Sparse multiplication calculator, mirror function calculator, pairing calculator, cryptographic calculator, sparse multiplication calculator method, and sparse multiplication calculator program

Abstract

To efficiently calculate a sparse multiplication that appears in pairing computation on an elliptic curve having a three-dimensional twist.SOLUTION: A sparse multiplication calculation device 10 calculates a sparse multiplication f*g in which the element f and element g of a finite field Fpk are taken as input, when k is a natural number devisable by 3, e is a natural number expressed by k / 3, Fpk is a finite field consisting of pk elements and having the expression of polynomial ring, Fpk=Fpe[v] / (v3-u), where u represents an element of Fpe and v3-u represents an irreducible polynomial. A preliminary calculation unit 21 calculates five polynomials in which the element f and element g are associated with h0, h1, h2, h3, h4 that are coefficients of a polynomial where the sparse multiplication f*g is expressed by v. An equation setup unit 22 sets up a five-dimensional linear equation using the five polynomials, that determines the coefficients h0, h1, h2, h3, h4. An equation solver unit 23 solves the five-dimensional linear equation and determines the coefficients h0, h1, h2, h3, h4.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This disclosure relates to a sparse multiplication calculator, a mirror function calculator, a pairing calculator, a cryptographic calculator, a sparse multiplication calculator method, and a sparse multiplication calculator program. In particular, this disclosure relates to a sparse multiplication calculator technique in pairing operations. [Background technology]

[0002] Pairing operations are calculations using elliptic curves that are processed internally within cryptographic schemes such as functional cryptography and secure lookup. Elliptic curves suitable for efficient pairing operations are called pairing-friendly curves. Until recently, the BN curve was known as a pairing-friendly curve equivalent to 128-bit security. BN is an abbreviation for Barret-Naehrig. However, since around 2016, security has been re-evaluated, and interest in pairing operations using various pairing-friendly curves such as the BLS curve and KSS curve has been growing. BLS is an abbreviation for Barreto-Lynn-Scott. KSS is an abbreviation for Kachisa-Schaefer-Scott.

[0003] Pairing operations can be broadly divided into the calculation of mirror functions and the calculation of the final power. The calculation of mirror functions is also called a mirror loop. Both the calculation of mirror functions and the calculation of the final power require complex computational processes and have a significant impact on the overall computational complexity of cryptographic schemes such as functional cryptography and secure search.

[0004] Recent research has focused on BLS curves, which are considered to be among the most efficient pairing-friendly curves in terms of overall pairing operations. Pairing operations on BLS curves with embedding orders k = 24, 27, 42, and 48 have been extensively studied. In particular, in recent years, elliptic curves with cubic twists, as well as elliptic curves with 6th-order twists, have attracted attention.

[0005] The curve parameterized by the elliptic curve family is an elliptic curve determined by the polynomial r(x), the polynomial p(x), the polynomial t(x), the embedding degree k, and the integer u. The polynomials r(x), p(x), and t(x) have different forms according to the embedding degree k. The curve E parameterized by the elliptic curve family of embedding degree k is an elliptic curve defined over the finite field F p consisting of p = p(x) elements. r = r(x) is the largest prime number that divides the order of the subgroup E(F p ) of the elliptic curve E. t = t(x) is the trace of the elliptic curve E.

[0006] The pairing operation on the elliptic curve E takes as input two points P and Q on the elliptic curve E, calculates a rational function f called the mirror function, and then calculates it to the power of (p(x) k -1) / r(x). That is, the pairing operation on the elliptic curve E is calculated by Equation 11.

Number

[0007] Non-Patent Document 1 describes an efficient sparse multiplication calculation algorithm for efficiently calculating the mirror function. To explain sparse multiplication, consider the elements f and g of the extension field Fp 9 . Usually, the element f (similarly for the element g) has a form like Equation 12. Here, each coefficient f0, f1, f2 is an element of the intermediate field Fp 3 , and v is the variable when the extension field Fp 9 is represented as the polynomial ring Fp 9 = Fp 3 [v] / (v 3 -u).

[0008] At this time, the sparse multiplication of the element f and the element g refers to the situation where any of the coefficients of the element f or the element g is an element of the prime field Fp. In this case, the calculation efficiency is better than that of ordinary multiplication.

Number

[0009] [Non-Patent Document 1] AJDevegili, CO hEigeartaigh, M.Scott and R.Dahab, “Multiplication and Squaring on Pairing-Friendly Fields” [Overview of the Initiative] [Problems that the invention aims to solve]

[0010] To efficiently compute sparse multiplications that appear in pairing operations on elliptic curves with cubic twist, an efficient algorithm for sparse multiplication is needed. Sparse multiplication algorithms based on the Karatsuba method, which have been considered in previous research, are effective for quadratic and hexatic extension fields, but have the problem of being less effective for cubic extension fields.

[0011] This disclosure aims to efficiently compute sparse multiplications that appear in pairing operations on elliptic curves with cubic twist, based on the Toom-Cook method. [Means for solving the problem]

[0012] The loose multiplication calculator related to this disclosure is A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp k The element is p k Representation of a polynomial ring Fp in a finite field consisting of 10 elements k =Fp e [v] / (v 3 Let u be a finite field having -u) and let u be Fp e As the basis of, v 3 When -u is an irreducible polynomial, the finite field Fp kIn a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as inputs, The elements f and g mentioned above, and h which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. 0、 A pre-computation unit that calculates five polynomials that associate h1, h2, h3, and h4, Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 The equation formulation section is for formulating a 5-dimensional linear equation to find h1, h2, h3, and h4, Solving the aforementioned 5-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 It includes a solution unit that finds h1, h2, h3, and h4. [Effects of the Invention]

[0013] This disclosure proposes an algorithm for efficiently calculating sparse multiplication that appears in the calculation of mirror functions in pairing operations on elliptic curves with cubic twist. Therefore, the sparse multiplication computing device according to this disclosure enables efficient calculation of mirror functions in pairing operations. [Brief explanation of the drawing]

