Patent Application
20120033805
The present invention relates to a cryptographic technique. In particular, it relates to a technique of calculation over a finite field.
In recent years, with the practical use of cryptographic schemes based on pairing, studies to improve the pairing efficiency have become more active. The pairing is a two-input one-output bilinear function. The present cryptography uses a pairing that accepts as inputs two points P(x1, y1) and Q(x2, y2) on an elliptic curve defined on a finite field GF(pm)(x1, y1, x2, y2∈GF(pm), p represents a prime number, and m represents an integer equal to or greater than 1) and returns an element ηT(P, Q) of an extension field GF(pd·m) of the finite field GF(pm) (ηT(P, Q) ∈ GF(3d·m)):
e(P(x1, y1), Q(x2, y2))→ηT(P, Q) (1)
The first proposed algorithm for pairing calculation in polynomial time is the Miller algorithm for Tate pairing. Following the Miller algorithm, the ηT pairing algorithm, which is reduced by half in number of recursions compared with the Miller algorithm, and then the improved ηT pairing algorithm, which is further improved in calculation speed by omitting the cube root calculation involved with the ηT pairing algorithm, were proposed (see Non-patent literature 1, for example). In the following, the improved ηT pairing algorithm will be summarized.
<Improved ηT Pairing Calculation Algorithm>
[Preparation]
Eb: Eb represents a supersingular elliptic curve that is defined on a finite field GF(3m) and expressed as Y2=X3−X+b (b∈{−1,1}).
σ: σ represents an indeterminate element that is a root of an irreducible polynomial σ2+1=0 over the finite field GF(3m).
ρ: ρ represents an indeterminate element that is a root of a polynomial ρ3−ρ−b=0 over the finite field GF(3m).
[Input] P(x1, y1), Q(x2, y2)(x1, y1, x2, y2∈GF(3m))
[Output] ηT(P, Q)∈GF(36m)
[Calculation Process]
Step 1: y1=−y1∈GF(3m) (only if b=1)
Step 2: u=x1+x2+b∈GF(3m)
Step 3: c=b
Step 4: f=−y1·u+y2·σ+y1·ρ∈GF(36m)
Step 5: repeat Steps 5-1 to 5-8 while increasing j from 0 to (m−1)/2 in increments of 1
Step 5-1: u=x1+x2+c∈GF(3m)
Step 5-2: g=−u2+y1·y2·σ−u·ρ−ρ2∈GF(36m)
Step 5-3: f=f·g∈GF(36m)
Step 5-4: f=f3∈GF(36m)
Step 5-5: y1=−y1∈GF(3m)
Step 5-6: x2=x29∈GF(3m)
Step 5-7: y2=y29∈GF(3m)
Step 5-8: c=(c−b) mod 3∈GF(3)
Step 6: output ffinalpow∈GF(36m)[finalpow=(33m−1)(3m+1)(3m−3(m+1)/2+1)]
Non-patent literature 2 discloses an algorithm that is obtained by applying the loop unrolling technique, which is a kind of loop transformation, to the ηT pairing calculation. The loop unrolling technique is to improve the execution speed by decreasing the number of determination steps for loop termination, which occur in every repeated loop. According to the method disclosed in Non-patent literature 2, a processing that involves two loops according to the basic algorithm is performed in one loop to reduce the number of loop repetitions by half, thereby reducing the number of determination steps for loop termination by half.
Non-patent literature 1: Beuchat, J.-L.; Shirase, M.; Takagi, T.; Okamoto, “An Algorithm for the ηT Pairing Calculation in Characteristic Three and its Hardware Implementation”, Proceedings of the 18th IEEE Symposium on Computer Arithmetic, Institute of Electrical and Electronics Engineers, 25-27 Jun. 2007, pp. 97-104
Non-patent literature 2: Beuchat, J.-L.; Brisebarre, N.; Detrey, J.; Okamoto, E.; Shirase, M.; Takagi, T., “Algorithms and Arithmetic Operators for Computing the ηT Pairing in Characteristic Three”, IEEE transactions on computers, Institute of Electrical and Electronics Engineers, November 2008, Volume 57, Issue 11, pp. 1454-1468
The prior-art literatures 1 and 2 listed above disclose methods for efficient calculation of one pairing but disclose no methods for efficient calculation of the product of a plurality of pairings.
