiment may calculate the L^e_L-isogenous mapping, perform the public key generation process, the shared key establishment process, etc. by a method other than the repeated combination of point L multiplication and L-isogenous mapping. For example, the isogenous mapping calculation unit 3 of the embodiment may use a method of repeatedly executing a combination of point L multiplication (L is a positive integer) and M-isogenous mapping (M is a positive integer).

[0093] Specifically, for example, the storage unit of the isogenous mapping calculation device 100 of the embodiment may store, as a pre-computed value, an intermediate value determined from an elliptic point T obtained by repeatedly performing point L multiplication (L is a positive integer) and M-isogenous mapping (M is a positive integer) on an elliptic point S, which is the kernel of the isogenous mapping, among multiple intermediate values ​​used in the isogenous mapping calculation. Then, when the isogenous mapping calculation unit 3 receives an input of the elliptic point S and the e least significant digits of the L-adic representation of the private key sk, it may calculate an M-isogenous mapping of the elliptic point S using the pre-computed value determined from the elliptic point T identified by the e least significant digits of the L-adic representation of the private key sk, and may calculate, based on the M-isogenous mapping of the elliptic point S, an intermediate value or a j-invariant determined from an elliptic curve transferred by isogeny mapping a public elliptic curve including the elliptic point S.

[0094] The isogeny mapping calculation unit 3 may also use the pre-computed values ​​read from the storage unit to calculate an M-isogeny mapping of public elliptic points on a public elliptic curve including the elliptic point S, and calculate an elliptic point transferred by isogeny mapping the public elliptic point based on the M-isogeny mapping of the public elliptic point. For example, the pre-computed values ​​include an elliptic point obtained by L^e-isogeny mapping the public elliptic point. The isogeny mapping calculation unit 3 identifies the elliptic point T, which is the kernel of the M-isogeny mapping, according to the lowest e digits of the L-adic representation of the private key sk, and reads out the elliptic point obtained by L^e-isogeny mapping the public elliptic point as an intermediate value determined from the elliptic point T.

[0095] In addition, the isogeny mapping calculation unit 3 may accept a strategy indicating a tree structure that determines the calculation order of the point L-multiplication and the M-isogeny mapping and the number of times the point L-multiplication and the M-isogeny mapping are to be calculated, and may calculate at least one of the M-isogeny mapping and the point L-multiplication based on this strategy.

[0096] For example, the isogeny mapping is L^e_L-isogeny mapping (e_L is a positive integer), and M = L^m (m is a positive integer). In this case, for example, the above-mentioned elliptic point T is a value that can be taken by performing point L multiplication and M-isogeny mapping (corresponding to m L-isogeny mappings in terms of number of times) (e_L-1) times on the above-mentioned elliptic point S. Also, for example, the above-mentioned elliptic point T is a value that can be taken by performing point L multiplication (e_L-e) times and M-isogeny mapping on the above-mentioned elliptic point S.

[0097] Furthermore, the isogenous mapping calculation device 100 of the embodiment may change the calculation method of the L^e_L-isogenous mapping depending on the positive integer e_L. For example, when the positive integer e_L is an even number, the L^e_L-isogenous mapping may be calculated by a method other than repeating the combination of point L multiplication and L-isogenous mapping.

[0098] For example, when the positive integer e_L is an even number, the L^e_L-isogeneous mapping may be calculated by repeating a combination of one point L^2 multiplication and two L-isogeneous mappings.Furthermore, when the positive integer e_L is an even number, the L^e_L-isogeneous mapping may be calculated by repeating a combination of two point L multiplications and one M(=L^2)-isogeneous mapping.

[0099] Specifically, when L=2, the L^e_2-isogeny may be calculated by repeating a combination of two point doublings and one 4-isogeny. Alternatively, the L^e_2-isogeny may be calculated by changing the combination for each iteration.

[0100] Similarly, when the positive integer e_L is a multiple of 3, the L^e_L-isogeneous mapping may be calculated not only by a combination of point L multiplication and L-isogeneous mapping, but also by a combination of point L^3 multiplication, point L^2 multiplication, L^3-isogeneous mapping, and L^2-isogeneous mapping.