[0014] [Figure 1] A diagram showing an example configuration of a sparse multiplication calculator according to Embodiment 1. [Figure 2] A flowchart illustrating the overall operation of the sparse multiplication calculator according to Embodiment 1. [Figure 3] A flowchart showing the calculation process for specifically calculating equations 14 and 15 according to Embodiment 1. [Figure 4] A flowchart showing the calculation process for specifically calculating the number 20 according to Embodiment 1. [Figure 5] A flowchart showing the calculation process for specifically calculating the number 20 according to Embodiment 1. [Figure 6] This figure shows an example of the configuration of a sparse multiplication calculator according to a modified example 1 of Embodiment 1. [Figure 7] This figure shows an example of the configuration of a Miller function calculator according to a modified example 3 of Embodiment 1. [Figure 8] This figure shows an example of the configuration of a pairing calculation device according to a modified example 4 of Embodiment 1. [Figure 9] A diagram showing an example configuration of a sparse multiplication calculator according to Embodiment 2. [Figure 10] A flowchart showing the calculation process for specifically calculating equations 27 and 28 according to Embodiment 2. [Figure 11] A flowchart showing the calculation process for specifically calculating the number 33 according to Embodiment 2. [Figure 12] A flowchart showing the calculation process for specifically calculating the number 33 according to Embodiment 2. [Figure 13] A diagram showing an example configuration of the cryptographic processing device according to Embodiment 3. [Figure 14] A flowchart illustrating the operation of the cryptographic processing device according to Embodiment 3. [Modes for carrying out the invention]

[0015] The following description of this embodiment will be illustrated with reference to the figures. In each figure, identical or corresponding parts are denoted by the same reference numerals. In the description of the embodiment, the explanation of identical or corresponding parts will be omitted or simplified as appropriate. The arrows in the figures mainly indicate the flow of data or processing.

[0016] Embodiment 1. ***Explanation of Notation*** In the text and diagrams, the symbol "^" is sometimes used to represent exponentiation. For example, a^b is a b It represents.

[0017] ***Explanation of the structure*** Figure 1 shows an example of the configuration of the sparse multiplication calculator 10 according to this embodiment. The sparse multiplication calculator 10 is a computer. The sparse multiplication calculator 10 comprises hardware such as a processor 11, memory 12, storage 13, and a communication interface 14. The processor 11 is connected to the other hardware via signal lines and controls this other hardware.

[0018] Processor 11 is an IC that performs processing. Specific examples of processor 11 include CPU, DSP, or GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0019] Memory 12 is a storage device that temporarily stores data. Specific examples of memory 12 include SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0020] Storage 13 is a storage device for storing data. A specific example of storage 13 is an HDD. Alternatively, storage 13 may be a portable recording medium such as an SD® memory card, CF®, NAND flash, flexible disk, optical disk, compact disk, Blu-ray® disc, or DVD. HDD is an abbreviation for Hard Disk Drive. SD® is an abbreviation for Secure Digital. CF® is an abbreviation for CompactFlash®. DVD is an abbreviation for Digital Versatile Disk.

[0021] The communication interface 14 is an interface for communicating with external devices. Specific examples of the communication interface 14 include Ethernet®, USB, and HDMI® ports. USB is an abbreviation for Universal Serial Bus. HDMI® is an abbreviation for High-Definition Multimedia Interface.

[0022] The sparse multiplication calculator 10 comprises a pre-calculation unit 21, an equation formulation unit 22, and a solution unit 23 as functional components. The pre-calculation unit 21 comprises a first pre-calculation unit 31 and a second pre-calculation unit 32. The functions of each functional component of the sparse multiplication calculator 10 are implemented by software. Storage 13 stores programs that implement the functions of each functional component of the loose multiplication calculator 10. These programs are loaded into memory 12 by the processor 11 and executed by the processor 11. This enables the implementation of the functions of each functional component of the loose multiplication calculator 10.

[0023] In Figure 1, only one processor 11 was shown. However, there may be multiple processors 11, and multiple processors 11 may work together to execute programs that implement each function.

[0024] The program that implements the functions of each functional component of the sparse multiplication calculator 10 is also called the sparse multiplication calculator program. Memory 12 loads not only the loose multiplication calculation program but also the OS. OS stands for Operating System. Processor 910 executes the loose multiplication calculation program while running the OS. Note that part or all of the loose multiplication calculation program may be incorporated into the OS.

[0025] The sparse multiplication calculator 10 may include multiple processors that replace the processor 11. These multiple processors share the task of executing the sparse multiplication program. Each processor is a device that executes the sparse multiplication program, just like the processor 11.

[0026] The data, information, signal values, and variable values ​​used, processed, or output by the sparse multiplication calculation program are stored in memory 12, storage 13, or registers or cache memory within the processor 11.

[0027] The "parts" in the pre-calculation unit 21, equation formulation unit 22, and solution unit 23 may be read as "circuit," "process," "procedure," "process," or "circuitry." The sparse multiplication calculation program causes the computer to execute the pre-calculation process, equation formulation process, and solution process. The "process" in the pre-calculation process, equation formulation process, and solution process may be read as "program," "program product," "computer-readable storage medium storing the program," or "computer-readable recording medium recording the program." Furthermore, the sparse multiplication calculation method is performed by the sparse multiplication calculation device 10 executing the sparse multiplication calculation program. The sparse multiplication calculation program may be provided on a computer-readable recording medium. Alternatively, the sparse multiplication calculation program may be provided as a program product.

[0028] ***Explanation of operation*** Referring to Figures 2 to 5, the operation of the sparse multiplication calculator 10 according to this embodiment will be described. The operating procedure of the sparse multiplication calculator 10 according to this embodiment corresponds to the sparse multiplication calculation method according to this embodiment. Furthermore, the program that implements the operation of the sparse multiplication calculator 10 according to this embodiment corresponds to the sparse multiplication calculation program according to this embodiment.

[0029] The sparse multiplication calculator 10 according to this embodiment calculates sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist. Specifically, the sparse multiplication calculator 10 calculates sparse multiplication used in the calculation of Miller functions in finite field Fp k We calculate the sparse multiplication f*g, taking elements f and g as inputs. I will explain in detail below.

