Isogeny computation device, cryptosystem, isogeny computation method, and isogeny computation program

Abstract

An ideal computation unit (24) uses a basis of an integer ring O_H of a Hilbert class field computed from system parameters in isogeny-based cryptography, and an ideal class (1_i, √(-p)-1) for each integer i of i = 1, …, n (n is an integer of 1 or more), the ideal class being set by a prime number p given as the system parameter and a prime number l_i given as the system parameter for each integer i of i = 1, …, n to compute an ideal L_i = (l_i, √(-p)-1)O_H for each integer i of i = 1, …, n. A public key computation unit (25) computes a public key by Artin mapping using the ideal L_i for each integer i of i = 1, …, n computed by the ideal computation unit (24) and the system parameter.

Description

Isomorphic Mapping Computing Device, Cryptosystem, Isomorphic Mapping Calculation Method, and Isomorphic Mapping Calculation Program

[0001] The present disclosure relates to a technology for calculating public keys in isomorphic mapping cryptography.

[0002] Research and development of quantum-resistant cryptography that cannot be decoded even by quantum computers are underway. Isomorphic mapping cryptography is a type of quantum-resistant cryptography, and it has the advantage of having a smaller key, ciphertext, and signature size compared to other quantum-resistant cryptographies. As a typical prior art, CSIDH exists (Non-Patent Document 1). CSIDH is an abbreviation of Commutative SI-DH. SI-DH is an abbreviation of Supersingular Isogeny Diffie-Hellman.

[0003] The prior art had a problem that the public key calculation time was long compared to other cryptographic methods based on computational complexity problems such as lattice cryptography. In response to this, an improved method of shortening the calculation time by improving polynomial processing has been proposed (Non-Patent Document 2).

[0004] CASTRYCK, Wouter, et al. CSIDH: an efficient post-quantum commutative group action. In: Advances in Cryptology-ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2-6, 2018, Proceedings, Part III 24. Springer International Publishing, 2018. p. 395-427. BERNSTEIN, Daniel J., et al. Faster computation of isogenies of large prime degree. Open Book Series, 2020, 4.1: 39-55.

[0005] However, even with the improved methods, the random sampling process, which is the most time-consuming part of public key calculation, remains unimproved. Furthermore, because random sampling is a probabilistic process, it is difficult to estimate the computation time, and the computation time must be adjusted to the worst-case scenario. This disclosure aims to speed up the computation of public keys in isomorphism cryptography and to make it easier to estimate the computation time.

[0006] The homogeneous mapping computing device according to this disclosure comprises an ideal calculation unit that calculates an ideal L_i = (l_i, √(-p) - 1) O_H for each integer i = 1, ..., n, using a basis for the integer ring O_H of the Hilbert class calculated from the system parameters in the homogeneous mapping cryptography, and an ideal class (l_i, √(-p) - 1) for each integer i = 1, ..., n, set by a prime number p given as the system parameter and a prime number l_i for each integer i = 1, ..., n, given as the system parameter; and a public key calculation unit that calculates a public key by Artin mapping using the ideal L_i for each integer i = 1, ..., n, calculated by the ideal calculation unit and the system parameters.

[0007] This disclosure describes how to compute the public key using the Artin map. This makes it possible to compute the public key in an isomorphism cryptosystem without random sampling. As a result, the computation speed is increased, and it becomes easier to estimate the computation time.

[0008] Hardware configuration diagram of the homogeneous mapping computing device 10 according to Embodiment 1. Functional configuration diagram of the homogeneous mapping computing device 10 according to Embodiment 1. Flowchart showing the operation of the homogeneous mapping computing device 10 according to Embodiment 1. Functional configuration diagram of the homogeneous mapping computing device 10 according to Embodiment 2. Flowchart showing the operation of the homogeneous mapping computing device 10 according to Embodiment 2.

[0009] Embodiment 1. ***Explanation of Notation*** In the following explanation, subscripts may be represented using "_". For example, X_Y is X ＹThis represents exponentiation. Also, exponentiation is sometimes represented using "^". For example, X^Y is X Ｙ It represents [something]. Also, √X represents the number 11.

[0010] ***Configuration Description*** Referring to Figure 1, the hardware configuration of the homogeneous mapping computing device 10 according to Embodiment 1 will be described. The homogeneous mapping computing device 10 is a computer. The homogeneous mapping computing device 10 comprises a processor 11, memory 12, storage 13, and input / output interface 14. The processor 11 is connected to other hardware via signal lines and controls this other hardware.