[0101] Furthermore, when the positive integer e_L is an odd number, the calculation of L^e_L-isogeneity may be performed by a combination of point L^2 multiplication, point L multiplication, L^2-isogeneity mapping, and L-isogeneity mapping.

[0102] Using the L^2-isogeneous mapping reduces the number of precomputed values ​​for the same e, and therefore the required memory size. When the positive integer e is even, it is better in terms of memory size to precomput the possible values ​​of the elliptic point [L^(e_L-2)]S_L,[L^(e_L-4)]φ_L^2(S_L),…,[L^(e_L-e)]φ_L^2(e / 2-1)(S_L) than to precomput the possible values ​​of the elliptic point [L^(e_L-1)]S_L,[L^(e_L-2)]φ_L(S_L),[L^(e_L-3)]φ_L^2(S_L),…,[L^(e_L-e)]φ_L^(e-1)(S_L).

[0103] For example, when e=4, instead of retaining L numbers of ellipse points [L^(e_L-1)]S_L, L^2 numbers of ellipse points [L^(e_L-2)]φ_L(S_L), L^3 numbers of ellipse points [L^(e_L-3)]φ_L^2(S_L), and L^e=L^4 numbers of ellipse points [L^(e_L-e)]φ_L^(e-1)(S_L), it is sufficient to retain L^2 numbers of ellipse points [L^(e_L-2)]S_L and L^4 numbers of ellipse points [L^(e_L-4)]φ_L^2(S_L)=[L^(e_L-e)]φ_L^2(e / 2-1)(S_L).

[0104] This reduces the number of precomputed values ​​by the number of L combinations of elliptic points [L^(e_L-1)]S_L and the number of L^3 combinations of elliptic points [L^(e_L-3)]φ_L^2(S_L). Similarly, when the positive integer e is odd, the number of precomputed values ​​can be reduced by using L^2-isogeneous mapping and L-isogeneous mapping. The number of precomputed values ​​can be reduced not only when the elliptic point T is used as a precomputed value, but also when the coefficients, intermediate value K, and intermediate value AC of the elliptic curve are used as precomputed values.

[0105] As described above, in the isogenous mapping calculation device 100 of the embodiment, the storage unit stores, as pre-computed values, intermediate values ​​determined from an elliptic point T obtained by repeatedly executing point L-multiplication (L is a positive integer) and M-isogenous mapping (M is a positive integer) on an elliptic point S that is the kernel of the isogenous mapping, among multiple intermediate values ​​used in the isogenous mapping calculation. Then, the isogenous mapping calculation unit 3 identifies the elliptic point T that is the kernel of the M-isogenous mapping according to the lowest e digits (e is a positive integer) of the L-adic representation of the private key sk that determines the elliptic point S, reads out the pre-computed value determined from the elliptic point T from the storage unit, and calculates at least one of the point L-multiplication and the M-isogenous mapping using the pre-computed value read out from the storage unit.

[0106] According to the isogenous mapping calculation device 100 of the embodiment, the processing speed of the isogenous mapping calculation can be improved. Specifically, the number of calculations of point L multiplication and L-isogenous mapping in the L^e_L-isogenous mapping calculation can be reduced, thereby speeding up the L^e_L-isogenous mapping calculation. This can reduce the number of execution cycles for public key generation and shared key establishment in a key agreement scheme that bases its security on the isogenous mapping problem. Furthermore, the number of execution cycles for isogenous mapping cryptography configured using the key agreement scheme, and for key generation, encryption, decryption, key encapsulation, and key decapsulation in KEM can be reduced.

[0107] Finally, a description will be given of an example of the hardware configuration of the isogenous mapping calculation device 100 of the embodiment. The isogenous mapping calculation device 100 of the embodiment can be realized by using, for example, any computer device as basic hardware.

[0108] [Example of hardware configuration] 9 is a diagram illustrating an example of the hardware configuration of an isogenous mapping calculation device 100 according to an embodiment. The isogenous mapping calculation device 100 according to an embodiment includes a processor 201, a main storage device 202, an auxiliary storage device 203, a display device 204, an input device 205, and a communication device 206. The processor 201, the main storage device 202, the auxiliary storage device 203, the display device 204, the input device 205, and the communication device 206 are connected via a bus 210.

