The present application is a national phase entry under 35 U.S.C. §371 of International Application No. PCT/JP2005/020967 filed Nov. 15, 2005, which claims priority from Japanese Provisional Patent Application No. P2004-337186 filed Nov. 22, 2004.
The present invention relates to a cryptographic processing method, a cryptographic processing apparatus, and a computer program. More particularly, the present invention relates to a cryptographic processing method, an encryption apparatus, and a computer program, which allow high-speed processing of a scalar multiplication operation in a hyperelliptic curve cryptography process.
With increasing progress and popularity of network communications and e-commerce in recent years, it has become very important to achieve high security. One method to achieve high security is to use encryption in communication, and many encryption techniques are known.
For example, there is a known system in which a cryptographic processing module is disposed in a small-sized apparatus such as an IC card whereby, when data is transmitted between the IC card and a data reader/writer, processing including authentication and encryption/decryption of data is performed.
IC cards having a capability of performing cryptographic processing are widely used. For example, such IC cards are used to pass through entrance gates of stations, to perform payment in shopping centers, etc. In many applications of IC cards, there is an increasing demand for reduction in size and increase in processing speed.
Cryptography methods are categorized into two types: common key cryptography and public key cryptography. The common key cryptography is also called symmetric key cryptography. In the common key cryptography, a sender and a receiver both have a common key. A specific example of a common key cryptography technique is that using a DES (Data Encryption Standard) algorithm. In the DES algorithm, encryption and decryption can be accomplished in substantially the same manner.
In the public key cryptography (also called asymmetric key cryptography), in contrast to the common key cryptography, different keys are used by a sender and a receiver. Compared with the common key cryptography in which a common key is used in both encryption and decryption, the public key cryptography is advantageous in that only one specific person needs to have a secret key which must be kept secret and thus it is easy to manage the secret key. However, the public key cryptography is low in processing speed compared with the common key cryptography. Because of the low processing speed, the public key cryptography is generally used in applications which deal with only small data size, such as transmission of a secret key, digital signature, etc. Specific examples of public-key cryptography is RSA (Rivest-Shamir-Adleman) cryptography and ECC (Elliptic Curve Cryptography).
In the elliptic curve cryptography, encryption is performed using an elliptic curve y2=x3+ax+b (4a3+27b2≠0) on a prime field or an elliptic curve y2+xy=x3+ax2+b (b≠0) on an extension field of 2. If a point (O) at infinity is added to a set of points on such a curve, the resultant set forms a finite group with respect to addition, and the point (O) at infinity is an element of the finite group. The operation of addition over the finite group is denoted by +. Addition of two points P and Q on the finite group, that is, P+Q, is referred to as “addition of points”, and addition of point P and point P, P+P=2P, is referred to as “doubling of a point”. An operation of repeatedly adding of point P k times such that P+P+ . . . +P=kP is referred to as “scalar multiplication of a point”.
It is known that scalar multiplication of a point can be accomplished by addition of points and doubling of a point. Details of addition, doubling, and scalar multiplication of points on an elliptic curve over a prime field or points on an elliptic curve over an extension field of degree 2 in an affine coordinate system (x, y) or a projective coordinate system (X, Y, Z) are described in IEEE P1363/D13 Standard Specifications for Public Key Cryptography.
Koblitz and Cantor have proposed hyperelliptic curve cryptography (HECC) which is generalization of the elliptic curve cryptography. Descriptions of the hyperelliptic curve cryptography can be found, for example, in Non-Patent Document 1 and Non-Patent Document 2.
In the elliptic curve cryptography, when a point P on an elliptic curve defined over a finite field Fq is given, if a point Q=kP (kεZ), that is, a point obtained by multiplying point P by a scalar k is further given, it is known that a problem of finding k for the given point Q reduces to a discrete logarithm problem. On the other hand, in the case of public key cryptography based on the hyperelliptic curve cryptography, when a divisor D1 which is a formal sum of points and a divisor D2 obtained by multiplying D1 by a scalar k are given, a problem of finding k from D2 reduces to a discrete logarithm problem on a Jacobian variety of a hyperelliptic curve.
A hyperelliptic curve is characterized by a genus g. When q=pn where p is a prime and n is a positive integer, a hyperelliptic curve C of genus g defined over a finite field Fq is defined by the following equation:
y2+h(x)y=f(x)
where h(x), f(x)εFq[x], and f(x) is a monic polynomial of degree 2g+1.
A point −P opposite to the point P=(x, y) on the hyperelliptic curve C is defined by (x, y+h(x)). When P=−P, this point P is called a ramification point.
It is known that in the hyperelliptic curve cryptography, a security level comparable to that obtained by the elliptic curve cryptography can be achieved by a field of definition of a hyperelliptic curve with a processing size which is 1/g times that of the elliptic curve. This small processing size provides a great merit in implementation of the hyperelliptic curve cryptography, which is one of the advantages of the hyperelliptic curve cryptography.
Fundamental matters of the hyperelliptic curve cryptography are explained. In the hyperelliptic curve cryptography, as described above, when a divisor D1 which is a formal sum of points and a divisor D2 obtained by multiplying D1 by a scalar k are given, a problem of finding k from D2 reduces to a discrete logarithm problem on a Jacobian variety of a hyperelliptic curve, and this problem can be applied to public key cryptography.
The divisors can be expressed in the following form:
[Mathematic Expression 1]
In the above expression, Pi=(xi, yi), and Pi≠Pj when i≠j. The divisor in this form is called a semi reduced divisor.
Σmi is referred to as a weight of D. When the weight of a semi reduced divisor is equal to or smaller than the genus g, the semi reduced divisor is called a reduced divisor.
An arbitrary semi reduced divisor D on a Jacobian variety of a hyperelliptic curve can be expressed in a Mumford form D=(U, V) using the following polynomials U and V (U, VεFq[x]). A further detailed description of the Mumford expression may be found, for example, in Non-Patent Document 3.
U=Π(x−xi)m
V(xi)=yi
V(x)2+V(x)h(x)−f(x)≡0 mod U(x),deg V<deg U [Mathematic Expression 2]
An arbitrary reduced divisor D of genus 2 can be expressed in the Mumford form using a set of polynomials of degree 2 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x2+u1x+u0,v1x+v0)
An arbitrary reduced divisor D of genus 3 can be expressed in the Mumford form using a set of polynomials of degree 3 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x3+u2x2+u1x+u0,v2x2+v1x+v0)
In the following description, it is assumed that the divisor D is a reduced divisor unless otherwise specified. Note that, as described above, the reduced divisor is a semi reduced divisor with a weight equal to or smaller than genus g.
Of reduced divisors, those other than a divisor with a weight equal to genus g, that is, reduced divisors having a weight smaller than genus g, are called degenerate divisors.
For example,
when genus g=2, degenerate divisors are divisors with a weight equal to 1, and
when genus g=3, degenerate divisors are divisors with a weight equal to 1 or 2.
For genus g=2 and for genus g=3, respectively, degenerate divisors can be represented using the Mumford expresses as follows:
(a) degenerate divisors of genus 2 (weight of 1): (U, V)=(x+u, v)
(b) degenerate divisors of genus 3 (weight of 1): (U, V)=(x+u0, v0)
(c) degenerate divisors of genus 3 (weight of 2): (U, V)=(x2+u1x+u0, v1x+v0)
Scalar multiplication of a divisor used in the hyperelliptic curve cryptography is explained below. Scalar multiplication of a divisor can be accomplished by a combination of addition of divisors and doubling of the divisor. This algorithm is called an addition algorithm. Some examples of addition algorithms are explained below.
A first proposed practical algorithm is known as a Cantor algorithm. A detailed description of the Cantor algorithm may be found, for example, in Non-Patent Documents 1 and 2. This Cantor algorithm is applicable to a divisor on a hyperelliptic curve of any genus. However, the Cantor algorithm has a disadvantage that, compared with an elliptic curve, the Cantor algorithm is complicated and needs a great amount of calculation.
Harley has proposed an algorithm in which hyperelliptic curves are limited to those of genus 2, and calculation is performed differently in an optimized manner depending on the weight of divisors thereby minimizing the amount of calculation. The proposal of this algorithm by Harley has stimulated further research on the calculation algorithm of the hyperelliptic curve cryptography (HECC) to achieve further improvement or extension.
In the Harley algorithm, a prime field is given as the field of definition, the curve is of genus=2, and divisors are expressed in the Mumford form. Examples of improvements in terms of the amount of calculation of the algorithm may be found, for example, in Non-Patent Document 4, Non-Patent Document 5, and Non-Patent Document 6. Examples of an algorithm extended to the case where an extension field of degree of 2 is given as the field of definition may be found, for example, in Non-Patent Document 7 and Non-Patent Document 8. Examples of extension of the Harley algorithm to genus 3 may be found, for example, in Non-Patent Document 9 and Non-Patent Document 10. Examples of reducing the amount of calculation by expressing divisors in the extended Mumford expression or using the weighted coordinates may be found, for example, in Non-Patent Document 11, Non-Patent Document 12, Non-Patent Document 6, and Non-Patent Document 13.
The Harley algorithm is explained below with reference to
(1) weight=2 for D1, weight=2 for D2
(2) weight=2 for D1, weight=1 for D2
(3) exception handling 1
In the case where divisors with weight=2 are added together, that is, in the case of (1) weight=2 for D1 and weight=2 for D2, if the greatest common divisor gcd(U1, U2)=1 for the divisors D1=(U1, V1) and D2=(U2, V2), the two divisors D1=(U1, V1) and D2=(U2, V2) include neither a common point nor opposite points. In this case, addition is performed according to the Harley algorithm. This addition process is denoted as follows:
(1a) HarleyADD
In the technique disclosed in Non-Patent Document 7, this process (1a) HarleyADD is called a Most-Frequent-Case process, because this process is performed most frequently in the addition of D1+D2 for the case of genus of 2.
A specific process of HarleyADD performed as the Most-Frequent-Case process for genus 2 is shown below in [Table 1].
[Mathematic Expression 3]
u11 + u21, w0
u21w1 + u10 + u20, r
(u10 + u20)w0 + u20w12,
w1, i0
w0;
(v11 + v21)w1, t0
(v10 + v20)w0,
(v11 + v21 + v10 + v20)(w0 + w1) + t2 + t0,
t1 + t2u21, t0
t0 + t2u20;
(rt1)−1, w3
w2r, w4
w2t1, w5
w3r, s1
w4t1, s0
w4t0;
w1 + w5(1 + w5), u30
u21w1 + u10 + u20 + w5(s0 + s02 + w1);
u11 + u31, w0
u10 + u30, w2
s1w1, w3
s0w0,
(s1 + s0)(w1 + w0) + w2 + w3, w2
w2 + 1, w1
w4 + w2u31,
w3 + w2u30, v31
w1 + v11 + h1, v30
w0 + v10 + h0;
The probability of occurrence of the process of (1a) HarleyADD is very high, while the probability of occurrence of exception handling is very low. In the case where the condition of the Most Frequent Case is not satisfied that is, in the case where the greatest common divisor gcd(U1, U2)≠1 for the divisors D1=(U1, V1) and D2=(U2, V2), exception handling is performed. The exception handling process performed in this case is denoted as follows:
(1b) Exception Handling 2
In the case of (2) weight=2 for D1 and weight=1 for D2, determination is made as to whether gcd(U1, U2)=1. If it is determined that gcd(U1, U2)=1, then the following process is performed.
(2a) ExHarADD2+1→2
However, if it is determined that gcd(U1, U2)≠1, then the following exception handling is performed.
(2b) Exception Handling 3
The algorithm of (2a) ExHarADD2+1→2 is described in Non-Patent Document 8. A specific process of ExHarADD2+1→2 is shown below in [Table 3].
[Mathematic Expression 4]
u20 + (u21 + u10)u10.
1/r.
inv(v10 + v20 + v21v10).
s0u21: l0
s0u20.
f4 + u21, k1
f3 + (f4 + u21)u21 + v21 + u20.
k2 + s02 + s0 + u10,
k1 + s0(l1 + h1) + u10u31.
u31(h2 + s0) + (h1 + l1 + v21),
u30(h2 + s0) + (h0 + l0 + v20).
(3) If it is determined that the weights satisfy neither (1) nor (2), then the exception process (3) is performed.
(4) weight=2
(5) weight=1
(6) weight=0
(4) When weight=2, it is checked whether the divisor includes a ramification point. If it is determined that the divisor includes no ramification point, then (4a) HarleyDBL is performed. On the other hand, if the divisor includes a ramification point, then (4b) exception process 6 is performed.
In Non-Patent Document 7, it is described that the process (4a) HarleyDBL occurs most frequently. A specific process of HarleyDBL is shown below in [Table 2].
[Mathematic Expression 5]
h1 + u11, w0
h0 + u10 + u11w11, r
u10(u10 + h0 + h1w1) + h0w0;
w1, i0
w0;
f3 + v11 + u112, w3
v10 + v11(v11 + h1),
w0w2 + w1w3, t0
(u11w0 + u10w1)w2 + w0w3;
(rt1)−1, w2
w0r, w3
w0t1, w4
w2r, s1
w3t1, s0
w3t0;
w4(1 + w4), u30
w4(w4(s0(1 + s0)) + w1);
u11 + u31, w0
u10 + u30, w2
s1w1, w3
s0w0,
(s1 + s0)(w1 + w0) + w2 + w3, w2
w2 + 1, w1
w4 + w2u31,
w3 + w2u30, v31
w1 + v11 + h1, v30
w0 + v10 + h0;
The addition operation and the doubling operation for genus=3 are described below with reference to
In the addition operation shown in
(1) weight=3 for D1, weight=3 for D2
(2) weight=3 for D1, weight=2 for D2
(3) weight=3 for D1, weight=1 for D2
(4) Exception Process 7
In the case of (1) weight=3 for D1 and weight=3 for D2, if the greatest common divisor gcd(U1, U2)=1 for the divisors D1=(U1, V1) and D2=(U2, V2), then the following operation is performed.
(1a) HarleyADD
This operation occurs most frequently in the addition operation for genus=3.
A further detailed description of the operation of HarleyADD, which is a most-frequent-case operation in the addition operation for genus=3, can be found, for example, in Non-Patent Document 9 and Non-Patent Document 10. An algorithm of HarleyADD, which is a most-frequent-case operation in the addition operation for genus=3, is shown below in [Table 4].