[0011] Processor 11 is an IC that performs processing. IC stands for Integrated Circuit. Specific examples of processor 11 include CPU, DSP, and GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0012] Memory 12 is a storage device that temporarily stores data. Specific examples of memory 12 include SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0013] Storage 13 is a storage device for storing data. Specific examples of storage 13 include SSDs and HDDs. SSD stands for Solid State Drive. HDD stands for Hard Disk Drive. Storage 13 may also be a portable recording medium such as an SD® memory card, CompactFlash®, NAND flash, flexible disk, optical disk, compact disk, Blu-ray® disk, or DVD. SD stands for Secure Digital. DVD stands for Digital Versatile Disk. Furthermore, storage 13 may be located outside the homogeneous mapping computing device 10, such as a cloud server.

[0014] The input / output interface 14 is an interface for communicating with external devices. Specific examples of the input / output interface 14 include Ethernet®, USB, and HDMI® ports. USB stands for Universal Serial Bus. HDMI stands for High-Definition Multimedia Interface.

[0015] Referring to Figure 2, the functional configuration of the isomorphism calculation device 10 according to Embodiment 1 will be described. The isomorphism calculation device 10 comprises a parameter generation unit 1, a class field calculation unit 2, a basis calculation unit 3, an ideal calculation unit 4, and a public key calculation unit 5 as functional components. The functions of each functional component of the isomorphism calculation device 10 are realized by software.

[0016] Storage 13 stores programs that implement the functions of each functional component of the isomorphism computing device 10. These programs are loaded into memory 12 by the processor 11 and executed by the processor 11. This enables the implementation of the functions of each functional component of the isomorphism computing device 10.

[0017] In Figure 1, only one processor 11 was shown. However, there may be multiple processors 11, and multiple processors 11 may work together to execute programs that implement each function.

[0018] ***Explanation of Operation*** The operation of the homogeneous mapping calculation device 10 according to Embodiment 1 will be explained with reference to Figure 3. The operation procedure of the homogeneous mapping calculation device 10 according to Embodiment 1 corresponds to the homogeneous mapping calculation method according to Embodiment 1. Furthermore, the program that realizes the operation of the homogeneous mapping calculation device 10 according to Embodiment 1 corresponds to the homogeneous mapping calculation program according to Embodiment 1.

[0019] Embodiment 1 describes the case where CSIDH is used as the isomorphism encryption method. The isomorphism computing device 10 is not limited to CSIDH, but can also be applied to other isomorphism encryption methods.

[0020] (Step S11: Parameter generation process) The parameter generation unit 21 generates the parameters of CSIDH. Specifically, the parameter generation unit 21 takes the security parameter k as input and is given the system parameter pp_CSIDH = (p, E, (l_1, ..., l_n), B, (e_1, ..., e_n)). p is a prime number of the form p = 4(l_1...l_n) - 1. E is a hypersingular elliptic curve over a finite field F_p, whose F_p-autohomogenesis ring is isomorphic to the ring of integers O_K of the imaginary quadratic field K = Q(√(-p)). Here Q represents the field of rational numbers. (l_1, ..., l_n) are n distinct prime numbers. (e_1, ..., e_n) is the secret key, and for each integer i = 1, ..., n, e_i is randomly selected from the integer interval [-B, B]. n is an integer greater than or equal to 1.

[0021] The parameter generation unit 21 generates ideals (l_i, √(-p)-1) for each integer i i = 1, ..., n using prime numbers l_i and p for each integer i i = 1, ..., n. Then, using the secret key (e_1, ..., e_n) and the ideals (l_i, √(-p)-1) for each integer i i = 1, ..., n, the secret key [a] = (l_1, √(-p)-1)^(e_1) ... (l_n, √(-p)-1)^(e_n).

[0022] (Step S12: Class field calculation process) The class field calculation unit 22 calculates the Hilbert class field H using the parameters of CSIDH. Specifically, the class field calculation unit 22 sets the imaginary quadratic field K = Q(√(-p)) using a prime number p. The class field calculation unit 22 calculates the j-invariant j(E) of the elliptic curve E, and adds the j-invariant j(E) to the imaginary quadratic field K to calculate the Hilbert class field H = K(j(E)). More specifically, the class field calculation unit 22 calculates the Hilbert class polynomial H(x) and performs operations such as dividing the polynomial ring K[x] of the imaginary quadratic field coefficients by the ideal (H(x)) generated therein. For the method of calculating the Hilbert class polynomial, for example, the method in Non-Patent Literature 3 can be used. Non-Patent Literature 3: BELDING, Juliana, et al. Computing Hilbert class polynomials. In: Algorithmic Number Theory: 8th International Symposium, ANTS-VIII Banff, Canada, May 17-22, 2008 Proceedings 8. Springer Berlin Heidelberg, 2008. p. 282-295.