[0109] Note that some of the above components may not be provided in the isogenous mapping calculation device 100. For example, if the isogenous mapping calculation device 100 can use the input function and display function of an external device, the isogenous mapping calculation device 100 may not be provided with the display device 204 and the input device 205.

[0110] The processor 201 executes a program read from the auxiliary storage device 203 to the main storage device 202. The main storage device 202 is a memory such as a ROM and a RAM. The auxiliary storage device 203 is a hard disk drive (HDD), a memory card, or the like.

[0111] The display device 204 is, for example, a liquid crystal display. The input device 205 is an interface for operating the isogenous mapping calculation device 100. The display device 204 and the input device 205 may be realized by a touch panel or the like having a display function and an input function. The communication device 206 is an interface for communicating with other devices.

[0112] For example, the program executed by the isogenic mapping calculation device 100 is provided as a computer program product in the form of a file in an installable or executable format, recorded on a computer-readable storage medium such as a memory card, hard disk, CD-RW, CD-ROM, CD-R, DVD-RAM, and DVD-R.

[0113] Furthermore, for example, the program executed by the isogenic mapping calculation device 100 may be stored on a computer connected to a network such as the Internet, and may be provided by being downloaded via the network.

[0114] Furthermore, for example, the program executed by the isogenous mapping calculation device 100 may be configured to be provided via a network such as the Internet without being downloaded. Specifically, the isogenous mapping calculation process may be configured to be executed by a so-called ASP (Application Service Provider) type service, which does not transfer the program from a server computer but realizes the processing function only by issuing an execution instruction and obtaining the result.

[0115] Furthermore, for example, the program for the isogenic mapping calculation device 100 may be provided by being pre-installed in a ROM or the like.

[0116] The program executed by the isogenous mapping calculation device 100 has a modular configuration including functions that can be realized by the program among the above-mentioned functional configurations. As for each function, as actual hardware, the processor 201 reads the program from a storage medium and executes it, and the above-mentioned functional blocks are loaded onto the main storage device 202. In other words, the above-mentioned functional blocks are generated on the main storage device 202.

[0117] Note that some or all of the above-described functions may be realized by hardware such as an IC, rather than by software.

[0118] Furthermore, each function may be realized using a plurality of processors 201, and in this case, each processor 201 may realize one of the functions, or may realize two or more of the functions.

[0119] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0120] 1. Sampling section 2 Scalar multiplication unit 3 Isogeny calculation unit 31 Control Unit 32 points L multiplication section 33 L-Isogeny Calculation Unit 100 Isogeny Mapping Calculation Device 201 processor 202 Main storage 203 Auxiliary storage device 204 Display device 205 Input Device 206 Communication Equipment 210 Bus

Claims

1. a storage unit that stores, as pre-calculated values, intermediate values ​​calculated using an elliptic point T obtained by repeatedly performing point L multiplication (L is a positive integer) and M-isogeneic mapping (M is a positive integer) on an elliptic point S that is a kernel of the isogeny mapping, among a plurality of intermediate values ​​used in the isogeny mapping calculation; an isogeny mapping calculation unit that identifies an elliptic point T that is a kernel of the M-isogenous mapping according to the lowest e digits (e is a positive integer) of an L-adic representation of a secret key sk used in the calculation of the elliptic point S, reads the precomputed value from the storage unit, and calculates at least one of the point L-multiplication and the M-isogenous mapping using the precomputed value read from the storage unit; An isogeny mapping calculation device comprising:

2. the isogeny mapping calculation unit stores an intermediate value K used in the calculation of the M-isogeny mapping as the pre-calculated value, and calculates the M-isogeny mapping using the intermediate value K.

2. The isogeny mapping calculation device according to claim 1.

3. the isogenous mapping calculation unit stores an intermediate value AC used in the calculation of the point L multiplication as the pre-calculated value, and calculates the point L multiplication using the intermediate value AC.