[Mathematic Expression 6]
In the case of (2) weight=3 for D1 and weight=2 for D2, if the greatest common divisor gcd(U1, U2)=1 for the divisors D1=(U1, V1) and D2=(U2, V2), then the following operation is performed.
(2a) ExHarADD3+2→3
if the greatest common divisor gcd(U1, U2)≠1, then the following exception handling is performed.
(2b) Exception Handling 9
In the case of (3) weight=3 for D1 and weight=1 for D2, if the greatest common divisor gcd(U1, U2)=1 for the divisors D1=(U1, V1) and D2=(U2, V2), then the following operation is performed.
(3a) ExHarADD3+1→3
If the greatest common divisor gcd(U1, U2)≠1, then the following exception handling is performed.
(3b) Exception Handling 10
Although algorithms for the respective operations are not explicitly described in published documents, papers, or the like, formulae can be written as described below for the case where field of definition is F2n. That is, algorithms for ExHarADD3+1→3 and ExHarADD3+2→3 are shown below in [Table 6] and [Table 7]
[Mathematic Expression 7]
u202, w1
w0(u + 12 + u20), w2
u20u11, r
w1 + w2 + u10.
1/r.
w0v12, s0
inv(v10 + v20 + v20v11 + z0).
s02 + s0 + u20 + u12 + f0
f6 + s02 + u12, t1
u12t0, t2
u20u32, t3
h2s0,
t1 + t2 + t3 + u11 + v12 + f5,
u20(t6 + v12 + f5 + t3 + u11), t5
v12(v12 + u12 + h2),
u12(u12(f6 + u12) + f5),
w0u32 + t4 + t5 + u12t0 + s0h1 + t0 + u10 + f4 + v11,
v12 + h2 + s0(u12 + u32) + u32:
v11 + h2 + s0(u11 + u31) + u31:
v10 + h2 + s0(u10 + u30) + u30:
[Mathematic Expression 8]
u202, w1
u112, w2
u212, w3
u12 + u21.
w0(u20 + u12w3), w5
u21(u10 + u11w3), w5
u20(w5 + w1),
w3w2 + u21u11, w6
u10(u10 + w6), r
w4 + w5 + w6
u21u12, i3
u21u11, i4
u20u12,
i2 + w2 + u20 + u11: i0
w2w3 + i3 + i4 + u10
v11 + v21 + v12u21, c0
v20 + v10 + v12u20,
i1c1, t3
i0c0, t1 = t2u21 + (i1 + i0)(c1 + c0) + t2 + t3,
t3 + t2u20.
rt1, z2
1/z1, z3
z2r, z4
z2t1, z5
z3r, s1
z4t1, s0
z4t0.
s0u12, t1
s0u10, t2
s1u11,
(s1 + s0)(1 + u12) + s1 + t0, k2
t0 + t2 + v12,
(s1 + s0)(u11 + u10) + t2 + t1 + v11, k0
t1 + v10.
z5(z5 + 1) + u12 + u21, t0
k32, t1
u122,
z5(z5(f6 + u12 + u21 + t0 + k3) + u21 + h2 + u12),
i2 + u11 + u20 + t1 + w2 + t2,
(t1 + w2)(u2l + u12) + i3 + i4 + u10,
i2 + u20 + w2 + u11 + t1 + f5 + (u21 + u12)(t0 + f6 + k3) + k2,
z5(t4 + k3h2) + h2(u12 + u21) + t1 + w2 + i2 + u20 + u11 + h1, t4
z5t4,
t3 + t4.
s0(u32 + u12), t1
s1(u31 + u11), t2
s1(u12 + u32).
t0 + t1 + t2u32 + u32 = v12 + h2,
s0(u30 + u10), t5
(s1 + s0)(u31 + u11 + u30 + u10),
t5 + t1 + t4 + t2u31 + u31 + v11 + h1,
t4 + t2u30 + u30 + v10 + h0,
t0/r.
s02, u31
u21 + u12 + w1 + s0,
(w1 + u12)(u21 + u12) + (h2 + u21)s0 + w0 + u20 + u11 + v12 + f5.
(u30 + u31(u31 + u12) + u11)s0 + u31(u31 + h2 + v12) + u30 + h1 + v11,
(u10 + u30(u31 + u12))s0 + u30(u31 + h2 + v12)+ v10 + h0.
(4) weight=3
(5) weight=2
(6) weight=1
(7) weight=0
(4) When weight=3, it is checked whether the divisor includes a ramification point. If it is determined that the divisor includes no ramification point, then (4a) HarleyDBL is performed. On the other hand, if the divisor includes a ramification point, then (4b) exception process 11 is performed.
In Non-Patent Document 9 or 10, it is described that the process (4a) HarleyDBL occurs most frequently. A specific process of HarleyDBL is shown below in [Table 5].
[Mathematic Expression 9]
The operations of HarleyADD and HarleyDBL for both genus=2 and genus=3 are called most-frequent-case operations, because the probability of occurrence of these operations is very high when addition or doubling is performed for randomly generated divisors. A further detailed description of the fact that the operations of HarleyADD and HarleyDBL occur most frequently may be found, for example, in Non-Patent Document 14.
According to Non-Patent Document 14, the probability of occurrence of operations other than the most-frequent-case operations is O(1/q) where q is the number of elements of the field of definition. In practical use of cryptography that provides a reasonably high security level, qg is as large as a value representable by about 160 bits, and thus only HarleyADD or HarleyDBL occurs in practical operations.
Therefore, in many cases, when the addition algorithm of the hyperelliptic curve cryptography (HECC) is implemented using the Harley algorithm or a modification thereto in cryptographic processing means such as an IC card, only
HarleyADD and
HarleyDBL
are implemented, and the other exceptional operations which hardly occur are not performed. In this case, the exceptional operations may be performed, for example, in accordance an algorithm such as a Cantor algorithm which does not need selection of the mode depending on the weight. The processing load for the complicated exceptional operations increases with genus, as discussed in Non-Patent Document 9 or 10.
Scalar multiplication of a divisor according to the hyperelliptic curve cryptography (HECC) algorithm is explained below. In the hyperelliptic curve cryptography (HECC) algorithm, scalar multiplication of a divisor can be accomplished by a combination of hyperelliptic curve addition and hyperelliptic curve doubling. Two typical algorithms of the scalar multiplication are a binary algorithm and a double-and-add-always algorithm.
In the elliptic curve cryptography, as described above, when a point P on an elliptic curve defined over a finite field Fq is given, if a point Q=kP (kεZ), that is, a point obtained by multiplying point P by a scalar k is further given, it is known that a problem of finding k for the given point Q reduces to a discrete logarithm problem. On the other hand, in the case of public key cryptography based on the hyperelliptic curve cryptography, when a divisor D1 which is a formal sum of points and a divisor D2 obtained by multiplying D1 by a scalar k are given, a problem of finding k from D2 reduces to a discrete logarithm problem on a Jacobian variety of a hyperelliptic curve, and this problem can be applied to public key cryptography.
The scalar value d given as the multiplier to be multiplied with the divisor D in the scalar multiplication operation (D=dD) is expressed in a binary form as follows.
d=(dl-1, . . . , d0)
where dl-1=1, dl-2, . . . , 0=1 or 0.
A basic algorithm of scalar multiplication based on the binary method is described below in [Algorithm 1].
[Mathematic Expression 10]
D0
2D ||HarleyDBL doubling operation
D + D0 ||HarleyADD addition operation
Next, a calculation algorithm based on the double-and-add-always method is described.
A method to know secret information by attacking a weak point of implementation of a cryptography technique is called side channel attack (SCA). Specific examples of SCA include timing attack (TA), simple power analysis (SPA), and differential power analysis (DPA). In the SCA, an attack is made by detecting a processing time of a process having a correlation to secret information. In power attach such as the SPA or DPA, an attack is made by detecting a correlation between secret information and power consumption. A further detailed description of the timing attach (TA) may be found, for example, in Non-Patent Document 15, and that of the power attack may be found, for example, in Non-Patent Document 16.
In the simple power analysis (SPA), secret information is revealed by directly detecting a waveform of power consumption dependent on bit information of a secret key. To enhance resistance of the cryptography algorithm against attack by the SPA, it is needed that the algorithm do not produce a correlation between bit information of the secret key and the power waveform. On the other hand, to increase resistance to the timing attack (TA), it is needed that the algorithm do not produce a correlation between bit information of the secret key and the processing time.
It is known that the double-and-add-always method can provide high resistance against the timing attack (TA) or the power attack (SPA) to the elliptic curve cryptography (ECC) or the hyperelliptic curve cryptography (HECC). A further detailed description of the resistance of the double-and-add-always method against the attack can be found in the Non-Patent Document 17. In the double-and-add-always algorithm, unlike the binary algorithm described above, a dummy addition is always performed so that the processing time or the power waveform does not vary depending on the bit value of the scalar multiplier d.
A basic algorithm of scalar multiplication based on the double-and-add-always method is described below in [Algorithm 2].
[Mathematic Expression 11]
D0
2D[0] ||HarleyDBL doubling operation
D[0] + D0 ||HarleyADD addition operation
D[di]
Next, a process of producing a base point is described below. When scalar multiplication is used in cryptography, an input divisor D0 can be categorized into two types:
(1) predetermined divisors
(2) unpredictable divisors which occur randomly
When an input divisor is of the type (1), that is, a predetermined divisor, the input divisor is called a base point.
A general algorithm of producing a base point is described below.
(a)
First, g elements on the field of definition Fq are selected at random, and g points Pi (i=1, . . . , g) on a hyperelliptic curve are produced.
(a1) Let xi (i=1, . . . , g) denote the x coordinate of each if the elements randomly selected above. The y coordinate which is on the hyperelliptic curve and which corresponds to the x coordinate xi is determined for each element.
(b)
The base point is defined by a divisor D0=(U(x), V(x)) where
(b1) U(x)=(x−x1)(x−x2) . . . (x−xg)
(b2) V(x)=vg-1xg-1+vg-2xg-2+ . . . +v0
The coefficients vi of V(x)=vg-1xg-1+vg-2xg-2+ . . . +v0 are determined. For example, when there is no duplication in the produced points, vi can be determined from V(xi)=yi.
(c) The divisors produced in the above algorithm have a weight equal to g.
In the case where a predetermined divisor is employed as the divisor D0 used as the base point in the scalar multiplication operation in the cryptographic process, the divisor used as the base point with a weight equal to g can be produced via steps (a) to (c) described above.
[Non-Patent Document 1] N. Koblitz, Hyperelliptic curve cryptosystems”, J. Cryptology, vol. 1, No. 3, pp. 139-150,
[Non-Patent Document 2] D. G. Cantor, Computing in the Jacobian of hyperelliptic curve”, Math. Comp., Vol. 48, No. 177, pp. 95-101, 1987
[Non-Patent Document 3] D. Mumford, Tata lectures on theta II”, Progress in Mathematics, no. 43, Birkhauser, 1984
[Non-Patent Document 4] K. Matsuo, J. Chao, and S. Tsujii, Fast Genus two hyperelliptic curve cryptosystems”, Technical Report ISEC2001-31, IEICE Japan, 2001
[Non-Patent Document 5] Improving Harley algorithms for Jacobians of genus 2 hyperelliptic curves”, SCIS2002 (written in Japanese)
[Patent Document 6] T. Lange, Inversion-free arithmetic on genus 2 hyperelliptic curves”, Cryptology ePrint Archive, 2002/147, IACR, 2002
[Patent Document 7] T. Sugizaki, K. Matsuo, J. Chao, and S. Tsujii, An extension of Harley addition algorithm for hyperelliptic curves over finite fields of characteristic two”, ISEC2002-9, IEICE, 2001
[Patent Document 8] T. Lange, “Efficient arithmetic on genus 2 hyperelliptic curves over finite fields via explicit formulae”, Cryptology ePrint Archive, 2002/121, IACR, 2002
[Patent Document 9] J. Kuroki, M. Gonda, K. Masuo, J. Chao and S. Tsujii, Fast genus three hyperellipitc curve cryptosystems”, SCIS2002
[Patent Document 10] J. Pelzl, T. Wollinger, J. Guajardo, and C. Paar, Hyperelliptic curve Cryptosystems: Closing the Performance Gap to Elliptic Curves”, Cryptology ePrint Archive, 2003/026, IACR, 2003
[Patent Document 11] Y. Miyamoto, H. Doi, K. Matsuo, J. Chao and S. Tsujii, A fast addition algorithm of genus two hyperelliptic curves”, SCIS2002 (written in Japanese)
[Patent Document 12] N. Takahashi, H. Morimoto and A. Miyaji, Efficient exponentiation on genus two hyperelliptic curves (II)”, ISEC2002-145, IEICE, 2003 (written in Japanese)
[Patent Document 13] T. Lange, Weighed coordinate on genus 2 hyperellipitc curve”, Cryptology ePrint Archive, 2002/153, IACR, 2002
[Patent Document 14] N. Nagao, Improving group law algorithms for Jacobians of hyperelliptic curves”, ANTS-IV, LNCS 1838, pp. 439-448, Springer-Verlag, 2000
[Patent Document 15] C. Kocher, “Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems”, CRYPTO '96, LNCS 1109, pp. 104-113, 1996
[Patent Document 16] C. Kocher, J. Jaffe, and B. Jun, “Differential Power Analysis”, CRYPTO '99, LNCS 1666, pp. 388-397, Springer-Verlag, 1999
[Patent Document 17] J.-S. Coron, “Resistance against Differential Power Analysis for Elliptic Curve Cryptosystems”, CHES '99, LNCS 1717, pp. 292-302, Springer-Verlag, 1999
The elliptic curve cryptography (ECC) algorithm is in a phase in which it is practically used. In contrast, the hyperelliptic curve cryptography (HECC) algorithm, which is an extension of the elliptic curve cryptography (ECC) algorithm, is in a phase in which techniques to improve calculation speed, techniques to implement the algorithm, and other related techniques are under research and development. Although a considerable improvement in the processing speed of the scalar multiplication of the hyperelliptic curve cryptography (HECC) has been achieved, it is still lower than that of the elliptic curve cryptography (ECC), and there is a need for improvement in the processing speed.
In view of the above, it is an object of the present invention to provide a cryptographic processing method, a cryptographic processing apparatus, and a computer program, capable of performing a scalar multiplication operation associated with a process of hyperelliptic curve cryptography (HECC) at a high speed.