[0023] (Step S13: Base Calculation Process) The basis calculation unit 23 calculates the basis (generators) of the integer ring O_H of the Hilbert class field H. Specifically, the basis calculation unit 23 calculates the basis for the Hilbert class field H using, for example, the method described in Non-Patent Literature 4. Non-Patent Literature 4: Cohen, Henri. Advanced topics in computational number theory. Springer Science & Business Media, 2012.

[0024] (Step S14: Ideal Calculation Process) The ideal calculation unit 24 uses the basis of the integer ring O_H and l_i and √(-p)-1, which are the generators of the ideal (l_i, √(-p)-1) for each integer i = 1, ..., n, calculated as CSIDH parameters, to calculate the ideal L_i = (l_i, √(-p)-1)O_H for each integer i = 1, ..., n. This calculation is performed as an ideal product, and is done by multiplying (l_i, √(-p)-1) and the generators of O_H together.

[0025] (Step S15: Public Key Calculation Process) The public key calculation unit 25 calculates the public key using the Artin map. The definition of the Artin map is described in Non-Patent Literature 5. Non-Patent Literature 5: SILVERMAN, Joseph H. Advanced topics in the arithmetic of elliptic curves. Springer Science & Business Media, 1994.

[0026] Specifically, the public key calculation unit 25 uses the ideal data obtained by the ideal calculation unit 4 and the system parameter pp_CSIDH to perform the calculation shown in Equation 12. In Equation 12, [a] is the private key [a] generated by the parameter generation unit 21.

[0027] The public key calculation unit 25 calculates the public key, the j-invariant j([a]*E), by taking the value of the j-invariant j(E) and, for each integer i i = 1, ..., n, in order, raising it to the power of the ideal generator l_i and calculating the remainder modulo the ideal L_i, as shown in Equation 12. In other words, the public key calculation unit 25 calculates the public key, the j-invariant j([a]*E), by repeatedly performing the operation of raising the value of the j-invariant j(E) to the power of the ideal and taking the remainder modulo the ideal L_i. To perform the calculation of the Artin map as shown in Equation 12, it is necessary to prepare the ideal generator l_i, which is the value to be raised to, and the ideal L_i, which is the modulo. The ideal generator l_i can be obtained from pp_CSIDH. The ideal L_i, which is the modulo, has already been calculated in step S14. Therefore, it is possible to perform calculations of the Artin map as shown in equation 12. This calculation uses only exponentiation and modulo operations, eliminating the need for random sampling and thus reducing the computational complexity. Furthermore, estimating the computation time is simpler than when random sampling is used, as it only requires estimation for exponentiation and modulo operations.

[0028] Finally, the public key calculation unit 25 outputs the public key, which is the j-invariant j([a]*E).

[0029] ***Effects of Embodiment 1*** As described above, the homogeneous mapping computing device 10 according to Embodiment 1 adds the ideal L_i to the parameters used in public key calculation and calculates the public key using the Artin map. This makes it possible to calculate the public key in homogeneous mapping cryptography without random sampling, which is a probabilistic operation. As a result, the calculation speed is increased and the calculation time can be easily estimated.

[0030] Embodiment 2. Embodiment 1 described the case where CSIDH was used as the isomorphism encryption method. Embodiment 2 describes the case where CRS was used as the isomorphism encryption method. CRS is an abbreviation for Couveignes-Rostovtsev-Stolbunov.

[0031] ***Description of Configuration*** Referring to Figure 4, the functional configuration of the homogeneous mapping calculation device 10 according to Embodiment 2 will be described. The homogeneous mapping calculation device 10 has the same functional components as the homogeneous mapping calculation device 10 according to Embodiment 1. However, some parameters generated by the parameter generation unit 21 are different.