Suppose that a pairing that accepts as inputs two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) (X1[i], Y1[i], X2[i], Y2[i]∈GF(pm)) on an elliptic curve defined on a finite field GF(pm) and returns an element ηT(P[i], Q[i]) of an extension field GF(pd·m) of the finite field GF(pm) (ηT(P[i], Q[i])∈GF(3d·m)) is expressed as follows:
e(P(X1[i], Y1[i]), Q(X2[i], Y2[i]))→ηT(P[i], Q[i]) (2)
On this supposition, the above prior-art literatures 1 and 2 disclose no method for efficient calculation of
Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) (3)
where N≧2.
According to the conventional methods disclosed in the prior-art literatures 1 and 2, for example, the calculation of the formula (3) is performed by separately performing the calculation of the formula (2) for each value of i=0, . . . , N−1 and then multiplying the results ηT(P[i], Q[i]) of the separate calculations. For example, the loop unrolling technique is applied only to the loop process (recursion process) of the calculation of the formula (2) separately performed for each value of i∈{0, . . . , N−1}, and there has not been proposed a calculation method in which pairing calculations for different values of i are performed in cooperation with each other.
The same holds true for calculations other than pairing. For example, supposing that a calculation of K elements R(1, 0), . . . , R(1, K−1)∈GF(pm) (i∈{0, . . . , N−1}) over a finite field is expressed as
e(R(i, 0), . . . , R(i, K−1)) (4)
, the same holds true for a calculation of N*K elements R(i, k) of the finite field GF(pm):
Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) (5)
where R(i, k)∈GF(pm), N≧2, K≧1, i∈{0, . . . , N−1}, k∈{0, . . . , K−1}, p represents a prime number, and m represents an integer equal to or greater than 1.
As shown in
However, the calculation of the formula (5) can be improved in efficiency by finding an ingenious way of cooperation of the calculations of the formula (4) for the different values of i.
The present invention has been devised in view of such circumstances, and an object of the present invention is to provide a technique of efficiently calculating Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) where e(R(i, 0), . . . , R(i, K−1)) represents a calculation of K elements R(i, 0), . . . , R(i, K−1)∈GF(pm) of the finite field GF(pm) over a finite field.
According to the present invention, N*K elements R(i, k)∈GF(pm) of a finite field GF(pm) are input (N≧2, K≧1, i∈{0, . . . , N−1}, k∈{0, . . . , K−1}, p represents a prime number, and m represents an integer equal to or greater than 1), a finite field calculation part performs a calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) where e(R(i, 0), . . . , R(i, K−1)) represents a calculation of K elements R(i, 0), . . . , R(i, K−1)∈GF(pm) of the finite field GF(pm) over a finite field, and the result of the calculation is output.
The calculation e(R(i, 0), . . . , R(i, K−1)) over the finite field includes an extension field calculation over a d-th-order extension field GF(pd·m) (d≧2) of the finite field GF(pm). The extension field calculation is a calculation that maps images over the finite field GF(pm) that depend on one or more input elements R(i, k)∈{R(i, 0), . . . , R(i, K−1)} of the finite field GF(pm) and/or the elements R(i, k)∈{R(i, 0), . . . , R(i, K−1)} of the finite field GF(pm) to a polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) that expresses an element of the d-th-order extension field GF(pd·m). The polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) is a polynomial having d terms, the coefficients ah of some of the terms h∈{0, . . . , d−1} of which are the images over the finite field GF(pm) that depend on one or more input elements R(i, k) of the finite field GF(pm) and/or the elements R(i, k) of the finite field GF(pm), and the coefficients ar of predetermined some of the terms r∈{0, . . . , d−1} (r≠h) of which are previously determined to be 0∈GF(pm). That is, at least some of the coefficients in the polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) are 0 at any time.
A first calculation part of the finite field calculation part receives, for any i1∈{0, . . . , N−1}, images over the finite field GF(pm) that depend on one or more elements R(i1, k) of the finite field GF(pm) and/or the elements R(i1, k) of the finite field GF(pm), performs the extension field calculation therefor, and outputs the resulting polynomial poly(R(i1, 0), . . . , R(i1, K−1))∈GF(pd·m). A second calculation part of the finite field calculation part receives, for any i2∈{0, . . . , N−1} (i2≠i1), images over the finite field GF(pm) that depend on one or more elements R(i2, k) of the finite field GF(pm) and/or the elements R(i2, k) of the finite field GF(pm), performs the extension field calculation therefor, and outputs the resulting polynomial poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m). A third calculation part of the finite field calculation part receives the polynomial poly(R(i1, 0), . . . , R(i1, K−1)) and the polynomial poly(R(i2, 0), . . . , R(i2, K−1)), calculates the product thereof poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m), and outputs the product poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)).
