Final Exponentiation Computation Device Polynomial Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no general method for efficiently computing the hard part of final exponentiation in pairing computation, which depends on elliptic curve parameters, and requires pre-computation for each curve.
Innovation Solution
A final exponentiation computation device decomposes the exponent portion into easy and hard parts using a polynomial Φk(p(x)) and computes the hard part using powers of T(x), h1(x), h2(x), and inverse element computations, enabling efficient computation across various elliptic curves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the exponent portion is decomposed into easy and hard parts using polynomial Φk(p(x)), then the computation efficiency of final exponentiation is improved, but the device complexity increases due to multiple polynomial computations required
Solution Approach 1:
The exponent portion (p(x)^k - 1)/r(x) is segmented into two distinct parts: an easy part that can be computed efficiently using fast exponentiation of p(x)^i, and a hard part that requires polynomial computations involving Φk(p(x)). This segmentation allows each part to be optimized independently, improving overall computation efficiency while managing complexity through structured division of the computational task.
2Adaptability or versatility
If a general method for computing the hard part is developed, then the adaptability to various elliptic curves is improved, but the computation amount increases due to multiple polynomial operations
Solution Approach 1:
The patent develops a universal computation method for the hard part that works across multiple elliptic curve types (BLS curves with embedding degrees k=24, 27, 42, 48 and KSS curves). The same polynomial computation framework involving Φk(p(x)) and the derived polynomials T(x), h1(x), h2(x) can be applied to different curve parameters, providing adaptability while maintaining a consistent computational approach that avoids redundant method development for each curve type.
3Measurement precision
If pre-computation is performed for each elliptic curve, then the computation precision is improved, but the loss of time increases due to curve-specific preparation
Solution Approach 1:
The patent performs preliminary decomposition of the exponent portion into easy and hard parts using the polynomial Φk(p(x)) before the actual final exponentiation computation. The hard part is transformed into a linear sum of p(x)^i terms in advance, and the necessary polynomial computations (involving T(x), h1(x), h2(x)) are prepared beforehand. This preliminary action ensures computation precision is maintained while reducing the time required during the actual pairing computation by having the complex polynomial structure already simplified and ready.
Data Source
AI summary
A decomposition unit (211) decomposes an exponent portion of a final exponentiation computation portion of pairing computation in an elliptic curve into an easy part and a hard part with using a polynomial Φk(p(x)), the elliptic curve being expressed by: a polynomial r(x)=Φk(T(x))/h2(x), a polynomial p(x)=h1(x)r(x)+T(x), and a polynomial t(x)=T(x)+1 which are expressed with using a cyclotomic polynomial Φk(x) having a degree d, a polynomial T(x), a polynomial h1(x), and a polynomial h2(x); and an embedding degree k. An exponentiation computation unit (22) computes the hard part with using a power of a polynomial p(x)i for each integer i of i=0, . . . , d−1, a power of λd−i(x) where λd−i(x)=cd, a power of λi where λi=T(x)λi+1(x)+ci+1 for each integer i of i=0, . . . , d−2, a power of h1(x), a power of h2(x), multiplication, and inverse element computation.