[0032] ***Explanation of Operation*** The operation of the isomorphism calculation device 10 according to Embodiment 2 will be explained with reference to Figure 5. (Step S21: Parameter generation process) The parameter generation unit 21 generates the parameters of CRS. Specifically, the parameter generation unit 21 takes the security parameter k as input and is given the system parameter pp_CRS=(p, E, (l_1, ..., l_n), t, B, (e_1, ..., e_n)). p is a prime number of the form p = 7(l_1...l_n)-1. E is a normal elliptic curve on F_p, and its F_p-autohomogenesis ring is isomorphic to the ring of integers O_K of the imaginary quadratic field K=Q(√(-p)). Here Q represents the field of rational numbers. (l_1, ..., l_n) are n distinct prime numbers. t is a value called the trace of the Frobenius map associated with the elliptic curve E. (e_1, ..., e_n) are secret keys, each randomly selected from the integer interval [-B, B]. n is an integer greater than or equal to 1.

[0033] The parameter generation unit 21 generates ideals (l_i, √(-p)-λ) for each integer i = 1, ..., n using prime numbers l_i and p for each integer i = 1, ..., n. Then, using the secret key (e_1, ..., e_n) and the ideals (l_i, √(-p)-λ) for each integer i = 1, ..., n, the secret key [a] = (l_1, √(-p)-λ)^(e_1) ... (l_n, √(-p)-λ)^(e_n). Here, λ is the solution modulo l_i to the polynomial f(x) = x^2 - tx + p.

[0034] The processing from steps S22 to S25 is, in principle, the same as the processing from steps S12 to S15 in Figure 3. The only difference is that the input parameters are CRS parameters instead of CSIDH parameters.

[0035] ***Effects of Embodiment 2*** As described above, it is possible to use CSR instead of CSIDH as the isomorphism cryptography. The isomorphism computing device 10 can be applied not only to CSIDH and CSR as isomorphism cryptography, but also to other isomorphism cryptography schemes. In any case, the public key in the isomorphism cryptography can be calculated without random sampling, which is a probabilistic operation. As a result, the calculation speed is increased and the calculation time can be easily estimated.

[0036] ***Other Configurations*** <Modification 1> An encryption system can be configured using the isomorphism computing device 10 described in Embodiments 1 and 2. Specifically, an encryption system can be configured comprising the isomorphism computing device 10 and one or more encryption processing devices that process cryptographic primitives. Processing of cryptographic primitives includes processes such as encryption, decryption, signature generation, and signature verification.

[0037] <Modification 2> In Embodiment 1, each functional component was implemented in software. However, in Modification 2, each functional component may be implemented in hardware. The differences between this Modification 2 and Embodiment 1 will be explained below.

[0038] When each functional component is implemented in hardware, the homogeneous mapping computing device 10 includes electronic circuits instead of the processor 11, memory 12, and storage 13. The electronic circuits are dedicated circuits that implement the functions of each functional component, as well as the functions of the memory 12 and storage 13.

[0039] As the electronic circuit, a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a GA, an ASIC, or an FPGA is assumed. GA is an abbreviation of Gate Array. ASIC is an abbreviation of Application Specific Integrated Circuit. FPGA is an abbreviation of Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by being distributed to a plurality of electronic circuits.

[0040] <Modification Example 3> As Modification Example 3, some of each functional component may be realized by hardware and the other each functional component may be realized by software.

[0041] The processor 11, the memory 12, the storage 13, and the electronic circuit are referred to as a processing circuit. That is, the functions of each functional component are realized by the processing circuit.

[0042] Also, the "section" in the above description may be read as "circuit", "step", "procedure", "process", or "processing circuit".