More specifically, it is an object of the present invention to provide a cryptographic processing method, a cryptographic processing apparatus, and a computer program, capable of performing a cryptographic process at a high speed in a highly secure manner by selecting, as a base point, a degenerate divisor with a weight smaller than the genus g of the hyperelliptic curve and performing a scalar multiplication operation using a window algorithm such that precalculated data used in the window algorithm are expressed using degenerate divisors and an addition operation in the scalar multiplication operation is accomplished in the form of an addition of a degenerate divisor and a non-degenerate divisor.
Still more specifically, it is an object of the present invention to provide a cryptographic processing method, a cryptographic processing apparatus, and a computer program, capable of performing a cryptographic process at a high speed in a highly secure manner by efficiently searching for a degenerate divisor D used as the base point on a curve of genus (g)=2 such that the base point D and 5D both have a weight=1, and performing a scalar multiplication operation using the window algorithm using precalculated degenerate divisors D and 5D, or by efficiently searching for a degenerate divisor D used as the base point on a curve of genus (g)=3 such that the base point D and 3D both have a weight=2, and performing a scalar multiplication operation using the window algorithm using precalculated degenerate divisors D and 3D.
According to a first aspect of the present invention, there is provided a cryptographic processing method of performing a cryptographic processing operation based on hyperelliptic curve cryptography, comprising the steps of:
producing a base point such that the base point given as input divisor in a scalar multiplication operation based on the hyperelliptic curve cryptography and one or more of precalculated data, in addition to the base point, used in the scalar multiplication operation based on a window algorithm are degenerate divisors with a weight g0 smaller than genus g of a hyperelliptic curve (where 1≦g0<g);
producing precalculated degenerate divisor data used in the window algorithm from the base point produced in the base point producing step, such that the precalculated data includes only degenerate divisors; and
performing the scalar multiplication operation based on the window algorithm using the precalculated degenerate divisor data produced in the precalculated degenerate divisor data producing step such that the scalar multiplication operation is accomplished by performing an addition operation of adding degenerate divisors including a precalculated degenerate divisor.
In an embodiment of the cryptographic processing method according to the present invention, the operation performing step includes the steps of converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm thereby producing wNAF data; and relating the precalculated degenerate divisor data to the wNAF data produced in the conversion step.
In an embodiment of the cryptographic processing method according to the present invention, the operation performing step includes the steps of converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm thereby producing wNAF data; if precalculated data to be produced from the wNAF data produced in the conversion step includes data other than the precalculated degenerate divisor data, further converting the wNAF data into modified wNAF data expressed only by the precalculated degenerate divisor data; and relating the precalculated degenerate divisor data to the modified wNAF data produced in the further-conversion step.
In an embodiment of the cryptographic processing method according to the present invention, the base point producing step is the step of producing the base point D such that the base point D and one or more of precalculated data nD (where n is an integer other than 1) in addition to the base point used in the algorithm of executing the scalar multiplication operation based on the window algorithm are degenerate divisors with a weight g0 smaller than genus g of the hyperelliptic curve (where 1≦g0<g).
In an embodiment of the cryptographic processing method according to the present invention, the cryptographic processing method is a method of performing a scalar multiplication operation on a hyperelliptic curve with genus g=2; and wherein the base point producing step is the step of producing the base point such that the base point D and 5D are degenerate divisors with a weight=1, the operation performing step includes the steps of converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm using a window size=3 thereby producing wNAF data; if precalculated data to be produced from the wNAF data produced in the conversion step includes data other than the degenerate divisor D or 5D, further converting the wNAF data into modified wNAF data expressed only by the degenerate divisors D and 5D; and performing the addition operation included in the scalar multiplication operation such that the degenerate divisors D and 5D are related to the modified wNAF data produced in the further-conversion step, and the addition operation is performed by adding degenerate divisors including the degenerate divisor D and/or 5D.
In an embodiment of the cryptographic processing method according to the present invention, the cryptographic processing method is a method of performing a scalar multiplication operation on a hyperelliptic curve with genus g=3; and wherein the base point producing step is the step of producing the base point such that the base point D and 3D are degenerate divisors with a weight=2, the operation performing step includes the steps of converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm using a window size=2 thereby producing wNAF data; performing the addition operation included in the scalar multiplication operation such that the degenerate divisors D and 3D are related to the wNAF data produced in the conversion step, and the addition operation is performed by adding degenerate divisors including the degenerate divisor D and/or 3D.
According to a second aspect of the present invention, there is provided an cryptographic processing apparatus configured to perform a cryptographic processing operation based on hyperelliptic curve cryptography, comprising:
a base point producing means for producing a base point such that the base point given as input divisor in a scalar multiplication operation based on the hyperelliptic curve cryptography and one or more of precalculated data, in addition to the base point, used in the scalar multiplication operation based on a window algorithm are degenerate divisors with a weight g0 smaller than genus g of a hyperelliptic curve (where 1≦g0<g);
precalculated degenerate divisor data producing means for producing precalculated degenerate divisor data used in the window algorithm from the base point produced by the base point producing means, such that the precalculated data includes only degenerate divisors; and
operation means for performing the scalar multiplication operation based on the window algorithm using the precalculated degenerate divisor data produced by the precalculated degenerate divisor data producing means such that the scalar multiplication operation is accomplished by performing an addition operation of adding degenerate divisors including a precalculated degenerate divisor.
In an embodiment of the cryptographic processing apparatus according to the present invention, the cryptographic processing apparatus further comprises conversion means for converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm, thereby producing wNAF data, wherein the operation means performs an operation of relating the precalculated degenerate divisor data to the wNAF data produced by the conversion means.
In an embodiment of the cryptographic processing apparatus according to the present invention, the cryptographic processing apparatus further comprises conversion means for converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm, thereby producing wNAF data; and further-conversion means for, if precalculated data to be produced from the wNAF data produced by the conversion means includes data other than the precalculated degenerate divisor data, further converting the wNAF data into modified wNAF data expressed only by the precalculated degenerate divisor data, wherein the operation means performs an operation of relating the precalculated degenerate divisor data to the modified wNAF data produced by the further-conversion means.
In an embodiment of the cryptographic processing apparatus according to the present invention, the base point producing means is configured to produce the base point D such that the base point D and one or more of precalculated data nD (where n is an integer other than 1) in addition to the base point used in the algorithm of executing the scalar multiplication operation based on the window algorithm are degenerate divisors with a weight g0 smaller than genus g of the hyperelliptic curve (where 1≦g0<g).
In an embodiment of the cryptographic processing apparatus according to the present invention, the cryptographic processing apparatus is configured to perform a scalar multiplication operation on a hyperelliptic curve with genus g=2; and wherein the base point producing means is configured to produce the base point such that the base point D and 5D are degenerate divisors with a weight=1, and the base point producing means includes conversion means for converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm using a window size=3 thereby producing wNAF data; further-conversion means for, if precalculated data to be produced from the wNAF data produced by the conversion means includes data other than the degenerate divisor D or 5D, further converting the wNAF data into modified wNAF data expressed only by the degenerate divisors D and 5D; and operation means for performing the addition operation included in the scalar multiplication operation such that the degenerate divisors D and 5D are related to the modified wNAF data produced by the further-conversion means, and the addition operation is performed by adding degenerate divisors including the degenerate divisor D and/or 5D.
In an embodiment of the cryptographic processing apparatus according to the present invention, the cryptographic processing apparatus is configured to perform a scalar multiplication operation on a hyperelliptic curve with genus g=3; and wherein the base point producing means is configured to produce the base point such that the base point D and 3D are degenerate divisors with a weight=2, and the base point producing means includes conversion means for converting a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm using a window size=2 thereby producing wNAF data; and operation means for performing the addition operation included in the scalar multiplication operation such that the degenerate divisors D and 3D are related to the wNAF data produced by the conversion means, and the addition operation is performed by adding degenerate divisors including the degenerate divisor D and/or 3D.
According to a third aspect of the present invention, there is provided a computer program configured to be executed on a computer to perform cryptographic processing operation based on hyperelliptic curve cryptography, comprising the steps of
producing a base point such that the base point given as input divisor in a scalar multiplication operation based on the hyperelliptic curve cryptography and one or more of precalculated data, in addition to the base point, used in the scalar multiplication operation based on a window algorithm are degenerate divisors with a weight g0 smaller than genus g of a hyperelliptic curve (where 1≦g0<g);
producing precalculated degenerate divisor data used in the window algorithm from the base point produced in the base point producing step, such that the precalculated data includes only degenerate divisors; and
performing the scalar multiplication operation based on the window algorithm using the precalculated degenerate divisor data produced in the precalculated degenerate divisor data producing step such that the scalar multiplication operation is accomplished by performing an addition operation of adding degenerate divisors including a precalculated degenerate divisor.
The computer program may be provided to a computer system capable of executing various computer program codes via a storage medium such as a CD, an FD, or an MO on which the program is stored in a computer-readable manner or via a communication medium such as a network. By providing the program in the computer-readable form as described above, it becomes possible to execute processes on the computer system in accordance with the program.
Further objects, features, and advantages of the present invention will become apparent from the following description of exemplary embodiments with reference to the accompanying drawings. In the present description, the term “system” is used to describe a logical collection of a plurality of apparatuses, and it is not necessarily required that the plurality of apparatuses be disposed in a single case.
Advantages
In an aspect of the present invention, as described above, a base point D is produced such that the base point D and one or more of precalculated data in addition to the base point used in the algorithm of executing the scalar multiplication operation based on the window algorithm are degenerate divisors with a weight g0 smaller than genus g of the hyperelliptic curve (where 1≦g0<g), and the addition operation included in the scalar multiplication operation based on the window algorithm is accomplished by performing an addition operation of adding degenerate divisors including a precalculated degenerate divisor. Thus, a high-speed operation is achieved. Besides, because the addition operations do not include an addition operation of divisors including no degenerate divisor, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
In an aspect of the present invention, a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD is converted into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm, thereby producing wNAF data. If precalculated data to be produced from the wNAF data produced above includes data other than the degenerate divisors, then the wNAF data is further converted so as to obtain modified wNAF data expressed only by the degenerate divisors. The degenerate divisor data are related to the modified wNAF data, and the addition operation in the scalar multiplication is performed in the form of addition between a non-degenerate divisor and a degenerate divisor. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
A cryptographic processing apparatus, a cryptographic processing method, and a computer program according to the present invention are described below in a further detail below with respect to items listed below.
1. Basic methods of increasing the processing speed of the hyperelliptic curve cryptography algorithm according to the present invention
2. Algorithm of a process of setting a degenerate divisor as a base point and performing a process based on a window algorithm, according to an embodiment of the present invention
3. Functional configuration of cryptographic processing apparatus
4. Examples of applications of the present invention to production and verification of digital signature
5. Example of a hardware configuration of cryptographic processing apparatus
1. Basic Methods of Increasing the Processing Speed of the Hyperelliptic Curve Cryptography Algorithm According to the Present Invention
First, basic methods of increasing the processing speed of the hyperelliptic curve cryptography algorithm according to the present invention are described, in particular, on the following two algorithms.
(1A) Algorithm in which a degenerate divisor is employed as a base point
(1B) Algorithm based on the window algorithm
(1A) Algorithm in which a Degenerate Divisor is Employed as a Base Point
First, an algorithm of a process of setting a degenerate divisor as a base point is discussed. This technique is disclosed in Japanese Patent Application No. 2004-71757 filed previously by the present applicant.
The purpose of this technique is to increase the processing speed of the hyperelliptic curve cryptography (HECC) which is extension of the elliptic curve cryptography. As described above, a hyperelliptic curve is characterized by genus g. When q=pn where p is a prime and n is a positive integer, a hyperelliptic curve C of genus g defined over a finite field Fq is defined by the following equation:
y2+h(x)y=f(x)
where h(x), f(x)εFq[x], and f(x) is a monic polynomial of degree 2g+1.
A point −P opposite to the point P=(x, y) on the hyperelliptic curve C is defined by (x, y+h(x)). When P=−P, this point P is called a ramification point.
It is known that in the hyperelliptic curve cryptography, a security level comparable to that obtained by the elliptic curve cryptography can be achieved by a field of definition of a hyperelliptic curve with a processing size which is 1/g times that of the elliptic curve. This small processing size provides a great merit in implementation of the hyperelliptic curve cryptography, which is one of the advantages of the hyperelliptic curve cryptography.
In the hyperelliptic curve cryptography, as described above, when a divisor D1 which is a formal sum of points and a divisor D2 obtained by multiplying D1 by a scalar k are given, a problem of finding k from D2 reduces to a discrete logarithm problem on a Jacobian variety of a hyperelliptic curve.
As described above, the divisors can be expressed in the following form:
[Mathematic Expression 12]
In the above expression, Pi=(xi·yi), and Pi≠Pj when i≠j. The divisor in this form is called a semi reduced divisor. Σmi is referred to as a weight of D. When the weight of a semi reduced divisor is equal to or smaller than the genus g, the semi reduced divisor is called a reduced divisor.
An arbitrary semi reduced divisor D on a Jacobian variety of a hyperelliptic curve can be expressed in a Mumford form D=(U, V) using the following polynomials U and V (U, VεFq[x]).
U=Π(x−xi)m
V(xi)=yi
V(x)2+V(x)h(x)−f(x)≡0 mod U(x),deg V<deg U [Mathematic Expression 13]
An arbitrary reduced divisor D of genus 2 can be expressed in the Mumford form using a set of polynomials of degree 2 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x2+u1x+u0,v1x+v0)
An arbitrary reduced divisor D of genus 3 can be expressed in the Mumford form using a set of polynomials of degree 3 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x3+u2x2+u1x+u0,v2x2+v1x+v0)
Divisors may be expressed in other forms such as a modified Mumford expression or a weighted coordinate expression. The modified Mumford expression corresponds to projective coordinates in the ECC (elliptic curve cryptography) and expresses a divisor by (U, V, Z) obtained by multiplying the Mumford expression (U, V) by a constant Z.
In the weighted coordinate expression, a divisor is expressed by (U, V, Z1, Z2) obtained by multiplying the Mumford expression (U, V) by a plurality of constants Z1 and Z2. Both the modified Mumford expression and the weighted coordinate expression can reduce the amount of computation of a Harley algorithm described below.