Each element of a subset including L (which represents an even number) different elements of the set {0, . . . , N−1} is selected one time as i1 or i2, and the first calculation part, the second calculation part and the third calculation part perform respective processing stages one time for each pair of selected i1 and i2, thereby performing a loop process including the processing stages for the L/2 pairs of i1 and i2. Using the products poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) obtained by the processings, Πi=0N−1poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) is calculated.
As described above, at least some of the coefficients in the polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) and the polynomial poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m) are 0 at any time. Since the product of such polynomials is calculated in advance, calculations applying the coefficients that are 0 are unnecessary, and therefore, the amount of multiplication is reduced.
According to the present invention, the calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) where e(R(i, 0), . . . , R(i, K−1)) represents a calculation of K elements R(i, 0), . . . , R(i, K−1)∈GF(pm) of the finite field GF(pm) over a finite field can be efficiently performed.
In the following, embodiments of the present invention will be described with reference to the drawings.
[Definitions]
First, definitions of the terms and symbols used herein will be provided.
p: p represents a positive prime number. Specific examples of “p” include 2 and 3.
m: m represents an integer equal to or greater than 1. Specific examples of “m” include odd numbers and prime numbers equal to or greater than 3. In cryptography, values of 97, 167, 193, 239, 353 and 509 are commonly used as m, for example.
d: d represents an integer equal to or greater than 2.
L: L represents a positive even number.
N: N represents an integer equal to or greater than 2.
K: K represents an integer equal to or greater than 1.
i: i represents an element included in a set {0, . . . , N−1}.
k: k represents an element included in a set {0, . . . , K−1}.
GF(p): GF(p) represents a finite field whose order (number of elements) is p. The order p is a prime number, and therefore, the finite field GF(p) is a prime field. For example, the finite field GF(p) is formed by a remainder of division modulo p:
β mod p (6)
The calculation over the finite field GF(p) can be implemented simply by a remainder calculation modulo p, for example. A multiplication β*γ∈GF(p) over the finite field GF(p) can be implemented by (β*γ) mod p, and an addition β+γ∈GF(p) over the finite field GF(p) can be implemented by (β+γ) mod p.
GF(pm): For m≧2, GF(pm) represents an extension field whose order is pm, which is an m-th-order extension of the finite field GF(p). For m=1, GF(pm) represents a prime field that satisfies a relationship of GF(pm)=GF(p).
The extension field GF(pm), which is the m-th-order extension of the finite field GF(p), can be formed by a single-variable or multi-variable m-term polynomial whose indeterminate elements are roots of an irreducible polynomial over the finite field GF(p) and whose coefficients are elements of the finite field GF(p). For example, in the case where the extension field GF(pm) is formed by a single-variable polynomial, the extension field GF(pm) is formed by the following polynomial:
κ0+κ1·ω+ . . . +κm−1·ωm−1∈GF(pm) (7)
whose indeterminate elements ω∈GF(pm) are roots of an m-th-order
irreducible polynomial ipoly(ω)=0 over the finite field GF(p) and whose coefficients κ0, . . . , κm−1∈GF(p) are elements of the finite field GF(p). A specific example of mapping of elements of the finite field GF(p) to elements of the extension field GF(pm) is distortion mapping. The term “coefficient” used herein includes a coefficient of a constant term.
An addition over the extension field GF(pm) can be implemented as an addition of polynomials expressing the extension field GF(pm). However, an addition of coefficients in the addition of the polynomials is an addition over the finite field GF(p). For example, the result of an addition of κ0+κ1·ω+ . . . +κm−1·ωm−1∈GF(pm) and ν0+ν1·ω+ . . . +νm−1·ωm−1∈GF(pm) (ν0, . . . , νm−1∈GF(p)) is {(κ0+ν0)+(κ1+ν1)·ω+ . . . +(κm−1+νm−1)·ωm−1}∈GF(m). Note that (κ0+ν0)∈GF(p) and (κ1+ν1)∈GF(p), . . . and (Km−1+νm−1)∈GF(p).
A multiplication over the extension field GF(pm) can be implemented by taking a remainder of the product of polynomials expressing the extension field GF(pm) modulo an irreducible polynomial whose root is an indeterminate element of the polynomials. For example, a multiplication of κ0+κ1·ω+ . . . +κm−1·ωm−1∈GF(pm) and ν0+ν1·ω+ . . . +νm−1·ωm−1∈GF(pm) can be implemented by taking a remainder of (κ0+κ1·ω+ . . . +κm−1·ωm−1)·(ν0+ν1·ω+ . . . +νm−1·ωm−1) modulo an irreducible polynomial ipoly(ω). Specifically, the product over the extension field GF(pm) is an m-th or lower order polynomial obtained by substituting the irreducible polynomial ipoly(ω)=0 to (κ0+κ1·ω+ . . . +κm−1·ωm−1)·(ν0+ν1·ω+ . . . +νm−1·ωm−1).