3. The isogeny mapping calculation device according to claim 1 or 2.

4. The intermediate value AC corresponds to the coefficient of the elliptic curve that is transferred by isogeny mapping the public elliptic curve that includes the elliptic point S.

4. The isogeny mapping calculation device according to claim 3.

5. When the isogeny mapping calculation unit receives the elliptic point S and the e least significant digits of the L-adic representation of the private key sk as input, it calculates an M-isogeny mapping of the elliptic point S using the pre-computed value identified by the e least significant digits of the L-adic representation of the private key sk, and calculates an intermediate value or a j-invariant determined from an elliptic curve transferred by isogeny mapping a public elliptic curve including the elliptic point S, based on the M-isogeny mapping of the elliptic point S.

2. The isogeny mapping calculation device according to claim 1.

6. the isogeny mapping calculation unit calculates an M-isogeny mapping of a public elliptic point on a public elliptic curve including the elliptic point S, using the pre-calculated value read from the storage unit, and calculates an elliptic point to be moved by isogeny mapping the public elliptic point S, based on the M-isogeny mapping of the public elliptic point.

2. The isogeny mapping calculation device according to claim 1.

7. the pre-computed values ​​include ellipse points obtained by L^e-isogenemapping the public ellipse points; The isogeny mapping calculation unit identifies an ellipse point T that is a kernel of the M-isogeny mapping according to the lower e digits of the L-adic representation of the private key sk, and reads out an ellipse point obtained by L^e-mapping the public ellipse point as an intermediate value calculated using the ellipse point T.

7. The isogeny mapping calculation device according to claim 6.

8. the isogeny mapping calculation unit receives a strategy indicating a tree structure that determines the calculation order of the point L-multiplication and the M-isogeny mapping and the number of times the point L-multiplication and the M-isogeny mapping are to be calculated, and calculates at least one of the M-isogeny mapping and the point L-multiplication based on the strategy.

2. The isogeny mapping calculation device according to claim 1.

9. The isogeny mapping is L^e_L-isogeny mapping (e_L is a positive integer), The M is L^m (m is a positive integer), The ellipse point T is a value that can be taken by performing point L multiplication and M-isogene mapping on the ellipse point S (e_L-1) times.

2. The isogeny mapping calculation device according to claim 1.

10. The isogeny mapping is L^e_L-isogeny mapping (e_L is a positive integer), The M is L^m (m is a positive integer), The ellipse point T is a value that can be taken by performing point L multiplication (e_L-e) times and M-isogene mapping on the ellipse point S.

2. The isogeny mapping calculation device according to claim 1.

11. an isogeny mapping calculation device storing, as a pre-calculated value, an intermediate value calculated using an elliptic point T obtained by repeatedly performing point L multiplication (L is a positive integer) and M-isogeny mapping (M is a positive integer) on an elliptic point S that is a kernel of the isogeny mapping, among a plurality of intermediate values ​​used in the isogeny mapping calculation; the isogeny mapping calculation device specifies an elliptic point T that is a kernel of the M-isogeny mapping according to the lowest e digits (e is a positive integer) of an L-adic representation of a secret key sk used in the calculation of the elliptic point S, reads out the pre-computed value from a storage unit, and calculates at least one of the point L-multiplication and the M-isogeny mapping using the pre-computed value read out from the storage unit; A method for calculating isogenies including:

12. Computer, a storage unit that stores, as pre-calculated values, intermediate values ​​calculated using an elliptic point T obtained by repeatedly performing point L multiplication (L is a positive integer) and M-isogeneic mapping (M is a positive integer) on an elliptic point S that is a kernel of the isogeny mapping, among a plurality of intermediate values ​​used in the isogeny mapping calculation; an isogeny mapping calculation unit that identifies an elliptic point T that is a kernel of the M-isogenous mapping according to the lowest e digits (e is a positive integer) of an L-adic representation of a secret key sk used in the calculation of the elliptic point S, reads the precomputed value from the storage unit, and calculates at least one of the point L-multiplication and the M-isogenous mapping using the precomputed value read from the storage unit; A program to function as a

Images