[0030] In this embodiment, the enlarged body Fp k / Fp e We calculate sparse multiplication in Fp. Here, k is a natural number divisible by 3, and e is a natural number that can be expressed as k / 3. Also, Fq represents a finite field with q elements. k Fp is a representation of a polynomial ring. k =Fp e [v] / (v 3 It has -u). Note that v 3 -u is a polynomial ring Fp e [v] is an irreducible polynomial on Fp e It belongs to the expanded body Fp. k / Fp e Sparse multiplication in this context is a calculation that appears multiple times when considering pairing operations on elliptic curves with cubic twist, specifically in the calculation of mirror functions. Specific examples include pairing operations on elliptic curves such as the BLS-9, BLS-15, and BLS-27 curves.

[0031] Sparse multiplication is defined as multiplication of a finite field Fp k This refers to the multiplication f*g, where two elements f and g are inputs, but either element f or element g is sparse.

[0032] In this embodiment, an element f or g is sparse if, when element f is represented by the number 12, any of f0, f1, or f2 is a finite field Fp e Lower magnified body Fp d It means that it is the origin of. <eである。

[0033] In a normal multiplication calculation of f and g, regardless of sparse multiplication, a naive calculation would require 9 Fp operations. e The above multiplication, 6 Fpe The above addition, two Fp e The above multiplication by u is required, which is computationally intensive. Therefore, an efficient multiplication method is needed for the calculation of mirror functions in pairing operations. Generally speaking, sparse multiplication is more efficient than normal multiplication, but to reap the full benefits, an efficient sparse multiplication method is still necessary.

[0034] Figure 2 is a flowchart showing the overall operation of the sparse multiplication calculator 10 according to this embodiment.

[0035] <Step S11: Pre-calculation> In step 11, pre-calculation processing is performed. In the pre-calculation process, the pre-calculation unit 21 calculates the elements f and g, and h, which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. 0、 We calculate the five polynomials that associate with h1, h2, h3, and h4. Specifically, the pre-calculation unit 21 takes element f as a polynomial f(X) and element g as a polynomial g(X), and substitutes predetermined values ​​0, 1, -1, 2, and ∞ for X. The pre-calculation unit 21 uses f(0), f(1), f(-1), f(2), f(∞), g(0), g(1), g(-1), g(2), and g(∞) to determine H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), H3=f(2)·g(2), and H4=f(∞)·g(∞), and the coefficients of the polynomial obtained by expressing sparse multiplication f*g in terms of v, h 0、 We calculate the five polynomials that associate with h1, h2, h3, and h4. More specifically, it is as follows:

[0036] In step S11, the first pre-calculation unit 31 of the pre-calculation unit 21 formally considers elements f and g as polynomials f(X) and g(X) and obtains equation 13.

number

[0037] Furthermore, by substituting X=0, X=1, X=-1, X=2, and X=∞ into the respective polynomials f(X) and g(X), we obtain equations 14 and 15.

number

number

[0038] Figure 3 is a flowchart showing the calculation process for specifically calculating equations 14 and 15 according to this embodiment. The calculation process for specifically calculating equations 14 and 15 will be explained by referring to the flowchart of the calculations related to the first pre-calculation unit 31 in Figure 3.

[0039] In step S21, the first pre-calculation unit 31 calculates the addition using the coefficients f0 and f2 in the input f. In steps S22 and S23, the first pre-calculation unit 31 adds and subtracts the coefficient f1 to the result calculated in step S21, respectively. Through these steps, f(1) is calculated from step S22 and f(-1) is calculated from step S23. In step S24, the first pre-calculation unit 31 adds the coefficient f1 to the result calculated in step S22. In steps S25, S26, and S27, the first pre-calculation unit 31 adds a coefficient f2 to the result of the previous step, in each case. Through these steps, f(2) is calculated from step S27 onwards.

[0040] Next, the second pre-calculation unit 32 of the pre-calculation unit 21 calculates equation 16 in order to formulate a system of 5-dimensional linear equations in the equation formulation unit 22.

number

[0041] Here, h 0、 h1, h2, h3, and h4 are coefficients represented by equation 17.

number

[0042] This h 0、 h1, h2, h3, and h4 are the coefficients of the multiplication f*g that we ultimately want to calculate. Therefore, in the following, this h 0、 The goal is to calculate h1, h2, h3, and h4.

[0043] <Step S12: Solve the linear equation> In step S12, the equation formulation and solution calculation processes are performed. In the formula formulation process, formula part 22 uses five polynomials from equation 16 to obtain the coefficients of the polynomial that expresses sparse multiplication f*g in terms of v. 0、 We formulate a 5-dimensional linear equation to find h1, h2, h3, and h4. In the solution process, the solution unit 23 solves the 5-dimensional linear equation and the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 Find h1, h2, h3, and h4. Specifically, it is as follows:

[0044] The equation formulation unit 22 formulates equation 18, which is a 5-dimensional linear equation, based on the five polynomials, equation 16, which are the results calculated by the pre-calculation unit 21.

number

[0045] Since the matrix 18 is an invertible matrix, it has an inverse matrix. Therefore, multiplying both sides of matrix 18 by the inverse matrix gives matrix 19.

number

[0046] Multiplying both sides of equation 19 by 6 eliminates the denominator, and the coefficient h 0、 For h1, h2, h3, and h4, we obtain equation 20. Note that the calculations to obtain equations 19 and 20 are performed in equation formulation section 22.

number

[0047] Figures 4 and 5 are flowcharts showing the calculation process for specifically calculating the number 20 according to this embodiment. The calculation process for specifically calculating number 20 will be explained by referring to the calculation flowchart for the solution unit 23 in Figures 4 and 5.

[0048] In step S301, the solution unit 23 performs addition using H0, which has already been calculated in number 16, and writes the result to memory 12. In step S302, the solution unit 23 performs addition using the already calculated 2H0 and writes the result to the memory 12. In step S303, the solution unit 23 performs addition using the already calculated 3H0 and writes the result to memory 12. The process in step S303 obtains 6h0, which is one of the coefficients to be found.

[0049] The solution unit 23 similarly performs calculation steps from step S304 to step S312 and writes the results of each step to memory 12. The process in step S311 yields 6h4, which is one of the coefficients to be found.