GF(pd·m): GF(pd·m) represents a d-th-order extension field of the finite field GF(pm). The d-th-order extension field GF(pd·m) of the finite field GF(pm) can be formed by a single-variable or multi-variable d-term polynomial whose indeterminate elements are roots of an irreducible polynomial over the finite field GF(pm) and whose coefficients are elements of the finite field GF(pm). Although an example in which an extension field is formed by a single-variable polynomial has been described above, an example in which a sixth-order extension field is formed by a two-variable polynomial will be described here.
Supposing that σ∈GF(p6m) for roots c of an irreducible polynomial ipoly1(ω) over the finite field GF(pm), and ρ∈GF(p6m) for roots of an irreducible polynomial ipoly2(ρ) over the finite field GF(pm), elements of the finite field GF(p6m) are expressed by the following polynomial, whose coefficients a5, . . . , a0∈GF(pm) are elements of the finite field GF(pm).
a0+a1·ρ+a2·ρ2+a3·σ+a4·ρ·σ+a5·ρ2·σ∈GF(p6m) (8)
For p=3, a specific example of the polynomial ipoly1(σ)=0 is σ2+1=0, and a specific example of the polynomial ipoly2(σ)=0 is ρ3−ρ−b=0 (b∈{−1, 1}). A specific example of the mapping of elements of the finite field GF(pm) to elements of the extension field GF(p6m) is distortion mapping.
An addition over the d-th-order extension field GF(pd·m) can be implemented as an addition of polynomials expressing the d-th-order extension field GF(pd·m). However, an addition of coefficients in the addition of the polynomials is an addition over the finite field GF(pm). For example, the result of an addition of a0+a1·ρ+a2·ρ2+a3·σ+a4·ρ·σ+a5·ρ2·σ∈GF(p6m) and ν0+a1·ρ+ν2·ρ2+ν3·σ+ν4·ρ·σ+ν5·ρ2·σ∈GF(p6m) (ν5, . . . , ν0∈GF(pm)) is expressed as follows:
{(a0+ν0)+(a1+ν1)·ρ+(a2+ν2)·ρ2+(a3+ν3)·σ+(a4+ν4)·ρ·σ+(a5+ν5)·ρ2·σ}∈GF(p6m)
where (a0+ν0)∈GF(pm), and (a1+ν1)∈GF(pm), . . . , and (a5+ν5)∈GF(pm).
A multiplication over the d-th-order extension field GF(pd·m) can be implemented by taking a remainder of the product of polynomials expressing the d-th-order extension field GF(pd·m) modulo an irreducible polynomial whose root is an indeterminate element of the polynomials. For example, a multiplication of a0+a1·ρ+a2·ρ2+a3·σ+a4·ρ·σ+a5·ρ2·σ∈GF(p6m) and ν0+a1·ρ+ν2·ρ2+ν3·σ+ν4·ρ·σ+ν5·ρ2·σ∈GF(pm) can be implemented by taking a remainder of (a0+a1·ρ+a2·ρ2+a3·σ+a4·ρ·σ+a5·ρ2·σ)·(ν0+a1·ρ+ν2·ρ2+ν3·σ+ν4·ρ·σ+ν5·ρ2·σ) modulo an irreducible polynomial ipoly1(σ) or ipoly2(ρ). Specifically, the product over the extension field GF(p6m) is a sixth or lower order polynomial obtained by substituting the irreducible polynomial ipoly1(σ)=0 or ipoly2(ρ)=0 to the following formula.
(a0+a1·ρ+a2·ρ2+a3·σ+a4·ρ·σ+a5·ρ2·σ)·(ν0+a1·ρ+ν2·ρ2+ν3·σ+ν4·ρ·σ+ν5·ρ2·σ).
Note that input, calculation or output of a polynomial in any processing described below may be input, calculation or output of the polynomial itself including an indeterminate element and a coefficient or may be input, calculation or output of a vector comprising a coefficient that identifies the polynomial.
R(i, k): R(i, k) represents an element of the finite field GF(pm).
E: E represents an elliptic curve defined on the finite field GF(pm). The elliptic curve is defined as a set including a particular point O referred to as a point of infinity and a set of points (X, Y) that satisfy X and Y∈GF(pm) and the following Weierstrass equation in the affine coordinate system (A1, A2, A3, A4, A6∈GF(pm)):
Y
2
+A
1
·X·Y+A
3
·Y=X
3
+A
2
·X
2
+A
4
·X+A
6 (9)
Eb: Eb represents a supersingular elliptic curve that is defined on a finite field GF(3m) and expressed as follows.