As described above, when scalar multiplication is used in cryptography, an input divisor D0 can be categorized into two types:
(1) predetermined divisors
(2) unpredictable divisors which occur randomly
When an input divisor is of the type (1), that is, a predetermined divisor, this input divisor is used as a base point.
Note that in the present description, as described above, divisors D are reduced divisors which are semi reduced divisors with a weight equal to or smaller than genus g. Divisors other than those with a weight equal to genus g, that is, reduced divisors having a weight smaller than genus g, are called degenerate divisors.
For example,
when genus g=2, degenerate divisors are divisors with a weight equal to 1, and
when genus g=3, degenerate divisors are divisors with a weight equal to 1 or 2.
Degenerate divisors can be expressed using the Mumford form depending on whether genus g=2 or 3, as shown below.
(a) degenerate divisors of genus 2: (U, V)=(x+u, v)
(b) degenerate divisors of genus 3 (with weight=1): (U, V)=(x+u0, v0)
(c) degenerate divisors of genus 3 (with weight=2): (U, V)=(x2+u1x+u0, v1x+v0)
As described above, a base point is generally produced according to the following algorithm.
(a) First, g elements on the field of definition Fq are selected at random, and g points Pi (i=1, . . . , g) on a hyperelliptic curve are produced.
(b) Let a divisor at a base point be denoted as D0=(U(x), V(x)).
(c) The divisor generated via the above-described algorithm has a weight=g.
As described above, when a divisor is generated by the conventional algorithm and apparatus designed to produce a base point on a hyperelliptic curve of genus g, the resultant divisor is generally a divisor with a weight=g.
Japanese Patent Application No. 2004-71757 filed previously by the present applicant discloses an algorithm in which a degenerate divisor is employed as a base point. More specifically, a degenerate divisor, that is, a divisor with a weight=g0 smaller than genus g of a hyperelliptic curve is produced, and this degenerate divisor is employed as the base point.
A total sequence of scalar multiplication according to this algorithm is described below with reference to
a divisor with a weight=1 is generated when genus g=2, and
a divisor with a weight=1 or 2 is generated when genus g=3.
Next, in step S102, a scalar value d used as a multiplier in the scalar multiplication operation (D=dD0) is converted into a binary expression. In step S103, the scalar value d in the binary form and the degenerate divisor (D0) produced in step S101 are subjected to the scalar multiplication operation (D=dD0). The scalar multiplication operation (D=dD0) is accomplished, for example, using the binary method or the double-and-always method.
The details of the process of step S101, that is, the process of producing a degenerate divisor (D0) with a weight=g0 smaller than genus g of a hyperelliptic curve are described below.
In the present example, it is assumed that a base point on the hyperelliptic curve of genus g is given by a degenerate divisor with a weight=g0 satisfying the following condition:
g0<g
By setting the base point at the degenerate divisor satisfying the above condition, an increase in the processing speed of the scalar multiplication in the hyperelliptic curve cryptography is achieved.
In many cases, divisors used in hyperelliptic curve cryptography using a hyperelliptic curve of genus g have a weight equal to genus g, that is, most divisors are not degenerate divisors. When a divisor is generated randomly, the probability for the produced divisor being a degenerate divisor is O(1/q) where q is the number of elements of the finite field. For example, when genus=2, q for use in cryptography is set to be as large as about 280. Therefore, when a divisor is selected randomly, the probability for the selected divisor being a degenerate divisor is very low. In the case of the scalar multiplication for a fixed base point, it is possible to intentionally produce a degenerate divisor. A method of producing a degenerate divisor is described below with reference to
In the case of a conventional algorithm of setting a base point at a divisor with a weight=g on a hyperelliptic curve of genus g, the algorithm includes a process of selecting g points on the hyperelliptic curve. In contrast, in the present algorithm of producing the base point, g0 points on the hyperelliptic curve are selected such that 1≦g0<g. The details of the present algorithm of producing the base point are described below.
(Step S121)
g0 elements on the finite field Fq given as the field of definition are randomly selected, and g0 points Pi (i=1, . . . , g0) are produced on the hyperelliptic curve.
(1) Let xi (i=1, . . . , g0) denote the x coordinate of each of the elements randomly selected above. The y coordinate which is on the hyperelliptic curve and which corresponds to the x coordinate xi is determined for each element.
(Step S122)
A divisor D0=(U(x), V(x)) is employed as a base point, where
U(x)=(x−x1)(x−x2) . . . (x−xg0) (1)
V(x)=vg0-1xg0-1+vg0-2xg0-2+ . . . +v0 (2)
and coefficients vi of V(x)=vg0-1xg0-1+vg0-2xg0-2+ . . . +v0 are determined. For example, when there is no duplication in the produced points, vi can be determined from V(xi)=yi (i=1 . . . g0).
Thus, in the step described above, the divisor with a weight=g0 smaller than genus g of the hyperelliptic curve is selected as the base point.
For example, in the case of a hyperelliptic curve of genus g=3, a divisor with a weight=3 is generally selected as a base point in the conventional technique. In contrast, in the algorithm of setting a base point according to the present embodiment, a divisor with a weight smaller than genus g=3 is selected as the base point. That is, a divisor with a weight=1 or 2 is selected as the base point.
On the other hand, in the case of a hyperelliptic curve of genus g=2, a divisor with a weight=2 is generally selected as a base point in the conventional technique. In contrast, in the algorithm of setting a base point according to the present embodiment, a divisor with a weight smaller than genus g=2, that is, a divisor with a weight=1 is selected as the base point.
In the case where, on a hyperelliptic curve of genus g, a divisor with a weight=g0 smaller than g is produced as a base point using the algorithm described above with reference to
More specifically, when a divisor with a weight smaller than the genus g is selected as the base point, the addition in the scalar multiplication is not accomplished by HarleyADD but the addition is performed between a divisor with a weight g and a divisor with a weight smaller than g. The calculation cost for the addition between the divisor with the weight g and the divisor with the weight smaller than g in this algorithm is lower than that by HarleyADD, because the divisor the divisor with the weight smaller than g is represented by a polynomial of a reduced degree, and thus the calculation of the scalar multiplication can be performed in a shorter time.
In the case where a degenerate divisor is selected as the base point, the scalar multiplication can be performed so as to provide resistance against simple power analysis (SPA) according to an algorithm based on the double-and-add-always method, described below in [Algorithm 3].
[Mathematic Expression 14]
D0 ||set degenerate divisor
2D[0] ||HarleyDBL doubling operation
D[0] + D0 ||addition with degenerate divisor
D[di]
In the present example, the calculation is performed according to the algorithm described above. In general, addition with a degenerate divisor needs a less amount of calculation than addition between two non-degenerate divisors, and thus it is possible to perform scalar multiplication at a higher speed compared with the case where a degenerate divisor is not intentionally produced.
(1B) Algorithm Based on Window Algorithm
An example of a technique to increase the processing speed of the hyperelliptic curve cryptography algorithm by using a window algorithm is described.
A description of a technique using the window algorithm to process hyperelliptic curve cryptography such that high resistance is provided against the simple power analysis (SPA) can be found, for example, in [K. Okeya and T. Takagi, The Width-w NAF Method Provides Small Memory and Fast Elliptic Scalar Multiplications Secure against Side Channel Attacks, CT-RSA 2003, LNCS 2612, pp 328-343, Springer-Verlag, 2003]. The hyperelliptic curve cryptography is an extension of the elliptic curve cryptography, and the speeding-up technique based on the window algorithm can be applied to the hyperelliptic curve cryptography without gaps.
Referring to
The window algorithm can be categorized into a few types. In the most fundamental type, a scalar value d used as a multiplier to be multiplied with a divisor D in a scalar multiplication operation [D=dD] is converted into a binary form. The scalar value in the binary form is then divided at proper digits between the most and least significant bits into a plurality of blocks. A table is prepared in advance which indicates the product dD of each possible combination of bits of each block of the multiplier d and each possible value of the multiplicand D. In the actual scalar multiplication operation, the multiplication is performed by referring to the table. Use of the table makes it possible to obtain the product without having to perform the multiplication operation, and thus an increase in the processing speed can be achieved.
For example, when a scalar value d=2674 . . . 223 (in decimal form) is given as a multiplier to be used in the scalar multiplication operation [D=dD], if the given scalar value d can be converted into the following binary form
d=1110101001 . . . 00101110011
then the resultant binary expression is divided by windows with 3 bits (with a window size w=3) into a plurality of blocks as shown below.
[111], [010], [100] . . .
If there is a prepared table indicating products of the divisor D and respective possible combinations of bits in one block, it is possible to obtain the result of the scalar multiplication simply by extracting precalculated data from the table. This makes it possible to obtain the result in a short time by performing a simple process. The data pre-calculated and described in the form of the table can be provided in many ways.
One technique to describe the pre-calculated data in the table is a NAF conversion method, which allows a reduction in the data size of the pre-calculated data. In this technique, a multiplier (d) is converted into a NAF (Non-Adjacent Form) which is a signed binary form in which non-zero bits (1 or −1) are not allowed to be adjacent. In this form, the number of non-zero bits is minimized.
In the NAF conversion, the multiplier d converted in the binary form is further converted into the NAF form by applying [−1] to a data part in which [1]s successively appear so as to be converted into a series of bits 0, 1, −1.
A wNAF (width-w Non-Adjacent Form) method has been proposed to further reduce the amount of data precalculated and stored in the table. The details of this technique are described in [K. Okeya and T. Takagi, The Width-w NAF Method Provides Small Memory and Fast Elliptic Scalar Multiplications Secure against Side Channel Attacks, CT-RSA 2003, LNCS 2612, pp 328-343, Springer-Verlag, 2003] cited above.
In the wNAF conversion, products of a multiplicand (D) and respective blocks each consisting of a predetermined number of digits are precalculated, and the resultant products ±D, ±3D, ±5D, . . . , ±(2w−1)D are stored in the table. The multiplier d expressed in the binary form is divided by the window (with the predetermined window size) into blocks as follows.
|00 . . . 0x|00 . . . 0x|00 . . . 0x| . . .
where x is an odd integer (±1, ±3, . . . ).
Because the multiplier d is divided into the blocks in the above described manner, it is sufficient for the table to include only the following precalculated data.
±D, ±3D, ±5D, . . . , (2w−1)D
Thus, the precalculated data is limited to those described above, that is, a reduction in the amount of precalculated data is achieved.
With reference to a flow chart shown in
Next, in step S152, the precalculated data described above is produced. In this step, the window size w is given by signed odd numbers 1, 3, . . . , 2w−1, and the products of the base point D and the respective signed odd numbers, that is,
±D, ±3D, ±5D, . . . , ±(2w−1)D
are calculated as the precalculated data and stored in the memory.
Next, in step S153, the scalar value d used as the multiplier in the scalar multiplication operation [D=dD] is converted into the wNAF form. More specifically, the scalar value d given as the multiplier is divided into blocks as follows.
|00 . . . 0x|00 . . . 0x|00 . . . 0x| . . .
where x is an odd integer (±1, ±3, . . . ).
Thus, the scalar value d is converted into blocks with the fixed window size (the fixed number of digits) each consisting of a signed odd integer.
An algorithm of converting a scalar value d into the wNAF form is shown below in [Algorithm 4].
[Mathematic Expression 15]
d mod 2w
d − u[0]
d/2w
d mod 2w,u′[i]
u[i]
sign(u[i − 1]),u[i]
u[i]+b, u[i − 1]
u[i − 1]−b2w
u[i − 1],dw[(i − 1)w+1]
0, ....,dw[(i −
0
d − u′[i],d
d/2w
u[k],dw[kw+1]
0,...,dw[kw+w−1]
0
Next, in step S154, the scalar multiplication operation [D=dD] is performed. More specifically, a given scalar value d is expressed in the wNAF form and the scalar multiplication operation is performed by referring to the precalculated product data ±D, ±3D, ±5D, . . . , ±(2w−1)D prepared in step S152.
An algorithm of the scalar multiplication [D=dD] is shown below in [Algorithm 5].
[Mathematic Expression 16]
d[n]P
2D
D + d[i]D
In the present algorithm, in the wNAF conversion performed in step S153, the scalar value d is divided into blocks each consisting of 0 and a signed odd integer 1, 3, . . . , 2w−1. Like the case where the scalar value is converted into the binary form, the amount of calculation needed for the scalar multiplication decreases with decreasing number of non-zero digits appearing in the scalar value. The present algorithm is a method that minimizes the number of non-zero digits. The pattern obtained as a result of the conversion is always in the form of DD . . . DAD . . . DA (where D is doubling of the divisor and A is addition of the divisor), and thus the present algorithm provides high resistance against simple power analysis (SPA). In the case of the scalar multiplication in step S154, the obtained pattern itself has high resistance against simple power analysis (SPA), and thus it is not needed to perform dummy operation unlike the double-and-add-always method in which d is converted into the binary form.
2. Algorithm of a Process of Setting a Degenerate Divisor as a Base Point and Performing a Process Based on a Window Algorithm, According to an Embodiment of the Present Invention
An algorithm of a process of setting a degenerate divisor as a base point and performing a process based on a window algorithm, according to an embodiment of the present invention is described below. The above-described two methods to increase the processing speed of the hyperelliptic curve cryptography algorithm, that is,
In the window algorithm described above, the processing speed is improved by using a fixed non-degenerate divisor as the base point. In this window algorithm, if it is allowed to employ a degenerate divisor as the base point as in the algorithm described in [(1A) Algorithm in which a degenerate divisor is employed as the base point], then addition can be accomplished using the technique employed in step S154 in
In order to use a degenerate divisor as the base point in the algorithm described in [(1B) Algorithm based on the window algorithm] while maintaining the security against the cryptography attack, it is required that in step S152 in
It is possible to set divisors such that precalculated data is prepared for non-degenerate divisors other than the divisor employed as the base point, and the window algorithm is applied to the scalar multiplication. However, this method is weak against various kinds of attack. That is, if the algorithm is implemented by a combination of an addition operation using a degenerate divisor as the base point and an addition operation of divisors including non-degenerate divisor, a difference in power consumption or calculation time occurs depending on whether divisors in the scalar multiplication [dD] includes the base point D or not, which can cause weakness against the simple power analysis (SPA) or the timing attack (TA).