[0050] In step S41, the solution unit 23 performs a calculation using the value obtained in step S302 and H3, and writes the result to the memory 12. In step S42, the solution unit 23 performs a calculation using the value obtained in step S41 and the value obtained in step S312, and writes the result to the memory 12. In step S43, the solution unit 23 performs a calculation using the value obtained in step S42 and the value obtained in step S306, and writes the result to the memory 12. In step S44, the solution unit 23 performs calculations using the values ​​obtained in step S43 and step S307, and writes the results to the memory 12. The process in step S44 yields 6h1, which is one of the coefficients to be found.

[0051] In step S45, the solution unit 23 performs a calculation using the value obtained in step S42 and the value obtained in step S305, and writes the result to the memory 12. In step S46, the solution unit 23 performs a calculation using the value obtained in step S45 and H2, and writes the result to the memory 12. The process in step S46 yields 6h3, which is one of the coefficients to be found. In step S47, the solution unit 23 performs a calculation using the value obtained in step S303 and the value obtained in step S305, and writes the result to the memory 12. In step S48, the solution unit 23 performs a calculation using the value obtained in step S47 and step S308, and writes the result to the memory 12. In step S49, the solution unit 23 performs a calculation using the value obtained in step S48 and step S311, and writes the result to the memory 12. The process in step S49 yields 6h2, which is one of the coefficients to be found.

[0052] Next, we evaluate the computational cost of the calculation process up to this point. For numbers 14 and 15, seven additions were performed each. Therefore, the calculations for numbers 14 and 15 are completed in 14 additions. The cost of this calculation is 14A. e This is expressed as follows: Here, A e is a finite field Fp e This represents the addition shown above. For number 16, five multiplications were performed. The computational cost of this was 5M e This is expressed as follows: Here, M e is a finite field Fp e This represents the multiplication shown above. For number 20, a total of 21 additions were performed. Therefore, the calculation cost is 21A. e That is the case. However, since subtraction has roughly the same computational cost as addition from an implementation standpoint, subtraction is counted as addition, and calculating the reciprocal of an addition of an original is negligible from an implementation standpoint and is therefore ignored in the above evaluation. Based on these considerations, the total computational cost in this embodiment is expressed in Equation 21.

number

[0053] Note that the computational cost in equation 21 does not take into account remainders in a finite field. The computational cost when remainders are taken into account is expressed in equation 22.

number

[0054] Here, the symbol U represents a finite field Fp e This represents the U multiplication shown above. The reason why there are two additions and two U multiplications for number 21 is because of the relationship v 3 This is because the remainder is calculated using =u.

[0055] Up to this point, the coefficient h 0、 Since we were able to find h1, h2, h3, and h4, this is equivalent to being able to calculate the multiplication 6f*g for the inputs f and g.

[0056] In this embodiment, we consider a situation where either f or g is sparse. Since f and g have symmetry, we consider a situation where f is sparse. When f is sparse, any of the coefficients f0, f1, and f2 in equation 13 are in the finite field Fp d It is the origin of.

[0057] (When the coefficient f0 is sparse) In this case, Fp of H0 in equation 16 e Since the multiplication cost is reduced by one step, the computational cost of the multiplication 6f*g is expressed by equation 23.

number

[0058] (When the coefficient f2 is sparse) In this case, Fp of H4 in equation 16 e Since the multiplication cost is reduced by one step, the computational cost of the multiplication 6f*g can be expressed as equation 24.

number

[0059] (When the coefficient f1 is sparse) In this case, by considering the number 25 instead of f, the position of the coefficient that becomes sparse is shifted.

number

number

[0060] Finally, let's consider applying this sparse multiplication algorithm to mirror function calculations in pairing operations. If sparse multiplication occurs n times in the mirror function calculation, then at the end of the mirror function calculation, 6 n Or 6 n v n Only a value that deviates from the desired value is output. However, due to the nature of the final power calculation, such constants disappear at the easy part calculation stage in the final power, and therefore do not affect the final pairing operation.

[0061] ***Effects of this embodiment*** As described above, the sparse multiplication calculator 10 according to this embodiment includes a pre-calculation unit that efficiently pre-calculates f(0), f(1), f(-1), f(2), f(∞), g(0), g(1), g(-1), g(2), g(∞), H0, H1, H2, H3, and H4 for the calculation of multiplication f*g. The sparse multiplication calculator 10 also includes an equation formulation unit that formulates a system of 5th-degree linear equations based on the results from the pre-calculation unit. The sparse multiplication calculator 10 also includes a solution unit that solves the system of 5th-degree linear equations formulated by the equation formulation unit. Therefore, the sparse multiplication calculator 10 according to this embodiment allows for appropriate pre-calculation, and the sparse coefficients can be applied in all cases. This enables efficient calculation of pairing operations.

[0062] ***Other configurations*** <Example 1> In this embodiment, each functional component is implemented in software. However, in Modification 1, each functional component may be implemented in hardware. The differences between this Modification 1 and this embodiment will be explained below.

[0063] Figure 6 shows an example of the configuration of the sparse multiplication calculator 10 according to Modification 1 of this embodiment. When each functional component is implemented in hardware, the sparse multiplication calculator 10 includes an electronic circuit 15 instead of a processor 11, memory 12, and storage 13. The electronic circuit 15 is a dedicated circuit that implements the functions of each functional component, as well as the functions of the memory 12 and storage 13.

[0064] Electronic circuits 15 can include single circuits, complex circuits, programmed processors, parallel programmed processors, logic ICs, GAs, ASICs, and FPGAs. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be implemented in a single electronic circuit 15, or each functional component may be implemented by distributing them across multiple electronic circuits 15.

[0065] <Modification 2> As a second variation, some of the functional components may be implemented in hardware, while others may be implemented in software.

[0066] The processor 11, memory 12, storage 13, and electronic circuit 15 are collectively called the processing circuit. In other words, the function of each functional component is realized by the processing circuit.

[0067] <Variation 3> Figure 7 shows an example of the configuration of a Miller function calculator 400 according to modification 3 of this embodiment. In Figure 7, the hardware details are omitted, and only the functional components are illustrated.

[0068] In this embodiment, the finite field Fp k A sparse multiplication calculator 10 is described, which obtains elements f and g and performs only the multiplication calculation 6f*g when element f is sparse. The Miller function calculator 400 is equipped with the sparse multiplication calculator 10 of this embodiment and is a device that calculates Miller functions in pairing operations on an elliptic curve with a cubic twist.