Y
2
=X
3
−X+b(b∈{−1,1}) (10)
e(R(i, 0), . . . , R(i, K−1)): e(R(i, 0), . . . , R(i, K−1)) represents a calculation of K elements R(i, 0), . . . , R(i, K−1)∈GF(pm) of the finite field GF(pm) over a finite field. For K=4, a specific example of e(R(i, 0), . . . , R(i, K−1)) is a pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) where R(i, 0), R(i, 1), R(i, 2) and R(i, 3) are affine coordinate points X1[i], Y1[i], X2[i] and Y2[i]∈GF(pm), respectively, of two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) on the elliptic curve E defined on the finite field GF(pm). Specific examples of the pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) is pairing calculation in characteristic 3 (p=3), such as the Tate pairing, the ηT pairing calculation, the improved ηT pairing calculation or other, or pairing calculation in characteristic 2 (p=2).
[Summary]
Next, an embodiment will be summarized.
<Configuration>
As shown in
<Process>
Next, a process performed by the finite field calculation apparatus 1 according to this embodiment will be summarized.
When the finite field calculation apparatus 1 starts the process, N*K elements R(i, k)∈GF(pm) of the finite field GF(pm) are first input to the input part 10 and then passed to the finite field calculation part 20. On the assumption that a calculation of K elements R(i, 0), . . . , R(i, K−1)∈GF(pm) of the finite field GF(pm) over a finite field is expressed as e(R(i, 0), . . . , R(i, K−1)), the finite field calculation part 20 performs a calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) and passes the calculation result to the output part 30. The output part 30 outputs the received calculation result.
[Extension Field Calculation Included in Calculation e(R(i, 0), . . . , R(i, K−1))]
The calculation e(R(i, 0), . . . , R(i, K−1)) over the finite field GF(pm) includes, as a part thereof, an extension field calculation over the d-th-order extension field GF(pd·m) (d≧2) of the finite field GF(pm). The extension field calculation is a calculation that maps images on the finite field GF(pm) that depend on input one or more elements R(i, k)∈{R(i, 0), . . . , R(i, K−1)} of the finite field GF(pm) and/or the elements R(i, k)∈{R(i, 0), . . . , R(i, K−1)} to a polynomial poly (R(i, 0), . . . , R(i, K−1))∈GF(pd·m) that expresses elements of the d-th-order extension field GF(pd·m). That is, the extension field calculation is mapping from the finite field GF(pm) to the d-th-order extension field GF(pd·m).
For the polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) obtained by the extension field calculation, coefficients ah of some terms h∈{0, . . . , d−1} are images on the finite field GF(pm) that depend on one or more elements R(i, k) of the finite field GF(pm) and/or the elements R(i, k) of the finite field GF(pm), and coefficients ar of predetermined terms r∈{0, . . . , d−1} (r≠h) are previously determined to be 0∈GF(pm). Since the number of terms of the polynomial poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) that expresses elements of the d-th-order extension field GF(pd·m) is equal to or greater than 2 (d≧2), elements of the finite field GF(pm) can be mapped to a polynomial the coefficients of some of the terms of which are previously determined to be 0∈GF(pm).
A specific example of such an extension field calculation is a calculation over the sixth-order extension field GF(36m) according to the improved ηT pairing calculation algorithm described above. That is, the calculations according to the following formulas (11) and (12) are specific examples of the extension field calculation described above.
f=−y
1
·u+y
2
·σ+y
1
·ρ∈GF(36m) (11)
g=−u
2
+y
1
·y
2
·σ−u·ρ−ρ
2
∈GF(36m) (12)
These are examples in the case where p=3, d=6 and K=4 on the assumption that R(i, 0), R(i, 1), R(i, 2) and R(i, 3) are affine coordinate points X1, Y1, X2 and Y2∈GF(3m), respectively, of two points P(X1, Y1) and Q(X2, Y2) on the supersingular elliptic curve Eb (formula (10)), the affine coordinate points X1, Y1, X2 and Y2 or the images thereof are represented by x1, y1, x2 and y2∈GF(3m), u=x1+x2+c∈GF(3m), and the irreducible polynomials are σ2+1=0 and ρ3−ρ−b=0.