In order to ensure high resistance against attacks, it is needed that all precalculated points should be degenerate divisors. When the base point is given by a degenerate divisor D, it is technically very difficult to find a base point by checking all precalculated points such as ±D, ±3D, ±5D, . . . , ±(2w−1)D which are degenerate divisors, because the ratio of the number of possible degenerate divisors to the total number of divisors is very small and thus the probability that a plurality of divisors are both degenerate divisors is extremely small.
For example, in the case of a curve with genus=2, the number of elements of a Jacobian variety is as large as #J˜q2 as indicated by the Hasse's theorem. However, on the curve with genus=2, the number of degenerate divisors having a weight smaller than g=2, that is, the number of degenerate divisors having a weight=1 is as small as q at most. Thus, the probability that two divisors randomly selected from the Jacobian variety are both degenerate divisors is as small as 1/q2. In cryptography, q is selected to be as large as about 280, and thus it is very difficult to find a combination of two divisors by randomly generating divisors and checking the generated divisors. This also holds true for the case of genus=3.
Therefore, in order to extend the algorithm described in the [(1B) Algorithm based on the window algorithm] such that it is allowed to employ a degenerate divisor as the base point, it is needed to establish a method of efficiently finding a base point so that the base point and any odd multiple of the base point are degenerate divisors, which are needed to be prepared as precalculated points.
For the above-described purpose, the present invention provides two algorithms A and B.
(Algorithm A) Algorithm of efficiently searching for degenerate divisors D and 5D on a curve of genus (g)=2 such that the base point D and 5D both have a weight=1, converting the wNAF data into the form expressed using only the detected degenerate divisors D and 5D, and performing the scalar multiplication using the resultant converted wNAF data
(Algorithm B) Algorithm of efficiently searching for degenerate divisors D and 3D on a curve of genus (g)=3 such that the base point D and 3D both have a weight=2, converting the wNAF data into the form expressed using only the detected degenerate divisors D and 3D, and performing the scalar multiplication using the resultant converted wNAF data
The details of the two algorithms (Algorithm A) and (Algorithm B) are described below.
(Algorithm A) Algorithm of efficiently searching for degenerate divisors D and 5D on a curve of genus (g)=2 such that the base point D and 5D both have a weight=1, converting the wNAF data into the form expressed using only the detected degenerate divisors D and 5D, and performing the scalar multiplication using the resultant converted wNAF data
In this algorithm, the window algorithm is applied to a hyperelliptic curve of genus (g) of 2. A degenerate divisor D is set as the base point, and precalculated data are prepared such that all data can be calculated based on degenerate divisors using the window algorithm. In any case, the addition operation in the scalar multiplication is performed in the form of addition of a non-degenerate divisor and a degenerate divisor.
In the present algorithm, on the hyperelliptic curve of genus (g) of 2, divisors are detected in an efficient manner such that the base point [D] and [5D] are both degenerate divisors with a weight=1, the wNAF conversion is performed for the detected degenerate divisors D and 5D, and the scalar multiplication is performed using the wNAF data including only degenerate divisors.
As described above, on the curve with genus=2, the number of degenerate divisors having a weight smaller than g=2, that is, the number of degenerate divisors having a weight=1 is as small as q at most. Thus, the probability that two divisors randomly selected from the Jacobian variety are both degenerate divisors is as small as 1/q2. Because of this low probability, it is substantially impossible to find a combination of two divisors by randomly generating divisors and checking whether both the base point D and 5D are degenerate divisors.
The present algorithm allows it to efficiently find a base point D which is degenerate at both D and 5D. In the scalar multiplication operation, only D and 5D are prepared as precalculated divisors, and all precalculated divisors necessary in the window algorithm are calculated using D and 5D. The present algorithm includes the following three processes.
(Process A1) Process of efficiently finding D which is degenerate and has a weight=1 at both the base point D and 5D
(Process A2) Process of performing the wNAF conversion using the degenerate divisors D and 5D to obtain wNAF data including only degenerate divisors
(Process A3) Process of performing scalar multiplication using the precalculated data expressed only by the degenerate divisors D and 5D
The details of the respective processes (Process A1) to (Process A3) are described below.
(Process A1) Process of Efficiently Finding D which is Degenerate and has a Weight=1 at Both the Base Point D and 5D
Searching for a divisor D used as the base point such that the base point D and a multiple thereof 5D are both degenerate divisors with a weight (w)=1 is accomplished by applying a method of determining a condition that w(D)=w(5D)=1 by calculating 5D from the base point D using the Harley formula, where w(D)=w(5D)=1 denotes that weight (w)=1 for both divisors D and 5D.
In the Harley algorithm, as described above, a prime field is given as the field of definition, the curve is of genus=2, and divisors are expressed in the Mumford form. Any reduced divisor D of genus 2 can be expressed in the Mumford form using a set of polynomials of degree 2 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x2+u1x+u0,v1x+v0)
In order to determine a condition for D to have w(D)=w(5D)=1, let us calculate 5D from D by an addition chain based on the Harley formula. Let divisors D, 2D, and 4D be expressed in the Mumford form as follows.
D=(x+u,v)
2D=(x2+u1x+u0,v1x+v0)
4D=(x2+w1x+w0,z1x+z0)
The calculations D→2D, 2D→4D, and 4D→5D can be performed using the following Harley formulae:
D→2D: ExHarDBL1→2 (Table 8)
2D→4D: HarleyDBL (Table 2)
4D→5D: ExHarADD2+1→1
Of the Harley formulae described above, 4D→5D: ExHarADD2+1→1 is performed by addition of divisors D and 4D, which corresponds to the addition of weight 1+weight 2 in the Harley algorithm for genus g=2 described above with reference to
Algorithms of the other Harley formulae
D→2D: ExHarDBL1→2 and
2D→4D: HarleyDBL
are respectively shown below in [Table 8] and [Table 2].
[Mathematic Expression 17]
u102, u31
0
u302, w1
f3u30, w2
h1v10, w0
w0 + w1 + f1 + w2.
h1u10, w1
u30 + w3 + h0, v31
w0/w1;
u10v21,v30
w0 + v10;
[Mathematic Expression 18]
h1 + u11, w0
h0 + u10 + u11w11, r
u10(u10 + h0 + h1w1) + h0w0;
w1, i0
w0;
f3 + v11 + u112, w3
v10 + v11(v11 + h1),
w0w2 + w1w3, t0
(u11w0 + u10w1)w2 + w0w3;
(rt1)−1, w2
w0r, w3
w0t1, w4
w2r, s1
w3t1, s0
w3t0;
w4(1 + w4), u30
w4(w4(s0(1 + s0)) + w1);
u31 + u31, w0
u10 + u30, w2
s1w1, w3
s0w0,
(s1 + s0)(w1 + w0) + w2 + w3, w2
w2 + 1, w1
w4 + w2u31,
w3 + w2u30, v31
w1 + v11 + h1, v30
w0 + v10 + h0;
5D, which is a scalar multiplication of the base point D, can be obtained via a sequence of above-described additions D→2D→4D→5D. By using the relational expressions obtained in the above calculation process, a base point D is detected so that divisors D and 5D are both of the degenerate type, that is, both D and 5D have a weight=1. The details of the process of searching for the base point D are described below with reference to
(Step 1)
Parameters u1, u0, v1, and v0 in the Mumford expression of the divisor 2D shown below
2D=(x2+u1x+u0,v1x+v0)
are expressed by u and v appearing in the Mumford expression of D (D=(x+u, v)).
These parameters are denoted in the same manner as in step 1 in
u1=u1(u,v)
u0=u0(u,v)
v1=u1(u,v)
v0=u0(u,v)
From the formula applied to the process D→2D, that is, from the formula [ExHarDBL1→2] shown in table 8, the following relational expressions (1) are obtained.
[Mathematic Expression 19]
(Equation 1)
(Step 2)
Parameters w1, w0, z1, and z0 in the Mumford expression of the divisor 4D shown below
4D=(x2+w1x+w0,z1x+z0)
are expressed by u and v appearing in the Mumford expression of D (D=(x+u, v)).
These parameters are denoted in the same manner as in step 2 in
w1=w1(u,v)
w0=w0(u,v)
z1=z1(u,v)
z0=z0(u,v)
From the formula applied to the process 2D→4D, that is, from the formula [HarleyDBL] shown in table 2, relational expressions of r in step 1 and t1 and t0 in step 3 with respect to u1, u0, v1, and v0 are obtained, and w1, w0, z1, and z0 are expressed using u1, u0, v1, v0, t1, t0, and r as shown below in (Equation 2).
[Mathematic Expression 20]
(Equation 2)
By substituting the above result (obtained in step 1) into (Equation 2), w1, w0, z1, and z0 are expressed using only u and v appearing in the Mumford expression of D.
(Step 3)
Using the condition for 5D=D+4D to have a weight=1, an one-variable equation of u is produced.
The calculation of D+4D is accomplished using the formula ExHarADD1+2→1. In the determination on the branching to select an adequate addition formula of Harley shown in
An algorithm of ExHarADD2+1→2 is shown below in [Table 3]
[Mathematic Expression 21]
u20 + (u21 + u10)u10.
1/r.
inv(v10 + v20 + v21v10).
s0u21, l0
s0u20.
f4 + u21, k1
f3 + (f4 + u21)u21 + v21 + u20.
k2 + s02 + s0 + u10,
k1 + s0(l1 + h1) + u10u31.
u31(h2 + s0) + (h1 + l1 + v21),
u30(h2 + s0) + (h0 + l0 + v20).
As can be seen from [Table 3], there is no branch that causes the output of ExHarADD2+1→2 to be a degenerate divisor (with a weight=1). Therefore, it is needed to perform exception handling 3 to determine the condition for the output to be a degenerate divisor. In the exception handling 3, 5D can be a degenerate divisor having a weight=1 when D and 4D satisfy the following condition.
[Condition]
D=P−P∞
4D=−P+Q−2P∞
The above condition reduces to two conditions described below, and two equations with respect of u and v of the base point D corresponding to the two conditions are obtained.
(Condition 1)
w1(u,v)×u+w0(u,v)=0 (Equation 3a)
(Condition 2)
z1(u,v)×u+z0(u,v)=v+h(u) (Equation 4a)
Equations corresponding to the respective conditions 1 and 2 are denoted as (Equation 3a) and (Equation 4a). These conditions 1 and 2 are required to be satisfied in step 3 shown in
Equations 3a and 4a are with respect to u and v appearing in the Mumford expression of D, that is, D=(x+u, v). Both equations 3a and 4a can be converted into one-variable equations with respect to u as described below.
From the equation defining the hyperelliptic curve, v2 is given as
v2=h(u)v+f(u)
By using this equation, any term including v2 can be converted into a linear expression of v. By repeatedly applying this operation, it is possible to reduce the degree of v. Thus, equation 3a can be formally expressed as follows.
G1(u,v)=a1(u)+b1(u)v=0
Furthermore, if a polynomial conjugate to G is defined as
G1(u,v)=a1(u)+b1(u)(v+h(u))
then
N1=G1×G1′=a12+a1b1h+b12f
is obtained and thus finally an one-variable equation (Equation 3b) with respect to u is obtained as shown below.
N1(u)=0 (Equation 3b)
A similar process is performed for Equation 4a to obtain an one-variable equation of u shown below.
N2(u)=0 (Equation 4b)
If N1 and N2 in (Equations 3b) and (Equation 4b) are calculated by performing the above-described steps, polynomials of u of degree 53 and 72 are finally obtained. It is known that one-variable polynomial equations of finite degree can be generally solved within a polynomial time. Solutions of u are determined for the respective polynomial equations.
(Step 4)
If there is a common solution in the solutions of the two equations determined in step 3, the common solution is employed as u of the divisor.
The obtained u is then substituted into the hyperelliptic curve equation v2+h(u)=f(u), thereby determining v.
Using the determined u and v, the degenerate divisor of the base point is determined by calculating D=(x−u, v).
The base point D determined in the above-described manner is a degenerate divisor with a weight=1, and it is guaranteed that 5D is also a degenerate divisor with a weight=1.
Now, referring to a flow chart shown in
y2+h(x)y=f(x)
where h(x), f(x)εFq[x], and f(x) is a monic polynomial of degree 2g+1.
More specifically, the hyperelliptic curve equation y2+h(x)=f(x) is defined by
h(x)=x2+h1x+h0
f(x)=x5+f3x3+f1x+f0
Thus, as described above, the hyperelliptic curve of genus g=2 has been defined by setting the parameters h1, h0, f3, f1, and f0.
In step S202, the common solution (u) of the one-variable equations of u determined by using the condition for 5D=D+4D to have a weight=1, that is, the common solution of the following two equations is determined.
N1(u)=0 (Equation 3b)
N2(u)=0 (Equation 4b)
These equations are obtained, as described above, from the [Condition] required for 5D to be a degenerate divisor with a weight=1 in the exception handling 3 shown in
[Condition]
D=P−P∞
4D=−P+Q−2P∞
the following two conditions are obtained.
(Condition 1)
w1(u,v)×u+w0(u,v)=0 (Equation 3a)
(Condition 2)
z1(u,v)×u+z0(u,v)=v+h(u) (Equation 4a)
Furthermore, by applying the following equation defining the hyperelliptic curve
v2=h(u)v+f(u)
to Equations 3a and 4a, thereby converting them into the form of a linear equation of v. Thus, Equation 3a is converted into the following form.
G1(u,v)=a1(u)+b1(u)v=0
Furthermore, a polynomial conjugate to G is defined as follows.
G1(u,v)=a1(u)+b1(u)(v+h(u)) Thus,
N1=G1×G1′=a12+a1b1h+b12f
Thus,
N1(u)=0 (Equation 3b)
is obtained and finally the following equation is obtained.
N2(u)=0 (Equation 4b)
In step S202, the common solution (u) of the above two equations, which are shown again below, is determined.
N1(u)=0 (Equation 3b)
N2(u)=0 (Equation 4b)
In a case where there is no common solution for the above equation (that is, if the answer to step S203 is No), the process returns to step S201 to set the parameters h1, h0, f3, f1, and f0 to other values and perform the calculation to find the common solution (u).
If the common solution (u) has been found (that is, if the answer to step S203 is Yes), the process proceeds to step S204. In step S204, the substitution of the hyperelliptic curve v2+h(u)=f(u) is performed and v is determined. Next, in step S205, using the determined u and v, the degenerate divisor used as the base point D=(x−u, v) is determined.