[0069] In Figure 7, the sparse multiplication calculation device 10 may be read as the sparse multiplication calculation unit. Similar to the loose multiplication calculator 10 described in this embodiment, each functional component of the Miller function calculator 400 is implemented by software or hardware.

[0070] <Modification 4> Figure 8 shows an example of the configuration of a pairing calculation device 500 according to Modification 4 of this embodiment. In Figure 8, the hardware details are omitted, and only the functional components are illustrated.

[0071] The pairing calculation device 500 is a device that performs pairing calculations on an elliptic curve with a cubic twist. It comprises a Miller function calculation device 400 according to a modified example 3 of this embodiment, and a final power calculation device 510 that performs the calculation of the final power.

[0072] The pairing calculation device 500 performs pairing calculations on, for example, the BLS27 curve. It also performs pairing calculations on the BLS9 curve. Furthermore, it performs pairing calculations on the BLS15 curve. Finally, it performs pairing calculations on the BLS21 curve.

[0073] In Figure 8, the Miller function calculation device 400 may be read as the Miller function calculation unit. Similar to the sparse multiplication calculator 10 described in this embodiment, each functional component of the pairing calculator 500 is implemented by software or hardware.

[0074] Embodiment 2. This embodiment will primarily describe the differences from Embodiment 1 and the additions made to Embodiment 1. In this embodiment, components having the same function as those in Embodiment 1 are denoted by the same reference numerals, and their descriptions are omitted.

[0075] In Embodiment 1, in equation 13, where elements f and g are formally treated as polynomials, 0, 1, -1, 2, and ∞ were substituted in equations 14 and 15. In this embodiment, we will describe the method of substituting 0, 1, -1, -u, and ∞ in equations 14 and 15 into equation 13.

[0076] ***Explanation of the structure*** Figure 9 shows an example of the configuration of the sparse multiplication calculator 10 according to this embodiment. The configuration of the sparse multiplication calculator 10 according to this embodiment is the same as the configuration of the sparse multiplication calculator 10 according to this embodiment. The difference is that the first pre-calculation unit 31 substitutes 0, 1, -1, -u, and ∞ in equations 14 and 15 in equation 13.

[0077] ***Explanation of operation*** The operation of the sparse multiplication calculator 10 according to this embodiment will be described with reference to Figure 2 and Figures 10 to 12. The operating procedure of the sparse multiplication calculator 10 according to this embodiment corresponds to the sparse multiplication calculation method according to this embodiment. Furthermore, the program that implements the operation of the sparse multiplication calculator 10 according to this embodiment corresponds to the sparse multiplication calculation program according to this embodiment.

[0078] Referring to Figure 2, the overall operation of the sparse multiplication calculator 10 according to this embodiment will be described.

[0079] <Step S11: Pre-calculation> In the pre-calculation process of this embodiment, the pre-calculation unit 21 takes element f as a polynomial f(X) and element g as a polynomial g(X), and substitutes predetermined values ​​0, 1, -1, -u, ∞ for X. The pre-calculation unit 21 uses f(0), f(1), f(-1), f(-u), f(∞), g(0), g(1), g(-1), g(-u), g(∞) to determine H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), H3=f(-u)·g(-u), H4=f(∞)·g(∞), and h which is the coefficient of the polynomial obtained by expressing sparse multiplication f*g in terms of v. 0、 We calculate the five polynomials that associate with h1, h2, h3, and h4. More specifically, it is as follows:

[0080] First, substitute X=0, X=1, X=-1, X=-u, and X=∞ into the respective polynomials f(X) and g(X) to obtain equations 27 and 28.

number

number

[0081] Figure 10 is a flowchart showing the calculation process for specifically calculating equations 27 and 28 according to this embodiment. The calculation process for specifically calculating numbers 27 and 28 will be explained by referring to the flowchart of the calculations related to the first pre-calculation unit 31 in Figure 10.

[0082] In step S51, the first pre-calculation unit 31 calculates the addition using the coefficients f0 and f2 in the input f. In steps S52 and S53, the first pre-calculation unit 31 adds and subtracts the coefficient f1 to the result calculated in step S51, respectively. Through these steps, f(1) is calculated from step S52 and f(-1) is calculated from step S53.

[0083] In step S54, the first pre-calculation unit 31 calculates u times f1 and subtracts it from the coefficient f0. In step S55, the first pre-calculation unit 31 calculates u times f2 and subtracts it from the result calculated in step S54. This step process calculates f(-u).

[0084] In the second pre-calculation unit 32 of the pre-calculation unit 21, equation 29 is calculated in order to formulate a system of 5-dimensional linear equations in the equation formulation unit 22.

number

[0085] Here, h 0、 h1, h2, h3, and h4 are coefficients represented by equation 17. Note, v 3 Note that =u. This h 0、 h1, h2, h3, and h4 are the coefficients of the multiplication f*g that we ultimately want to calculate. Therefore, in the following, this h 0、 The goal is to calculate h1, h2, h3, and h4.

[0086] <Step S12: Solve the linear equation> In the equation formulation section 22, equation 30, which is a 5-dimensional linear equation, is formulated based on the results calculated in the pre-calculation section 21.

number

[0087] This matrix of 30 is u(u 2 A matrix is ​​invertible when (-1) is not 0. In this embodiment, we are considering a cubic extension field, so u can never be 0, 1, or -1, and therefore this matrix has an inverse. Multiplying both sides of equation 30 by the inverse matrix gives equation 31.

number

[0088] Here, the 4th and 5th elements when calculating the right-hand side of equation 31 correspond to the coefficients of the cubic and quartic systems in equation 17. Therefore, applying the remainder over a finite field is equivalent to multiplying the 4th row of the matrix on the right-hand side of equation 31 by u and adding it to the 1st row, and multiplying the 5th row by u and adding it to the 2nd row. In other words, equation 31 is equivalent to the relation v 3 When we take the remainder with =u, we get the number 32.

number

[0089] Subtracting both sides of equation 32 from -2u(u 2 Multiplying by -1 clears the denominator, and the coefficient h 0、 We obtain equation 33 for h1 and h2. Note that the calculations to obtain equations 31 and 32 are performed in equation formulation section 22.

number

[0090] Figures 11 and 12 are flowcharts showing the calculation process for specifically calculating the number 33 according to this embodiment. The calculation process for specifically calculating number 33 will be explained by referring to the calculation flowchart for the solution unit 23 in Figures 11 and 12.