As described above, the maximum value of the number of terms of the polynomial that expresses the elements of the sixth-order extension field GF(pd·m) of the finite field GF(pm) is 6. However, the coefficients of the terms of the indeterminate elements ρ2, ρ·σ and ρ2·σ∈GF(p6m) of the polynomial f=−y1·u+y2·σ+y1·ρ∈GF(36m) are previously determined to be 0, and the coefficients of the terms of the indeterminate elements ρ·σand ρ2·σ∈GF(p6m) of the polynomial g=−u2+y1·y2·σ−u·ρ−ρ2∈GF(36m) are previously determined to be 0 (see formula (8)). That is, the formulas (11) and (12) can be expressed as the following formulas (13) and (14).
f=−y
1
·u+y
1·ρ+0·ρ2+y2·σ+0·ρ·σ+0·ρ2·σ∈GF(36m) (13)
g=−u
2
−u·ρ−ρ
2
+y
1
·y
2·σ+0·ρ·σ+0·ρ2·σ∈GF(36m) (14)
The distortion mapping described below is also an example of the extension field calculation having the characteristics described above.
−x2+ρ∈GF(36m) (15)
y2·σ∈GF(36m) (16)
The formulas (15) and (16) can be expressed as the following formulas (17) and (18).
−x2+ρ+0·ρ2+0·σ+0·ρ·σ+0·ρ2·σ∈GF(p6m) (17)
0+0·ρ+0·ρ2+y2·σ+0·ρ·σ+0·ρ2·σ∈GF(p6m) (18)
There are many other examples of the calculation that maps elements of a finite field GF(pm) having an order pm to a d-th-order extension field GF(pd·m) having an order pd·m (d≧2) greater than the order pm.
[Calculation Performed by Finite Field Calculation Part 20]
The extension field calculation included in the calculation e(R(i, 0), . . . , R(i, K−1)) described above is performed by the GF(pd·m) calculation part 22 in the finite field calculation part 20 shown in
First, images on the finite field GF(pm) that depend on one or more elements R(i1, k) (i1∈{0, . . . , N−1}) of the finite field GF(pm) and/or the elements R(i1, k) of the finite field GF(pm) are input to a calculation part 22-1 (first calculation part) in the GF(pd·m) calculation part 22. Note that the “images on the finite field GF(pm) that depend on one or more elements R(i1, k) of the finite field GF(pm)” are the result of calculation performed by any of the GF(pm) calculation parts 21 in the finite field calculation part 20. A specific example of the calculation result is the result of calculation over the finite field GF(3m) according to the improved ηT pairing calculation algorithm described above. That is, the following calculation result is a specific example of the “images on the finite field GF(pm) that depend on one or more elements R(i1, k) of the finite field GF(pm)”.
y
1
=−y
1
∈GF(3m) (19)
u=x
1
+x
2
+b∈GF(3m) (20)
u=x
1
+x
2
+c∈GF(3m) (21)
y
1
=−y
1
∈GF(3m) (22)
x
2
=x
2
9
∈GF(3m) (23)
y
2
=y
2
9
∈GF(3m) (24)
Note that these are examples on the assumption that elements R(i, 0), R(i, 1), R(i, 2) and R(i, 3) of the finite field GF(pm) are affine coordinate points X1, Y1, X2 and Y2∈GF(3m), respectively, of two points P(X1, Y1) and Q(X2, Y2) on the supersingular elliptic curve Eb (formula (10)), and the affine coordinate points X1, Y1, X2 and Y2 are or the images thereof are represented by x1, y1, x2 and y2∈GF(3m). There are many similar calculations over the finite field GF(pm).
The calculation part 22-1 performs the extension field calculation described above on the images on the finite field GF(pm) that depend on one or more elements R(i1, k) of the finite field GF(pm) and/or the elements R(i1, k) of the finite field GF(pm) and outputs the resulting polynomial:
poly(R(i1, 0), . . . , R(i1, K−1))∈GF(pd·m) (25)
Then, images on the finite field GF(pm) that depend on one or more elements R(i2, k) (i2∈{0, . . . , N−1} (i2≠i1)) of the finite field GF(pm) and/or the elements R(i2, k) of the finite field GF(pm) are input to a calculation part 22-2 (second calculation part) in the GF(pd·m) calculation part 22. Note that the “images on the finite field GF(pm) that depend on one or more elements R(i2, k) of the finite field GF(pm)” are the result of calculation performed by any of the GF(pm) calculation parts 21 in the finite field calculation part 20. The calculation part 22-2 performs the extension field calculation described above on these images or elements and outputs the resulting polynomial:
poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m) (26)
Then, the polynomials poly(R(i1, 0), . . . , R(i1, K−1)) and poly(R(i2, 0), . . . , R(i2, K−1)) described above are input to the calculation part 22-3 (third calculation part) in the GF(pd·m) calculation part 22. The calculation part 22-3 determines their product
poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m) (27)
and outputs the product poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1))∈GF(pd·m).