[0043] The various aspects of this disclosure are summarized below as appendices. (Appendix 1) An isomorphism computing device comprising: an ideal calculation unit that calculates an ideal L_i = (l_i, √(-p) - 1) O_H for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) using a basis for the ring of integers O_H of the Hilbert class calculated from the system parameters in an isomorphism cryptography, a prime number p given as the system parameter, and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) set by the ideal class (l_i, √(-p) - 1) for each integer i = 1, ..., n (where n is an integer greater than or equal to 1), and a public key calculation unit that calculates a public key by an Artin map using the ideal L_i for each integer i = 1, ..., n calculated by the ideal calculation unit and the system parameters. (Note 2) The public key calculation unit calculates the public key by performing a process of raising the value of the j-invariant j(E) for the elliptic curve E given as a system parameter to the power of each integer i i = 1, ..., n by the generator l_i of the ideal class and calculating the remainder modulo the ideal L_i, as described in Note 1. (Note 3) The public key calculation unit calculates the public key j([a]*E) as described in Note 2 by calculating Equation 1. (Equation 1) (Note 4) An encryption system comprising: an encryption device described in any one of Notes 1 to 3; an encryption device that generates ciphertext by encrypting using the public key calculated by the encryption device; and a decryption device that decrypts the ciphertext generated by the encryption device.(Note 5) An isomorphism computation method in which a computer calculates an ideal L_i = (l_i, √(-p) - 1) O_H for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) using a basis for the ring of integers O_H of the Hilbert class calculated from the system parameters in an isomorphism cryptography, a prime number p given as the system parameter, and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) given as the system parameter, and an ideal class (l_i, √(-p) - 1) for each integer i = 1, ..., n, and the system parameters, and the computer calculates a public key by an Artin map using the calculated ideal L_i for each integer i = 1, ..., n, and the system parameters. (Note 6) An isomorphism computation program that causes a computer to function as an isomorphism computation device, which performs an ideal computation process to compute the ideal L_i = (l_i, √(-p) - 1) O_H for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) using a basis for the ring of integers O_H of the Hilbert class fields calculated from the system parameters in an isomorphism cryptography, a prime number p given as the system parameter, and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) given as the system parameter, and an ideal class (l_i, √(-p) - 1) for each integer i = 1, ..., n, and the ideal L_i for each integer i = 1, ..., n calculated by the ideal computation process and the system parameters, and a public key computation process to compute the public key by the Artin map using the ideal L_i for each integer i = 1, ..., n, calculated by the ideal computation process and the system parameters.

[0044] The embodiments and variations of this disclosure have been described above. Some of these embodiments and variations may be implemented in combination. Alternatively, some or all of them may be implemented in part. However, this disclosure is not limited to the embodiments and variations described above, and various modifications are possible as needed.

[0045] 10 Homogeneous mapping computing device, 11 Processor, 12 Memory, 13 Storage, 14 Input / Output interface, 21 Parameter generation unit, 22 Class field calculation unit, 23 Base calculation unit, 24 Ideal calculation unit, 25 Public key calculation unit.

Claims

1. i = 1 is set by a basis of the integer ring O_H of the Hilbert class fields calculated from the system parameters in the isomorphism cryptography, and a prime number p given as the system parameter and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) given as the system parameter. , , , Using the ideal class (l_i, √(-p)-1) for each integer i of n, i = 1, ... An ideal calculation unit that calculates the ideal L_i = (l_i, √(-p)-1)O_H for each integer i of n, and i = 1 calculated by the ideal calculation unit A homogeneous mapping computing device comprising a public key calculation unit that calculates a public key using the Artin mapping with respect to the ideal L_i for each integer i of n and the system parameters.

2. The public key calculation unit sets i = 1 for the value of the j-invariant j(E) for the elliptic curve E given as a system parameter. The isomorphism computing device according to claim 1, which calculates the public key by performing a process of raising each integer i of , , , n to the power of the generator l_i of the ideal class and calculating the remainder modulo the ideal L_i.

3. The same mapping calculation device according to claim 2, wherein the public key calculation unit calculates the public key j([a]*E) by calculating the number 1.

4. A cryptographic system comprising: an isomorphism computing device according to any one of claims 1 to 3; and a cryptographic processing device that processes cryptographic primitives using the public key calculated by the isomorphism computing device.

5. The computer sets i = 1 by a basis of the integer ring O_H of the Hilbert class fields calculated from the system parameters in the isomorphism cryptography, and a prime number p given as the system parameter and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) given as the system parameter. , , , Using the ideal class (l_i, √(-p)-1) for each integer i of n, i = 1, ...For each integer i of n, the ideal L_i = (l_i, √(-p)-1)O_H is calculated, and the computer calculates i = 1 A method for computing an isomorphism that computes a public key using the Artin map with respect to the ideal L_i for each integer i of n and the system parameters.

6. i = 1 is set by a basis of the integer ring O_H of the Hilbert class fields calculated from the system parameters in the isomorphism cryptography, and a prime number p given as the system parameter and a prime number l_i for each integer i = 1, ..., n (where n is an integer greater than or equal to 1) given as the system parameter. , , , Using the ideal class (l_i,√(-p)-1) for each integer i of n, i = 1, ... An ideal calculation process that calculates the ideal L_i = (l_i, √(-p)-1)O_H for each integer i of n, and i = 1 calculated by the ideal calculation process An isomorphism computation program that causes a computer to function as an isomorphism computation device that performs a public key computation process that computes a public key using the Artin map with respect to the ideal L_i for each integer i of n and the system parameters.

Images