[0091] In step S601, the solution unit 23 performs addition using H0, which has already been calculated in number 29, and writes the result to memory 12. In step S602, the solution unit 23 performs a multiplication of u using the already calculated 2H0 and writes the result to the memory 12. In step S603, the solution unit 23 performs a multiplication by u using the already calculated 2uH0 and writes the result to the memory 12. In step S604, the solution unit 23 performs a calculation using the value obtained in step S603 and the value obtained in step S602, and writes the result to the memory 12. The problem-solving unit 23 similarly performs the calculation steps from step S605 to step S621 and writes the results of each step to the memory 12.

[0092] In steps S701 to S703, the solution unit 23 performs calculations using the values ​​obtained in the calculation in Figure 11 and writes the results to the memory 12. One of the coefficients to be found in the process of step S703 is -2u(u 2 -1) obtain h0 Similarly, the calculations for the others are performed using the results of the previous calculations, and -2u(u 2 -1)h1, -2u(u 2 -1) Obtain h2

[0093] Next, we evaluate the computational cost of the calculation process up to this point. For numbers 27 and 28, we performed 6 additions and 2 multiplications of u, respectively. Therefore, the calculations for numbers 27 and 28 are completed in 12 additions and 4 multiplications of u. For the number 29, five multiplication operations were performed. For number 33, a total of 17 additions and 17 multiplications of u were performed. Based on these factors, the total computational cost in this embodiment is represented by Equation 34.

number

[0094] Up to this point, the coefficient h0、 Since we were able to find h1 and h2, we multiply them by the inputs f and g -2u(u 2 -1) This is equivalent to being able to calculate f*g.

[0095] In Embodiment 1, we consider a situation where either f or g is sparse. The case distinction is the same as in Embodiment 1, so it will be omitted.

[0096] (When the coefficient f0 or coefficient f2 is sparse) In this case, multiplication -2u(u 2 -1) The computational cost of f*g is expressed by equation 35.

number

[0097] (When the coefficient f1 is sparse) The computational cost in this case is represented by the number 36.

number

[0098] Finally, let's consider applying this sparse multiplication algorithm to the calculation of mirror functions in pairing operations. If sparse multiplication occurs n times in the calculation of mirror functions, then at the end of the calculation of mirror functions, (-2u(u 2 -1)) n Or (-2u(u 2 -1)) n v n Only a value that deviates from the desired value is output. However, due to the nature of the final power calculation, such constants disappear at the easy part calculation stage in the final power, and therefore do not affect the final pairing operation.

[0099] ***Other configurations*** <Modification 5> In the sparse multiplication calculator 10 according to this embodiment, the mirror function calculator 400 and the pairing calculator 500 are configured in the same way as in the modified examples 3 and 4 of Embodiment 1.

[0100] ***Effects of this embodiment*** As described above, the sparse multiplication calculator 10 according to this embodiment includes a pre-calculation unit that efficiently pre-calculates f(0), f(1), f(-1), f(-u), f(∞), g(0), g(1), g(-1), g(-u), g(∞), H0, H1, H2, H3, and H4 for the calculation of multiplication f*g. The sparse multiplication calculator 10 also includes an equation formulation unit that sets up a system of 5th-degree linear equations based on the results from the pre-calculation unit. The sparse multiplication calculator 10 also includes a solution unit that solves the system of 5th-degree linear equations set up by the equation formulation unit. As described above, the sparse multiplication calculator 10 according to this embodiment also performs appropriate pre-calculations, and the coefficients that become sparse are applicable in all cases. As a result, pairing operations can be calculated efficiently, similar to Embodiment 1.

[0101] Embodiment 3. This embodiment will primarily describe the differences from Embodiments 1 and 2, as well as the additions made to Embodiments 1 and 2. In this embodiment, components having the same function as those in Embodiments 1 and 2 are denoted by the same reference numerals, and their descriptions are omitted.

[0102] Embodiments 1 and 2 described methods for calculating sparse multiplication. This embodiment describes processing using the results of pairing operations calculated in Embodiments 1 and 2.

[0103] ***Explanation of the structure*** Figure 13 shows an example of the configuration of the cryptographic processing device 600 according to this embodiment. Figure 13 omits the hardware details and only illustrates the functional components.

[0104] The cryptographic processing unit 600 includes a pairing calculation device 500 as described in Embodiment 1 and Embodiment 2, and a cryptographic processing unit 610 that performs cryptographic processing using the results of the pairing calculation calculated by the pairing calculation device 500.

[0105] In Figure 13, the Miller function calculator 400 and the final power calculator 510 may be read as the Miller function calculator unit and the final power calculator unit. Similar to the loose multiplication calculator 10 described in Embodiment 1, each functional component of the cryptographic processing unit 600 is implemented by software or hardware.

[0106] ***Explanation of operation*** The operation of the cryptographic processing device 600 according to this embodiment will be described. The operation procedure of the cryptographic processing device 600 according to this embodiment corresponds to the cryptographic processing method according to this embodiment. Furthermore, the program that implements the operation of the cryptographic processing device 600 according to this embodiment corresponds to the cryptographic processing program according to this embodiment.

[0107] Figure 14 is a flowchart showing the operation of the cryptographic processing device 600 according to this embodiment. The operation procedure of the cryptographic processing device 600 according to this embodiment corresponds to the cryptographic processing method according to this embodiment. Furthermore, the program that implements the operation of the cryptographic processing device 600 according to this embodiment corresponds to the cryptographic processing program according to this embodiment.

[0108] <Step S81: Pairing calculation process> The result of the pairing calculation is calculated by a pairing calculation device 500 equipped with the functional components of the sparse multiplication calculation device 10 according to Embodiment 1 or Embodiment 2. The result of the pairing calculation is written to memory 12.