The calculation part 22-3 in this embodiment determines the product poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) without performing any calculation that involves as operands the terms of the polynomial poly(R(ii, 0), . . . , R(i1, K−1)) that are previously determined to be 0 ∈ GF(pm) and/or the terms of the polynomial poly(R(i2, 0), . . . , R(i2, K−1)) that are previously determined to be 0∈GF(pm). In the example shown in
The control part 23 makes the calculation parts 22-1 to 22-3 perform a loop process (horizontal loop) in which the series of processing stages are performed L/2 times while changing the values i1 and i2 in such a manner that each element of a subset including L (which represents an even number) different elements of the set {0, . . . , N−1} is used one time as i1 or i2. In other words, the control part 23 selects each element of a subset including L (which represents an even number) different elements of the set {0, . . . , N−1} one time as i1 and i2, and makes the calculation parts 22-1 to 22-3 perform the series of processing stages thereof one time for each pair of selected i1 and i2, thereby performing a loop process including the series of processing stages for the L/2 pairs (i1, i2). As required, the control part 23 makes the calculation parts perform, multiple times, the loop process that involves performing the series of processing stages L/2 times (vertical loop). This embodiment is most effective when N is an even number, L=N, and the subset described above is the set {0, . . . , N−1}.
In the example shown in
The product poly(R(ii, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) output from the calculation part 22-3 as a result of each series of processing stages is input to a calculation part 22-4 (fourth calculation part). Using these products, the calculation part 22-4 determines
Πi=0N−1poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) (28)
and outputs Πi=0N−1poly(R(i, 0), . . . , R(i, K−1)). For example, if N≧4, the calculation part 22-4 determines the multiplication value Πi=0N−1poly(R(i, 0), . . . , R(i, K−1))∈GF(pd·m) from the products poly(R(i1, 0), . . . , R(i2, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) output from the calculation part 22-3 as results of the series of processing stages.
Alternatively, the calculation part 22-4 may successively stores the products poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) output from the calculation part 22-3 as results of the series of processing stages in the memory 24 and calculate the multiplication value thereof after the products are completely calculated. From the viewpoint of saving of the capacity of the memory 24, however, the calculation part 22-4 preferably determines the multiplication value each time one series of processing stages is performed by multiplying the previous multiplication value (the initial value is 1, the multiplicative identity element) by the product poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) output from the calculation part 22-3. In other words, each time one series of processing stages is performed, the multiplication value of the products poly(R(i1, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) which have been obtained is preferably updated.
Next, a first embodiment of the present invention will be described.
This embodiment is an example in which the present invention is applied to the part of calculation of g of the improved ηT pairing calculation algorithm.
According to this embodiment, K=4, p=3, d=6, m is an odd number equal to or greater than 1, N is an even number equal to or greater than 4, L=N, elements R(i, 0), R(i, 1), R(i, 2) and R(i, 3) of the finite field GF(pm) are affine coordinate points X1[i], Y1[i], X2[i] and Y2[i]∈GF(pm), respectively, of two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) on the elliptic curve E defined on the finite field GF(pm), the calculation e(R(i, 0), . . . , R(i, K−1)) is a pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])), and the calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) is a multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])). Furthermore, according to embodiment, the elliptic curve is the supersingular elliptic curve Eb expressed by the formula (10) (b=−1 or 1). Furthermore, the extension field calculation according to this embodiment is a calculation that determines a polynomial that expresses elements of the sixth-order extension field GF(36m) of the finite field GF(3m)
g[i]=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (29)
where the affine coordinate points X1[i], Y1[i], X2[i] and Y2[i] input to the input part or the images thereof are represented by x1[i], y1[i], x2[i] and y2[i], respectively, u[i]=x1[i]+x2[i]+c∈GF(3m), the indeterminate element σ is a root of the irreducible polynomial σ2+1=0 whose coefficients are elements of the finite field GF(3m), and the indeterminate element ρ is a root of the irreducible polynomial ρ3−ρ−b=0.
<Configuration>
A finite field calculation apparatus according to the first embodiment is the finite field calculation apparatus shown in
As shown in
The finite field calculation part 120 is a special device that comprises a well-known or dedicated computer having a CPU, a RAM and a ROM, for example, and a special program. That is, the GF(3m) calculation parts 121-1 to 121-4, the GF(36m) calculation parts 122-1 to 122-9, the GF(3) calculation part 125 and the control part 123 are functional parts that are implemented by a predetermined program read in by the CPU, and the memory 124 is a RAM, a cache memory, a register or a hard disk, for example. At least a part of the finite field calculation part 120 may be formed by an integrated circuit.