(Process A2) The wNAF Conversion is Performed Using the Degenerate Divisors D and 5D to Obtain wNAF Data Including Only Degenerate Divisors
In the previous process, the degenerate divisor used as the base point D with a weight=1 which is also degenerate when multiplied into 5D on the hyperelliptic curve of genus (g)=2 has been found. Using these degenerate divisors D and 5D, a wNAF data having resistance against the analysis attach such as the simple power analysis (SPA) is produced as described below.
In the wNAF conversion, as described above with reference to the window algorithm, the scalar value [d] used in the scalar multiplication operation [D=dD] is divided into blocks each having a predetermined number of digits. More specifically, the scalar value d given as the multiplier is divided into the following blocks.
|00 . . . 0x|00 . . . 0x|00 . . . 0x| . . .
where x is an odd integer (±1, ±3, . . . ).
The scalar multiplication simply using only the degenerate divisors D and 5D detected above does not provide high resistance against the SPA. To achieve high security for the case where the scalar value [d] is divided into bocks with a block size (number of digits) of 2 by the window algorithm (wNAF) as follows,
|01|, |03|, |0(−1)|, |0(−3)|,
it is needed to prepare, in the table, the precalculated data ±D and ±3D corresponding to the above blocks.
In the case where the scalar value [d] is divided into blocks with a block size of 3 as follows,
|001|, |003|, |005|, |0079|,
|00(−1)|, |00(−3)|, |00(−5)|, |00(−7)|
it is needed to prepare, in the table, the precalculated data ±D, ±3D, ±5D, and ±7D corresponding to the above blocks.
However, in the present algorithm, only degenerate divisors D and 5D are produced in the process described above, and all data necessary as precalculated data have not yet been obtained. For example, in the case where the scalar value [d] is divided into blocks with a block size (the number of digits) of 3, some of the necessary data ±D, ±3D, ±5D, and ±7D have not yet been calculated, and it is impossible to accomplish the window algorithm. It is possible to calculate 3D and 7D separately from D and 5D. However, in this case, there is very high probability that the resultant values are not degenerate. The result of this is that the addition operation in the scalar multiplication includes a mixture of addition of divisors including a degenerate divisor and addition of divisors which are all of the non-degenerate type. In this case, the difference in power consumption or processing time in the process can cause a weakness against analysis attack such as the simple power analysis (SPA).
In the present algorithm, to avoid the above problem, the scalar multiplication based on the window algorithm is performed using the degenerate divisors D and 5D detected in the previous step while maintaining high resistance against the analysis attack such as the simple power analysis (SPA).
The improved wNAF conversion method used herein in the scalar multiplication operation based on the window algorithm using the degenerate divisors D and 5D while maintaining the high resistance against the simple power analysis (SPA) is called wNAF(1, 5). The wNAF(1, 5) process includes a wNAF conversion process based on the above-described technique and a process of further converting the wNAF data according to a conversion table. The process of further converting the wNAF data is shown in
First, in step S231, the wNAF conversion process is performed in a similar manner to step S153 in
That is, the scalar value d given as the multiplier is converted into the wNAF form. More specifically, the scalar value d given as the multiplier is divided into blocks as follows.
|00 . . . 0x|00 . . . 0x|00 . . . 0x| . . .
where x is an odd integer (±1, ±3, . . . ).
Herein, by way of example, it is assumed that the window size is set to be 3 in the wNAF conversion process. In this case, ±D, ±3, ±5D, and ±7D are selected as precalculated data [dD] to be stored in the table.
Next, in step S232, the precalculated data ±D, ±3, ±5D, and ±7D to be stored in the table are converted, using the conversion table shown in
According to conversion table shown in
block associated with calculation of +D: [001]→[001] (no change occurs)
block associated with calculation of +3D: [003]→[011]
block associated with calculation of +5D: [005]→[005] (no change occurs)
block associated with calculation of +7D: [007]→[015]
block associated with calculation of −D: [00(−1)]→[00(−1)] (no change occurs)
block associated with calculation of −3D: [00(−3)]→[0(−1)(−1)]
block associated with calculation of −5D: [00(−5)]→[00(−5)] (no change occurs)
block associated with calculation of −7D: [00(−7)]→[0(−1)(−5)]
Thus, by performing the above conversion using the conversion table, the precalculated data [±D, ±3, ±5D, and ±7D] to be stored in the table has been converted into the form using only ±1 and ±5 so that the data can be expressed using the degenerate divisors D and 5D.
That is, via the above conversion process, the precalculated data [±D, ±3, ±5D, and ±7D] to be stored in the table has been converted into the form using only ±1 and ±5 so that the data can be expressed using the degenerate divisors D and 5D. The scalar multiplication D=dD is accomplished by performing addition operations using the degenerate divisors D and 5D in the above-described form, that is, by performing addition operations using only degenerate divisors.
(Process A3) The Scalar Multiplication is Performed Using the Precalculated Data Expressed Only by the Degenerate Divisors D and 5D
The details of the algorithm of converting the precalculated data [±D, ±3, ±5D, and ±7D] to be stored in the table into the form including only the degenerate divisors D and 5D, and performing the scalar multiplication [D=dD] using these data are described below.
The algorithm of the scalar multiplication is shown below in [Algorithm 7].
[Mathematic Expression 22]
D for d[i] = 0)
d[n − 2]D
d[n − 3]D
2D[0]
D[0] + d[n − 3]D
D[~δ(d[n − 2])]
2 times 2D[0]
D[0] + d[3i + 1]D
D[δ(d[i])]
2D[0]
D[0] + d[3i]D
In the algorithm described above, δ is a function which returns 0 for d[i]=0 and 1 for any other values of d[i], and [˜] denotes a bit inversion of δ, that is, [˜] causes δ=1 to be inverted into 0 and 0 into 1.
In the above algorithm, ±D, ±3, ±5D, and ±7D] are expressed using only the degenerate divisors D and 5D which have already been detected, and any addition operation occurring in the scalar multiplication operation is accomplished by addition of a degenerate divisor and a non-degenerate divisor. In the case where in the converted table, if a 2nd bit is 0, a dummy operation is performed. Thus, a high-speed calculation is possible. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
Referring to a flow chart shown in
First, in step S251 in
N1(u)=0 (Equation 3b)
N2(u)=0 (Equation 4b)
Thereafter, v is determined by substituting the obtained u into the hyperelliptic curve equation v2+h(u)=f(u). Using the determined u and v, the degenerate divisor D=(x−u, v) of the base point is determined.
In step S252, another degenerate divisor 5D is precalculated from the base point D calculated in step S251. This can be accomplished by performing a sequence of operations described below.
D→2D: ExHarDBL1→2 (Table 8)
2D→4D: HarleyDBL (Table 2)
4D→5D: ExHarADD2+1→1
In step S253, the scalar value d given as the multiplier used in the scalar multiplication operation d=dD is converted into the wNAF form. From the resultant wNAF data, modified wNAF data expressed only by the degenerate divisors D and 5D calculated in steps S251 and S252 is produced. For example, in the case of the window size=3, data [±D, ±3, ±5D, and ±7D] appearing in the ordinal wNAF form are expressed using only the degenerate divisors D and 5D. The conversion is accomplished using the conversion table shown in
Finally, in step S254, the scalar multiplication operation D=dD is performed. This scalar multiplication operation is performed using the precalculated data expressed only by the degenerate divisors D and 5D according to [Algorithm 7] described above. In this scalar multiplication, data [±D, ±3, ±5D, and ±7D] appearing in the ordinal wNAF form are converted into expressions using only the degenerate divisors D and 5D, and any addition operation occurring in the scalar multiplication operation is accomplished by addition of degenerate divisors. Thus, a high-speed calculation is possible. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in security against the attack such as the SPA or the TA.
(Algorithm B) Algorithm of efficiently searching for degenerate divisors D and 3D on a curve of genus (g)=3 such that the base point D and 3D both have a weight=2, converting wNAF data into a modified wNAF data expressed using only the detected degenerate divisors D and 3D, and performing the scalar multiplication using the resultant modified wNAF data
Now, there is described an algorithm of efficiently searching for degenerate divisors D and 3D on a curve of genus (g)=3 such that the base point D and 3D both have a weight=2, converting wNAF data into a modified wNAF form expressed using only the detected degenerate divisors D and 3D, and performing the scalar multiplication using the resultant modified wNAF data.
In this algorithm, a base point [D] and [3D] on the hyperelliptic curve of genus (g)=3 are efficiently detected such that [D] and [3D] are both degenerate divisors with a weight=2, wNAF data is converted into a form expressed using only D and 3D, and the scalar multiplication is performed using the resultant modified wNAF data including only degenerate divisors.
As described above, it is substantially impossible to find a base point D by randomly generating divisors and checking whether both the base point D and 3D are simultaneously degenerate divisors. The present algorithm provides a method of efficiently finding a base point D such that D and 3D are both degenerate. In the scalar multiplication operation, D and 3D are prepared as precalculated divisors, and all precalculated divisors necessary in the window algorithm are obtained using D and 3D. In the case of genus (g)=3, unlike the case of genus (g)=2, further conversion of wNAF data is not necessary, and it is sufficient to prepare only D and 3D as the precalculated divisors. The present algorithm includes the following three processes.
(Process B1) Process of efficiently finding D such that the base point D and 3D are both degenerate divisors with a weight=2
(Process B2) Process of performing scalar multiplication using the precalculated data expressed only by the degenerate divisors D and 3D
The details of the respective processes (Process B1) and (Process B2) are described below.
(Process B1) Process of efficiently finding D such that the base point D and 3D are both degenerate divisors with a weight=2
Searching for a divisor D such that the base point D and 3D are both degenerate divisors with a weight 2 is accomplished by applying a method of determining a condition that w(D)=w(3D)=2 by calculating 3D from the base point D using the Harley formula, where w(D)=w(3D)=3 denotes that weight (w)=2 for both the divisors D and 3D.
In order to determine the condition for D to have w(D)=w(3D)=2, let us calculate 3D from D by an addition chain based on the Harley formula. Let divisors D and 2D be expressed in the Mumford form as follows.
D=(x2+u21x+u20,v21x+v20)
2D=(x3+u12x2+u11x+u10,v12x2+v11x+v10)
The calculations D→2D and 2D→3D can be performed using the following Harley formulae:
D→2D: ExHarDBL2→3 (Table 9)
2D→3D: ExHarADD2+3→2 (Table 7)
The details of the above operations according to the Harley formulae, that is,
D→2D: ExHarDBL2→3 (Table 9) and
2D→3D: ExHarADD2+3→2 (Table 7)
are shown below in [Table 9] and [Table 7].
[Mathematic Expression 23]
u102, w1
u112, w2
u11h2, w3
w1h2,
w0(u10 + w2 + h22), w5
(w1 + h1)h1 + (h0 + h1h2)u11,
w5u10 + w4, w4
h0(h0 + w3 + u11(h1 + w1)).
w4 + w5
w1 + w2 + h1 + u10, i0
u11(w1 + h1) + w3 + u10h2 + h0
h2v11,k1
w1(w1 + f5 + u10) + (f4 + v11)u11 + z0 + v10 + f3 + u10f5 + w0,
w1(u11(w1 + f5) + f4 + v11) + (z0 + v10 + f3 + w0)u11 + v11(v11 + h1) +
w1 + f5, d0
v11 + f4,
u10d0, k′1
k1 + (u11 + u10)(d1 + d0) + u11d1 + z0, k′0
z0 + k0
i1k′1, z0
i0k′0,
z1u11 + (i1 + i0)(k′1 + k′0) + z1 + z0, t0
z0 + z1u10
1/r, s1
invt1, s0
invt0
s1(s1 + 1),
w1 + s1(h2 + u11) + s0 + f5,
s0(s0 + h2 + u11) + s1(h1 + u10 + u11h2 + w1) + v11 + f4
[Mathematic Expression 24]
u202, w1
u112, w2
u212, w3
u12 + u21.
w0(u20 + u12w3), w5
u21(u10 + u11w3), w5
u20(w5 + w1),
w3w2 + u21u11, w6
u10(u10 + w6), r
w4 + w5 + w6
u21u12, i3
u21u11, i4
u20u12,
i2 + w2 + u20 + u11: i0
w2w3 + i3 + i4 + u10
v11 + v21 + v12u21, c0
v20 + v10 + v12u20,
i1c1, t3
i0c0, t1 = t2u21 + (i1 + i0)(c1 + c0) + t2 + t3,
t3 + t2u20.
rt1, z2
1/z1, z3
z2r, z4
z2t1, z5
z3r, s1
z4t1, s0
z4t0.
s0u12, t1
s0u10, t2
s1u11,
(s1 + s0)(1 + u12) + s1 + t0, k2
t0 + t2 + v12,
(s1 + s0)(u11 + u10) + t2 + t1 + v11, k0
t1 + v10.
z5(z5 + 1) + u12 + u21, t0
k32, t1
u122,
z5(z5(f6 + u12 + u21 + t0 + k3) + u21 + h2 + u12),
i2 + u11 + u20 + t1 + w2 + t2,
(t1 + w2)(u2l + u12) + i3 + i4 + u10,
i2 + u20 + w2 + u11 + t1 + f5 + (u21 + u12)(t0 + f6 + k3) + k2,
z5(t4 + k3h2) + h2(u12 + u21) + t1 + w2 + i2 + u20 + u11 + h1, t4
z5t4,
t3 + t4.
s0(u32 + u12), t1
s1(u31 + u11), t2
s1(u12 + u32).
t0 + t1 + t2u32 + u32 = v12 + h2,
s0(u30 + u10), t5
(s1 + s0)(u31 + u11 + u30 + u10),
t5 + t1 + t4 + t2u31 + u31 + v11 + h1,
t4 + t2u30 + u30 + v10 + h0,
t0/r.
s02, u31
u21 + u12 + w1 + s0,
(w1 + u12)(u21 + u12) + (h2 + u21)s0 + w0 + u20 + u11 + v12 + f5.
(u30 + u31(u31 + u12) + u11)s0 + u31(u31 + h2 + v12) + u30 + h1 + v11,
(u10 + u30(u31 + u12))s0 + u30(u31 + h2 + v12)+ v10 + h0.