[0109] <Step S82: Cryptographic processing> The cryptographic processing unit 610 performs cryptographic processing using the result of the pairing operation obtained in step S81. Cryptographic processing consists of processing of cryptographic primitives such as encryption, decryption, signing, and verification. Encryption is the process of converting plaintext data into ciphertext in order to conceal the data from third parties. Decryption is the process of converting the ciphertext converted by encryption back into plaintext data. Signature is the process of generating a signature for at least one of the following purposes: detecting data tampering and verifying the origin of the data. Verification is the process of using the signature generated in the signature to detect data tampering and verify the origin of the data.

[0110] For example, the cryptographic processing unit 610 may generate a decrypted message using the result of a pairing operation that takes the elements of the ciphertext and the elements of the decryption key as input.

[0111] ***Effects of this embodiment*** As described above, the cryptographic processing device 600 according to this embodiment realizes cryptographic processing using the functional components of the sparse multiplication calculator 10 according to Embodiment 1 or Embodiment 2. The sparse multiplication calculator 10 according to Embodiment 1 and Embodiment 2 can efficiently calculate pairing operations. Therefore, the cryptographic processing device 600 according to this embodiment can efficiently perform cryptographic processing.

[0112] In embodiments 1 to 3 described above, each part of the loose multiplication calculator, pairing calculator, and cryptographic calculator was described as an independent functional block. However, the configuration of each of the loose multiplication calculator, pairing calculator, and cryptographic calculator does not have to be as described in the embodiments above. The functional blocks of each of the loose multiplication calculator, pairing calculator, and cryptographic calculator can be configured in any way as long as they can realize the functions described in the embodiments above. Furthermore, the loose multiplication calculator, pairing calculator, and cryptographic calculator may not be a single device, but a system composed of multiple devices. Furthermore, multiple parts of Embodiments 1 to 3 may be combined and implemented. Alternatively, only one part of these embodiments may be implemented. In addition, these embodiments may be combined and implemented in any way, either as a whole or in part. That is, in Embodiments 1 to 3, a free combination of each embodiment, a deformation of any component of each embodiment, or an omission of any component in each embodiment is possible.

[0113] Note that the above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of the application of the present disclosure, and the scope of the use of the present disclosure. The above-described embodiments can be variously modified as necessary. For example, the procedures described using the flowcharts or sequence diagrams may be modified as appropriate.

[0114] Hereinafter, aspects of the present disclosure will be summarized and described as appendices.

[0115] (Appendix 1) A sparse multiplication calculation device for calculating sparse multiplication used in the calculation of a mirror function in a pairing operation on an elliptic curve having a cubic twist, where k is a natural number divisible by 3, e is a natural number represented by k / 3, and Fp k is a finite field having p k elements, and a polynomial ring representation Fp k = Fp e [v] / (v 3 - u) is a finite field, u is an element of Fp e , and v 3 - u is an irreducible polynomial. In a sparse multiplication calculation device for calculating a sparse multiplication f*g of an element f and an element g of the finite field Fp k input as, a pre-calculation unit that calculates five polynomials associating the element f, the element g, and h 0、 h1, h2, h3, h4 that are coefficients of the polynomial representing the sparse multiplication f*g in terms of v; a formulation unit that formulates a five-dimensional linear equation for obtaining h 0、 h1, h2, h3, h4 that are coefficients of the polynomial representing the sparse multiplication f*g in terms of v using the five polynomials; a solving unit that solves the five-dimensional linear equation to obtain h 0、 [[ID= A sparse multiplication calculator equipped with the following features. (Note 2) The aforementioned pre-calculation unit, Let the element f be a polynomial f(X) and the element g be a polynomial g(X). Substituting predetermined values ​​for X, we obtain f(0), f(1), f(-1), f(2), f(∞), g(0), g(1), g(-1), g(2), g(∞), and each of H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), H3=f(2)·g(2), H4=f(∞)·g(∞), and the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h. 0、 A sparse multiplication calculator as described in Appendix 1, which calculates the five polynomials associated with h1, h2, h3, and h4. (Note 3) The aforementioned pre-calculation unit, Let the element f be a polynomial f(X) and the element g be a polynomial g(X). Substituting predetermined values ​​for X, we obtain f(0), f(1), f(-1), f(-u), f(∞), g(0), g(1), g(-1), g(-u), g(∞). Using these, we have H0=f(0)·g(0), H1=f(1)·g(1), H2=f(-1)·g(-1), H3=f(-u)·g(-u), H4=f(∞)·g(∞), and the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h. 0、 A sparse multiplication calculator as described in Appendix 1, which calculates the five polynomials associated with h1, h2, h3, and h4. (Note 4) A mirror function calculator that performs the calculation of mirror functions in pairing operations on an elliptic curve with a cubic twist, A mirror function calculator equipped with a sparse multiplication calculator as described in any one of the items from Appendix 1 to Appendix 3. (Note 5) A pairing calculation device that performs pairing calculations on an elliptic curve with a cubic twist, A pairing arithmetic device comprising a mirror function calculator as described in Appendix 4 and a final power calculator that performs the calculation of the final power. (Note 6) The pairing calculation device is A pairing calculation device as described in Appendix 5, which performs pairing calculations on the BLS (Barreto-Lynn-Scott) 27 curve. (Note 7) The pairing calculation device is A pairing calculation device as described in Appendix 5, which performs pairing calculations on the BLS9 curve. (Note 8) The pairing calculation device is A pairing calculation device as described in Appendix 5, which performs pairing calculations on the BLS15 curve. (Note 9) The pairing calculation device is A pairing calculation device as described in Appendix 5, which performs pairing calculations on the BLS21 curve. (Note 10) An encryption processing device comprising a pairing calculation device described in any one of the items from Appendix 5 to Appendix 9, and an encryption processing unit that performs encryption processing using the result of a pairing calculation calculated by the pairing calculation device. (Note 11) A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp k The element is p k Representation of a polynomial ring Fp in a finite field consisting of 10 elements k =Fp e [v] / (v 3 Let u be a finite field having -u) and let u be Fp e As the basis of, v 3 When -u is an irreducible polynomial, the finite field Fp k In a sparse multiplication calculation method used in a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as inputs, The computer uses the elements f and g, and h, which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. 0、 We calculate the five polynomials that associate h1, h2, h3, and h4, Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、We formulate a 5-dimensional linear equation to find h1, h2, h3, and h4. Solving the aforementioned 5-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 A sparse multiplication method for calculating h1, h2, h3, and h4. (Note 12) A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp k The element is p k Representation of a polynomial ring Fp in a finite field consisting of 10 elements k =Fp e [v] / (v 3 Let u be a finite field having -u) and let u be Fp e As the basis of, v 3 When -u is an irreducible polynomial, the finite field Fp k In a sparse multiplication calculation program used in a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as inputs, The elements f and g mentioned above, and h which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. 0、 A pre-computation process to calculate five polynomials that associate h1, h2, h3, and h4, Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 The process of formulating a 5-dimensional linear equation to find h1, h2, h3, and h4, Solving the aforementioned 5-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h 0、 The process of finding h1, h2, h3, and h4 A program that causes a computer to perform sparse multiplication calculations. [Explanation of Symbols]

[0116] 10 Sparse multiplication calculator, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 15 Electronic circuit, 21 Pre-calculation unit, 22 Formula formulation unit, 23 Solving unit, 400 Mirror function calculator, 500 Pairing calculator, 510 Final power calculator, 600 Cryptographic processing unit, 610 Cryptographic processing unit.

Claims

1. A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp ｋ The element is p ｋ A representation of a polynomial ring Fp in a finite field consisting of 10 elements. ｋ = Fp ｅ [v] / (v ３ Let u be a finite field having -u, and let u be Fp ｅ As the basis of, v ３ When -u is an irreducible polynomial, the finite field Fp ｋ In a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as inputs, The original f and the original g, and h which becomes the coefficient of the polynomial representing the sparse multiplication f*g by v ０、 h １ , h ２ , h ３ , h ４ A pre-calculation unit that calculates five polynomials associated with h Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ The equation formulation part sets up a 5-dimensional linear equation to find the value, Solving the aforementioned five-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ The part that seeks the solution and A sparse multiplication calculator equipped with the following features.

2. The aforementioned pre-calculation unit, Let the element f be a polynomial f(X) and the element g be a polynomial g(X). Substituting predetermined values ​​for X, we obtain f(0), f(1), f(-1), f(2), f(∞), g(0), g(1), g(-1), g(2), g(∞), and then use these to determine H ０ = f(0)・g(0), H １ = f(1)・g(1), H ２ = f(-1)・g(-1), H ３ = f(2)・g(2), H ４ = f(∞) and g(∞), and h, which is the coefficient of the polynomial obtained by expressing the aforementioned sparse multiplication f*g in terms of v. ０、 h １ , h ２ , h ３ , h ４ The sparse multiplication calculator according to claim 1, which calculates the five polynomials associated with the given terms.

3. The aforementioned pre-calculation unit, Let the element f be a polynomial f(X), and let the element g be a polynomial g(X). Substituting predetermined values ​​for X, we obtain f(0), f(1), f(-1), f(-u), f(∞), g(0), g(1), g(-1), g(-u), g(∞), and then use H ０ = f(0)・g(0), H １ = f(1)・g(1), H ２ = f(-1)・g(-1), H ３ = f(-u)・g(-u), H ４ = f(∞) and g(∞), and h, which is the coefficient of the polynomial obtained by expressing the aforementioned sparse multiplication f*g in terms of v. ０、 h １ , h ２ , h ３ , h ４ The sparse multiplication calculator according to claim 1, which calculates the five polynomials associated with the given terms.

4. A mirror function calculator that performs the calculation of mirror functions in pairing operations on an elliptic curve with a cubic twist, A mirror function calculator comprising a sparse multiplication calculator according to any one of claims 1 to 3.

5. A pairing calculation device that performs pairing calculations on an elliptic curve with a cubic twist, A pairing arithmetic device comprising a mirror function calculator according to claim 4 and a final power calculator for calculating the final power.

6. The pairing calculation device is The pairing calculation device according to claim 5, which performs pairing calculations on the BLS (Barreto-Lynn-Scott) 27 curve.

7. The pairing calculation device is The pairing calculation device according to claim 5, which performs pairing calculations on a BLS9 curve.

8. The pairing calculation device is The pairing calculation device according to claim 5, which performs pairing calculations on a BLS15 curve.

9. The pairing calculation device is The pairing calculation device according to claim 5, which performs pairing calculations on the BLS21 curve.

10. An encryption processing device comprising a pairing calculation device as described in claim 5, and an encryption processing unit that performs encryption processing using the result of a pairing calculation calculated by the pairing calculation device.

11. A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp ｋ The element is p ｋ A representation of a polynomial ring Fp in a finite field consisting of 10 elements. ｋ = Fp ｅ [v] / (v ３ Let u be a finite field having -u, and let u be Fp ｅ As the basis of, v ３ When -u is an irreducible polynomial, the finite field Fp ｋ In a sparse multiplication calculation method used in a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as inputs, The computer uses the elements f and g, and h, which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. ０、 h １ , h ２ , h ３ , h ４ We calculate the five polynomials that correspond to and Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ We formulate a five-dimensional linear equation to find the value of, Solving the aforementioned five-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ A sparse multiplication calculation method to find [the result].

12. A sparse multiplication calculator for calculating sparse multiplication used in the calculation of Miller functions in pairing operations on elliptic curves with cubic twist, wherein k is a natural number divisible by 3, e is a natural number expressible as k / 3, and Fp ｋ The element is p ｋ A representation of a polynomial ring Fp in a finite field consisting of 10 elements. ｋ = Fp ｅ [v] / (v ３ Let u be a finite field having -u, and let u be Fp ｅ As the basis of, v ３ When -u is an irreducible polynomial, the finite field Fp ｋ In a sparse multiplication calculation program used in a sparse multiplication calculator that calculates a sparse multiplication f*g with elements f and g as input, The elements f and g mentioned above, and h which is the coefficient of the polynomial obtained by expressing the sparse multiplication f*g in terms of v. ０、 h １ , h ２ , h ３ , h ４ A pre-computation process to calculate five polynomials that associate with and Using the five polynomials mentioned above, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ The process of formulating a 5-dimensional linear equation to find the value, Solving the aforementioned five-dimensional linear equation, the coefficients of the polynomial obtained by expressing the sparse multiplication f*g in terms of v are h ０、 h １ , h ２ , h ３ , h ４ The process of finding the solution and A program that causes a computer to perform sparse multiplication calculations.

Images