3D, which is a scalar multiplication of the base point D, can be obtained by performing a sequence of operations D→2D→3. By using the relational expressions obtained in the above calculation process, a base point D is detected so that D and 3D are both degenerate divisors with a weight=2. The details of the process of detecting the base point D are described below with reference to
(Step 1)
When the divisor 2D is expressed in the Mumford form as
2D=(x3+u12x2+u11x+u10, v12x2+v11x+v10),
parameters u12, u11, u10, v12, v11, and v10 appearing in this Mumford expression are expressed using parameters u21 u20, v21, and v20 appearing in the Mumford expression of D [D=(x2+u21x+u20, v21x+v20)].
These parameters are denoted in the same manner as in step 1 in
u12=u12(u21, u20, v21, v20)
u11=u11(u21, u20, v21, v20)
u10=u10(u21, u20, v21, v20)
v12=v12(u21, u20, v21, v20)
v11=v11(u21, u20, v21, v20)
v10=v10(u21, u20, v21, v20)
From the formula of D→2D, that is, the formula [ExHarDBL2→3] shown in table 9, the following relational expression (5) is obtained.
[Mathematic Expression 25]
s1, s0, and r in (Equation 5) shown above are functions of (u21, u20, v21, v20) given by (Equation 6) shown below.
[Mathematic Expression 26]
(Step 2)
Using the condition for 3D=D+2D to have a weight=2, an equation [t1=0] to be solved is produced.
To determine the condition for 3D=D+2D to have a weight=2,
the algorithm of 2D→3D: ExHarADD3+2→3 (Table 7) is examined. In step 3 in (Table 7) described above, if
t1=0
is satisfied, then the polynomial of u3 in the Mumford expression of 3D determined in step 6 has a degree of 2, that is, the weight is 2. Therefore,
t1=0
is the condition for 3D=D+2D to have a weight=2.
As shown in step 2 in
t1=t1(u12, u11, u10, v12, v11, v10, u21, u20, v21, v20)
which is a function of coefficients appearing in the Mumford expressions of D and 2D shown below.
D=(x2+u21x+u20, v21x+v20)
2D=(x3+u12x2+u11x+u10, v12x2+v11x+v10)
More specifically, t1=t1(u12, u11, u10, v12, v11, v10, u21, u20, v21, v20) is given by (Equation 7) shown below.
[Mathematic Expression 27]
The (Equation 7) is rewritten into a simpler form expressed using only coefficients (u21, u20, v21, v20) of the Mumford expression of D shown below.
D=(x2+u21x+u20, v21x+v20)
Herein, the coefficients are given by the relational expressions determined in step 1, that is, given by
u12=u12(u21, u20, v21, v20)
u11=u11(u21, u20, v21, v20)
u10=u10(u21, u20, v21, v20)
v12=v12(u21, u20, v21, v20)
v11=v11(u21, u20, v21, v20)
v10=v10(u21, u20, v21, v20)
Thus, the conditional expression
t1=t1(u21, u20, v21, v20)=0
has been determined.
(Step 3)
Next, as shown in step 3 in
t1=t1(u21, u20, v21, v20)=0
are expressed using points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve.
As described above, any reduced divisor D of genus 3 can be expressed in the Mumford form using a set of polynomials of degree 3 or less whose coefficients are elements of the finite field Fq, as follows:
(U,V)=(x3+u2x2+u1x+u0, v2x2+v1x+v0)
and the hyperelliptic curve C of genus g is defined by the following equation.
y2+h(x)y=f(x)
where h(x), f(x)εFq[x], and f(x) is a monic polynomial of degree 2g+1. If, according to the definition of the Mumford expression, the parameters (u21, u20, v21, v20) appearing in the following expression
t1=t1(u21, u20, v21, v20)=0
are expressed using points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve, then the relational expression shown in step 3 in
u21=x1+x2
u20=x1x2
v21=(y1+y2)/(x1+x2)
v20=v21x1+y1 (Equation 8)
According to (Equation 8) described above, the conditional expression
t1=t1(u21, u20, v21, v20)=0
is rewritten into (Equation 9) shown below.
t1=t1(x1, x2, y1, y2)=0 (Equation 9)
(Step 4)
As shown in step 4 in
t1=t1(x1, x2, y1, y2)=0
obtained in step 2, if x1 and y1 are regarded as constants, the above expression becomes a function of x2 and y2. The degree of y2 in this expression is reduced in a similar manner to the process of producing (Equation 3b) for the case of genus=2, by using
y2+h(x)y=f(x)
which defines the hyperelliptic curve. Using the resultant expression, (Equation 9) is formally expressed as follows.
G3(x2, y2)=a3(x2)+b3(x2)y2=0
Furthermore, if a polynomial conjugate to G3 is defined as follows
G3′=a3(x2)+b3(x2)(y2+h(x2))
then
N3=G×G′=a2+abh+b2f
is obtained and thus finally an one-variable equation (Equation 10) of x2 is obtained as shown below.
N3(x2)=0 (Equation 10)
(Step 5)
If
N3(x2)=0 (Equation 10)
has a solution with respect to x2, then, using the (Equation 8), that is,
u21=x1+x2
u20=x1x2
v21=(y1+y2)/(x1+x2)
v20=v21x1+y1
the divisor D=(x2+u21x+u20, v21x+v20) can be determined.
More specifically, as a result of the steps described above, an one-variable polynomial of degree 29 with respect to x2 is obtained. As with the case of genus (g)=2, It is known that one-variable polynomial equations of finite degree can be generally solved within a polynomial time. Solutions with respect to x2 are determined for the respective polynomial equations.
(Step 6)
If the solution with respect to x2 of
N3(x2)=0
is determined, then x2 is substituted into the equation
y2+h(x)y=f(x)
which defines the hyperelliptic curve, thereby determining y2.
Furthermore, from points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve, the base point D is determined as follows.
D=(x2+u21x+u20, v21x+v20)
The base point D determined in the above-described manner is a degenerate divisor with a weight=2, and it is guaranteed that 3D is also a degenerate divisor with a weight=2.
Now, referring to a flow chart shown in
y2+h(x)y=f(x)
where h(x), f(x)εFq[x], and f(x) is a monic polynomial of degree 2g+1.
More specifically, the hyperelliptic curve equation y2+h(x)=f(x) is defined by
h(x)=x3+h2x2+h1x+h0, and
f(x)=x7+f5x5+f4x4+f3x3+f2x2+f1x+f0
Thus, as described above, the hyperelliptic curve of genus g=3 has been defined by setting the parameters h2, h1, h0, f5, f4, f3, f2, f1, and f0.
In step S302, a point P(x1, y1) on the hyperelliptic curve is randomly produced and substituted into an equation N3(x2, x1, y1)=0. This equation
N3(x2, x1, y1)=0
is obtained from the condition that in the algorithm of 2D→3D: ExHarADD3+2→3 (Table 7) that is, in step 3 in (Table 7),
t1=0
should be satisfied in order for 3D=D+2D to have a weight 2.
More specifically, if, according to the definition of the Mumford expression, the parameters (u21, u20, v21, v20) appearing in the following expression
t1=t1(u21, u20, v21, v20)=0
are expressed using points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve, then the relational expression shown below is obtained.
u21=x1+x2
u20=x1x2
v21=(y1+y2)/(x1+x2)
v20=v21x1+y1
Herein, the conditional expression is set as below.
t1=t1(x1, x2, y1, y2)=0
Herein, if x1 and y1 are regarded as constants, the above expression becomes a function of x2 and y2. The degree of y2 in this expression is reduced by using the equation y2+h(x)y=f(x) which defines the hyperelliptic curve. Furthermore,
t1=t1(x1, x2, y1, y2)=0
is rewritten as
G3(x2, y2)=a3(x2)+b3(x2)y2=0.
Herein, if a polynomial conjugate to G3 is defined as follows
G3′=a3(x2)+b3(x2)(y2+h(x2))
then
N3=G×G′=a2+abh+b2f
is obtained.
In step S303, from N3=G×G′=a2+abh+b2f, an equation (Equation 10) including only x2 as a variable is obtained as shown below.
N3(x2)=0
The solution x2 of this equation is determined.
If the equation
N3(x2)=0
does not have a solution (that is, if the answer to step S2304 is No), the process returns to step S302 to set the parameters h2, h1, h0, f5, f5, f3, f2, f1, and f0 to other values and perform the calculation to find the solution (x2).
If the solution (x2) has been found (that is, if the answer to step S304 is Yes), the process proceeds to step S305. In step S305, x2 is substituted into the hyperelliptic curve y2+h(x)=f(x), and y2 is determined. Furthermore, in steps S306 and S307, from points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve, the base point D is determined as follows.
D=(x2+u21x+u20, v21x+v20)
The base point D determined in the above-described manner is a degenerate divisor with a weight=2, and it is guaranteed that 3D is also a degenerate divisor with a weight=2.
(Process B2) Process of performing scalar multiplication using the precalculated data expressed only by the degenerate divisors D and 3D
Now, an algorithm of a process of performing the scalar multiplication [D=dD] using the precalculated [±D,±3] expressed using only degenerate divisors D and 3D is described below. In this algorithm, the window size in the window algorithm (wNAF) is set to 2, and data [±D, ±3] are necessary as precalculated data, which can be directly calculated from the degenerate divisors D and 3D obtained by the above-described process. Therefore, unlike the previous algorithm for genus=2 in which the window size is set to 3, the conversion process using the conversion table is not necessary.
The algorithm of the scalar multiplication is shown below in [Algorithm 8].
[Mathematic Expression 28]
d[n]P
2D
D + d[i]D
This algorithm is different from that based on the conventional window algorithm (Algorithm 6) in that two degenerate divisors D and 3D are input and addition in step 2.2 is performed in the form of addition of a degenerate divisor and a non-degenerate divisor. Thus, as described above, and any addition operation occurring in the scalar multiplication operation is accomplished by addition of divisors including a degenerate divisor. Thus, a high-speed calculation is possible. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
Referring to a flow chart shown in
First, in step S351 in
t1=0
should be satisfied in order for 3D=D+2D to have a weight 2, and thus the following equation should hold.
N3(x2)=0
The solution (x2) of the above equation is determined, and the resultant value x2 is substituted into the equation y2+h(x)=f(x) which defines the hyperelliptic curve. From points P(x1, y1) and Q(x2, y2) on the hyperelliptic curve, the base point D is determined as follows.
D=(x2+u21x+u20, v21x+v20)
In step S352, another degenerate divisor 3D is precalculated from the base point D calculated in step S351. This can be accomplished by performing a sequence of operations described below.
D→2D: ExHarDBL1→2 (Table 8)
2D→3D: ExHarADD3+2→3 (Table 7)
In step S353, the scalar value d given as the multiplier used in the scalar multiplication operation d=dD is converted into the wNAF form.
Finally, in step S354, the scalar multiplication operation D=dD is performed. This scalar multiplication operation is performed using the precalculated data expressed only by the degenerate divisors D and 3D according to [Algorithm 8] described above.
In the conventional calculation technique using the wNAF, the addition operation is performed using a non-degenerate divisor having a weight=3. In contrast, in the addition operation in the scalar multiplication operation according to the present algorithm, the addition operation is performed using only the degenerate divisors D and 3D, that is, the addition operation is accomplished by adding a degenerate divisor and a non-degenerate divisor. Thus, a high-speed calculation is possible. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
The two algorithms of setting a degenerate divisor as a base point and performing the scalar multiplication operation using the window algorithm according to the present invention, that is, the following two algorithms have been described above.
(Algorithm A) Algorithm of efficiently searching for degenerate divisors D and 5D on a curve of genus (g)=2 such that the base point D and 5D both have a weight=1, converting wNAF data into a modified wNAF form expressed using only the detected degenerate divisors D and 5D, and performing the scalar multiplication using the resultant modified wNAF data
(Algorithm B) Algorithm of efficiently searching for degenerate divisors D and 3D on a curve of genus (g)=3 such that the base point D and 3D both have a weight=2, expressing the wNAF data using only the detected degenerate divisors D and 3D, and performing the scalar multiplication using the resultant converted wNAF data
As described above, the present invention makes it possible to apply the window algorithm to the scalar multiplication operation in the processing of the hyperelliptic curve cryptography using degenerate divisors while maintaining high security against the SPA. The algorithm according to the present invention makes it possible to perform the scalar multiplication operation at a higher speed than conventional techniques. The amount of computation needed in the algorithm according to the present invention and that needed in the conventional algorithm are shown below.
First, the amount of computation needed to perform the scalar multiplication on d with a length of 160 bits in the cryptographic processing with genus of 2 is shown for the following three algorithm.
(Algorithm According to the Present Invention A)
In this algorithm, as described above, degenerate divisors D and 5D on the curve of genus (g)=2 are searched for in a highly efficient manner such that the base point D and 5D both have a weight=1, wNAF data is converted into a modified wNAF form expressed using only the detected degenerate divisors D and 5D, and the scalar multiplication is performed using the resultant modified wNAF data.
Conventional algorithm A=(1A) Algorithm in which a degenerate divisor is used as the base point
Conventional algorithm B=(1B) Algorithm based on the window algorithm (using window size=2)
Conventional Algorithm A: 318I+6028M
Conventional Algorithm B: 239I+6293M
Algorithm According to the Present Invention A: 267I+5477M
In the above description, I denotes the cost for the division operation on an element of the finite field, and M denotes the cost for the multiplication operation on an element of the finite field. The lower in cost, the greater in efficiency of the algorithm. The amount of computation has been estimated based on the amount of computation of divisors using the calculation formulae of Algorithm 1 to 9 described above. Note that “Conventional Algorithm A” corresponds to “Algorithm 3”, Conventional Algorithm B” corresponds to “Algorithm 5”, and Algorithm According to the Present Invention A” corresponds to “Algorithm 7”.
For example, the cost for Conventional Algorithm A is calculated as follows.
(I+7M)+(I+27M)+158×{(I+27M)+(I+11M)}=318I+6028M
I and M vary depending on the computer used. In the estimation, it was assumed that I=4M. The result of the estimation performed under the above assumption indicates that “Algorithm According to the Present Invention A” (computation cost=267I+5477M) is higher in the processing speed by about 10% than “Conventional Algorithm A” (computation cost=318I+6028M). Algorithm According to the Present Invention A” (computation cost=267I+5477M) is also higher in the processing speed by about 10% than “Conventional Algorithm B” (computation cost=239I+6293M). In the comparison between “Conventional Algorithm B” and “Algorithm According to the Present Invention A”, the number of precalculated data was set to be equal to each other. That is, in “Conventional Algorithm B”, the window size was set to 2 (the precalculated data=D and 3D), while in “Algorithm According to the Present Invention A”, the window size was set to 3 (the precalculated data=D and 5D (degenerate divisors)).
Next, the amount of computation needed to perform the scalar multiplication on d with a length of 160 bits in the cryptographic processing with genus of 3 is shown for the following three algorithm.
(Algorithm According to the Present Invention B)
In this algorithm, as described above, degenerate divisors D and 3D on the curve of genus (g)=3 are searched for in a highly efficient manner such that the base point D and 5D both have a weight=2, wNAF data is converted into a modified wNAF form expressed using only the detected degenerate divisors D and 3D, and the scalar multiplication is performed using the resultant modified wNAF data.
Conventional algorithm A=(1A) Algorithm in which a degenerate divisor (with weight=2) is used as the base point
Conventional algorithm B=(1B) Algorithm based on the window algorithm (using window size=2)
Conventional Algorithm A: 318I+21111M
Conventional Algorithm B: 239I+19119M
Algorithm According to the Present Invention B: 239I+17003M
The amount of computation has been estimated based on the amount of computation of divisors using the calculation formulae of Algorithm 1 to 9 described above. Note that “Conventional Algorithm A” corresponds to “Algorithm 3”, Conventional Algorithm B” corresponds to “Algorithm 5”, and Algorithm According to the Present Invention B” corresponds to “Algorithm 8”.
In the estimation, it was also assumed that I=4M as with the case of the genus=2. The result of the estimation indicates that “Algorithm According to the Present Invention A” (computation cost=239I+17003M) is higher in the processing speed by about 20% than “Conventional Algorithm A” (computation cost=318I+21111M). Algorithm According to the Present Invention A” (computation cost=239I+17003M) is higher in the processing speed by about 11% than “Conventional Algorithm B” (computation cost=239I+17003M). In the comparison, the window size was set to 2 for all algorithms (the precalculated data=D and 3D).
In the present invention, as described above, a degenerate divisor with a weight smaller than the genus g of the hyperelliptic curve is used as the base point, and precalculated data used in the window algorithm are expressed using degenerate divisors. The addition operation in the scalar multiplication is performed in the form of addition between a non-degenerate divisor and a degenerate divisor thereby achieving a high-speed operation. Because the addition operation is limited to the form of addition of a degenerate divisor and a non-degenerate divisor, a high-speed calculation is achieved without causing degradation in security against the attack (SPA or TA) based on the variation in the power consumption or the processing time.
In the cryptographic processing operation including the operation of divisors on the hyperelliptic curve, the scalar multiplication operation of divisors needs a long processing time. Use of the above-described algorithm according to the present invention makes it possible to increase the processing speed of the scalar multiplication operation, and thus a great improvement in the processing speed of the hyperelliptic curve cryptography is achieved.
As described above, the hyperelliptic curve cryptography (HECC) is generalization of the elliptic curve cryptography (ECC) and can be applied to a wide variety of cryptographic processes based on the elliptic curve cryptography (ECC) such as digital signature, encryption of data, decryption of encrypted data, processing of a common encryption key, authentication processing, etc. By replacing the conventional scalar multiplication operation in the process of the elliptic curve cryptography (ECC) by the scalar multiplication operation according to the present invention, it is possible to increase the processing speed.
3. Functional Configuration of Cryptographic Processing Apparatus
A precalculated data producing unit 102 serves as precalculated data producing means for producing precalculated degenerate divisor data such as 3D or 5D from the base point D produced by the base point producing unit 101.
The cryptographic processing apparatus 100 also includes a conversion unit 103 configured to convert a scalar value d given as a multiplier to be multiplied with the divisor D in the scalar multiplication operation [D=dD] into WNAF data, a further-conversion unit 104 configured to further convert the wNAF data produced by the conversion unit 103 in accordance with a conversion table so as to produce modified wNAF data expressed using only degenerate divisors, and an operation unit 105 configured to perform the scalar multiplication operation to produce a scalar product of divisors including the divisor set as the base point.
The base point producing unit 101 is configured to randomly select g0 elements on the finite field Fq given as the field of definition thereby producing g0 points Pi (i=1, . . . , g0) on the hyperelliptic curve, determine coefficients vi of
U(x)=(x−x1)(x−x2) . . . (x−xg0), and
V(x)=vg0-1xg0-1+vg0-2xg0-2+ . . . +v0
thereby determining the divisor of the base point D0=(U(x), V(x)).
More specifically, for example, the base point producing unit 101 produces, as the base point, a degenerate divisor with a weight=1 when the genus g of the hyperelliptic curve is 2. When the genus g of the hyperelliptic curve is 3, the base point producing unit 101 produces, as the base point, a degenerate divisor with a weight=1 or 2. In the above-described process of producing the base point, the base point producing unit 101 produces the divisor D as the based point D such that, not only the base point but also one or more divisors needed to produce precalculated data used in the window algorithm, such as 5D in Algorithm A or 3D in Algorithm B, also become degenerate.
The precalculated data producing unit 102 produces the precalculated degenerate divisor data such as 3D or 5D used in the window algorithm from the base point D produced by the base point producing unit 101. In the case of Algorithm A (genus (g)=2), the window size is set to 3, and the degenerate divisor 5D is precalculated. In the case of Algorithm B (genus (g)=3), the window size is set to 2, and the degenerate divisor 3D is precalculated.
The conversion unit 103 converts the scalar value d given as the multiplier to be multiplied with the divisor D in the scalar multiplication operation [D=dD] into wNAF data. More specifically, the multiplier d expressed in the binary form is divided by the window (with the predetermined window size) into blocks as follows.
|00 . . . 0x|00 . . . 0x|00 . . . 0x| . . .
where x is an odd integer (±1, ±3, . . . ).
The further-conversion unit 104 further converts the wNAF data produced by the conversion unit 103 in accordance with the conversion table so as to produce modified wNAF data expressed using only degenerate divisors. Note that this process is performed in Algorithm A, but this process is not necessary in Algorithm B. The reason is as follows. In Algorithm A, the window size is set to 3. In the case where the window size is set to 3 in the conventional wNAF process, ±D, ±3D, ±5D, and ±7D are needed to be stored as precalculated data in the table. However, in Algorithm A, only degenerate divisors D and 5D are prepared as the precalculated data, and thus it is needed to convert the other precalculated data into a form expressed using only D and 5D. On the other hand, in the case of Algorithm B, the window size is set to 2, and ±D and ±3D are needed to be stored as precalculated data in the table. Fortunately, in Algorithm B, degenerate divisors D and 3D are prepared as the precalculated data, and thus it is not needed to prepare further precalculated data, that is, it is not needed to perform the further conversion of the wNAF data.
The operation unit 105 performs the scalar multiplication operation according to Algorithm 7 (Algorithm A) or Algorithm 8 (Algorithm B) described above. In the conventional wNAF process, the addition operation is performed using a non-degenerate divisor having a weight equal to the genus (g). In contrast, in the addition operation in the scalar multiplication operation according to the present algorithm, the addition operation is accomplished for divisors including a divisor with a weight smaller than the genus (g), that is, the addition operation is accomplished by adding a degenerate divisor and a non-degenerate divisor. Thus, a high-speed calculation is possible. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA.
4. Examples of Applications of the Present Invention to Production and Verification of Digital Signature
A specific example of an application of the cryptographic process algorithm according to the present invention is described below. In this specific example, it is assumed that the operation algorithm according to the present invention is applied to the scalar multiplication operation in production and verification of digital signature using the elliptic curve cryptography based on ECDSA (EC-Digital Signature Algorithm). According to the IEEE1363 standard, production and verification of digital signature based on the ECDSA are performed via a sequence shown below.
(1) Input
(1-1) Domain parameters of an elliptic curve and a base point G (with order r)
(1-2) Secret key s of a signer
(1-3) Plaintext M
(2) Key production
(2-1) For the given secret key s, W=sG is produced as a public key.
(3) Production of Signature
(3-1) Random integer 0<u<r is produced.
(3-2) V=uG=(xv, yv) is calculated.
(3-3) xv is converted into in integer i.
(3-4) c=i mod r is calculated. If c=0 then the process returns to step 3-1.
(3-5) f=h(M), where h is a hash function.
(3-6) d=u−1(f+sc) mod r is calculated. If d=0, then the process returns to step 3-1.
(3-7) (c, d) is employed as signature for the plaintext M.
(4) Signature Verification
(4-1) Checking is performed to determine whether 0<c<r and 0<d<r. If not so, “invalid” is output.
(4-2) h=d−1 mod r, h1=fh mod r, and h2=ch mod r are calculated.
(4-3) P=(xp, yp)=h1G+h2W is calculated. If P=0, then “invalid” is output.
(4-4) xp is converted into in integer i.
(4-5) c′=i mod r is calculated.
(4-6) If c′=c, “valid” is output, but otherwise, “invalid” is output.
In the algorithm described above, the technique using the hyperelliptic curve according to the present invention may be advantageously applied to the following steps.
(2-1) For the given secret key s, W=sG is produced as a public key.
(3-2) V=uG=(xv, yv) is calculated.
(4-3) P=(xp, yp)=h1G+h2W is calculated. If P=0, then “invalid” is output.
In the above steps (2-1), (3-2), and (4-3), the process W=sG, the process V=uG, and the process h1 in P=(xp, yp)=h1G+h2W are scalar multiplication operations of given divisors, and thus it possible to increase the processing speed by applying the technique according to the present invention.
5. Example of Hardware Configuration of Cryptographic Processing Apparatus
Finally, an example of a configuration of an IC module 200, which is a device configured to perform the cryptographic process described above, is described below with reference to
In
The processing program stored in the memory 202 includes a base point setting program module, a scalar multiplication operation program module, and a doubling operation program module. The memory 202 may also be used as a storage area for storing key data or the like necessary in the cryptographic process. It is desirable that the data storage area be configured so as to be secure against tampering.
A cryptographic processing unit 203 performs the encryption/decryption process including the scalar multiplication operation described above. Although in the present example, the cryptographic processing means is implemented in the form of a separate module, the cryptographic processing means may be implemented in a different manner. For example, a cryptographic processing program stored in the ROM may be read and executed by the CPU 201 thereby implementing the cryptographic processing means.
A random number generator 204 generates a random number necessary in production of a key in the cryptographic process.
A transmitting/receiving unit 205 is a data communication processing unit configured to perform data communication between the IC module and an external apparatus such as a reader/writer. More specifically, the transmitting/receiving unit 205 outputs encrypted data generated in the IC module and receives data from the external apparatus such as the reader/writer.
The present invention has been described above with reference to specific embodiments by way of example and not limitation. It should be apparent to those skilled in the art that various modifications and substitutions are possible without departing from the spirit and the scope of the invention That is, the embodiments have been described above by way of example and not limitation. The scope of the invention is to be determined solely by the claims.
Any of the processes disclosed in the present description may be performed by means of hardware, software, or a combination of hardware and software. In the case in which a process is performed by means of software, a program of the process may be installed into a memory disposed in a dedicated computer embedded in hardware and the program may be executed by the computer, or the program may be installed on a general-purpose computer capable of executing various processes and may be executed on the general-purpose computer.
The program may be stored in advance in a storage medium such as a hard disk or a ROM (Read Only Memory). The program may also be temporarily or permanently stored in a removable storage medium such as a flexible disk, a CD-ROM (Compact Disc Read Only Memory), an MO (Magneto-optical) disk, a DVD (Digital Versatile Disc), a magnetic disk, or a semiconductor memory. The program stored on such a removable storage medium may be supplied in the form of so-called packaged software.
Instead of installing the program from the removable storage medium onto the computer, the program may also be transferred to the computer from a download site via radio transmission or via a network such as an LAN (Local Area Network) or the Internet by means of wire communication. In this case, the computer receives the program transmitted in the above-described manner and installs the program on a storage medium such as a hard disk disposed in the computer.
The processes disclosed in the present description may be performed time-sequentially in the same order as that described in the program, or may be performed in parallel or individually depending on the processing power of the computer. In the present description, the term “system” is used to describe a logical collection of a plurality of devices, and it is not necessarily required that the plurality of devices be disposed in a single case.
In an aspect of the present invention, the base point D is produced such that the base point D and one or more of precalculated data, in addition to the base point, used in the scalar multiplication operation based on the window algorithm are degenerate divisors with a weight g0 smaller than genus g of the hyperelliptic curve (where 1≦g0<g), and the addition operation included in the scalar multiplication operation based on the window algorithm is accomplished by performing an addition operation of adding a non-degenerate divisor and a precalculated degenerate divisor. Thus, a high-speed operation is achieved. Besides, because the addition operations do not include addition of non-degenerate divisors, there is no difference in power consumption which would otherwise occur depending on the difference in processing time between degenerate divisors and non-degenerate divisors. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA. Therefore, the present invention can be advantageously applied to a wide variety devices such as an IC card which need a high processing speed and high security in the cryptographic processing operation.
In an aspect of the present invention, a multiplier d to be multiplied with a divisor D in the scalar multiplication operation D=dD is converted into a wNAF (width-wNon-Adjacent Form) form based on the window algorithm, thereby producing wNAF data. If precalculated data to be produced from the wNAF data produced above includes data other than the degenerate divisors, then the wNAF data is further converted so as to obtain modified wNAF data expressed only by the degenerate divisors. The degenerate divisor data are related to the modified wNAF data, and the addition operation in the scalar multiplication is performed in the form of addition between a non-degenerate divisor and a degenerate divisor. Thus, a high-speed calculation is achieved without causing degradation in resistance against the attack such as the SPA or the TA. Therefore, the present invention can be advantageously applied to a wide variety devices such as an IC card which need a high processing speed and high security in the cryptographic processing operation.
Number | Date | Country | Kind |
---|---|---|---|
P2004-337186 | Nov 2004 | JP | national |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/JP2005/020967 | 11/15/2005 | WO | 00 | 5/22/2007 |
Publishing Document | Publishing Date | Country | Kind |
---|---|---|---|
WO2006/054559 | 5/26/2006 | WO | A |
Number | Date | Country | |
---|---|---|---|
20070291937 A1 | Dec 2007 | US |