<Process>
First, affine coordinate points X1[i], Y1[i], X2[i] and Y2[i]∈GF(pm) (i∈{0, . . . , N−1}) of two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) on the supersingular elliptic curve Eb, which are input values for each pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) forming the multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])), are input to the input part 10 (
[Processing Stages in Case where b=1 (S102 to S105)]
In the case where the supersingular elliptic curve Eb for b=1 is used, the processing stages in steps S102 to S105 are performed. In the case where the supersingular elliptic curve Eb for b=−1 is used, the processing stages in steps S102 to S105 are not performed.
First, the control part 123 sets i=0 and stores the setting in the memory 124 (step S102). Then, the GF(3m) calculation part 121-1 reads y1[i] from the memory 124, performs the following calculation over the finite field GF(3m)
y
1
[i]={−y
1
[i]}∈GF(3m) (30)
and stores the calculation result in the memory 124 as a new y1[i] (step S103).
Then, the control part 123 determines whether or not i=N−1 (step S104). If it is not determined that i=N−1, the control part 123 sets i+1 as a new i and stores the setting in the memory 124, and the process returns to step S103 (step S105). If it is determined that i=N−1, the processing stages in the case where b=1 (steps S102 to S105) are completed (this is the end of the description of [Processing stages in Case Where b=1 (S102 to S105)]).
Then, the GF(36m) calculation part 122-7 (which forms a fifth calculation part) reads x1[0], y1[0], x2[0] and y2[0]∈GF(3m) from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f=−y
1[0]·(x1[0]+x2[0]+b)+y2[0]·σ+y1[0]·ρ∈GF(36m) (31)
and stores the calculation result f∈GF(36m) in the memory 124 (step S106).
Then, the GF(36m) calculation part 122-7 reads x1[1], y1[1], x2[1] and y2[1]∈GF(3m) from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f′=−y
1[1]·(x1[1]+x2[1]+b)+y2[1]·σ+y1[1]·ρ∈GF(36m) (32)
and stores the calculation result f′∈GF(36m) in the memory 124. Furthermore, the GF(36m) calculation part 122-8 reads the calculation results f and f′ from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f=f·f′∈GF(36m) (33)
and stores the calculation result in the memory 124 as a new f∈GF(36m) (step S107).
Then, the control part 123 sets i=2 and stores the setting in the memory 124 (step S108).
Then, the GF(36m) calculation part 122-7 reads x1[1], y1[1], x2[1] and y2[1]∈GF(3m) from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f′=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (34)
and stores the calculation result in the memory 124 as a new f′∈GF(36m) (step S109).
Then, the GF(36m) calculation part 122-8 (which forms the fifth calculation part) reads the calculations results f and f′ from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f=f·f′ ∈GF(36m) (35)
and stores the calculation result in the memory 124 as a new f∈GF(36m) (step S110).
Then, the control part 123 determines whether or not i=N−1 (step S111). If it is not determined that i=N−1, the control part 123 sets i+1 as a new i and stores the setting in the memory 124, and the process returns to step S109 (step S113). If it is determined that i=N−1, the control part 123 sets b as an initial value of c(c=b) and stored the setting in the memory 124 (step S112).
The processing stages in steps S106 to S110 performed before it is determined that i=N−1 in step S111 correspond to a process of performing a calculation f=Πi=0N−1(−y1[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ)∈GF(36m) where x1[i]=X1[i], y1[i]=Y1[i], x2[i]=X2[i] and y2[i]=Y2[i] and outputting the calculated f in the case where b=−1, and a process of performing the calculation f=Πi=0N−1(−y1[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ)∈GF(36m) where x1[i]=X1[i], y1[i]=−Y1[i], x2[i]=X2[i] and y2[i]=Y2[i] and outputting the calculated f in the case where b=1.
Then, the control part 123 sets j=0 and stores the setting in the memory 124 (step S114). Furthermore, the control part 123 sets i=0 and stores the setting in the memory 124 (step S115).
Then, the GF(3m) calculation part 121-2 reads x1[i], x2[i] and c from the memory 124, perform the following calculation over the finite field GF(3m)
u[i]=x
1
[i]+x
2
[i]+c∈GF(3m) (36)
and stores the calculation result u[i] in the memory 124 (step S116).
Then, the control part 123 determines whether or not i=N−1 (step S117). If it is not determined that i=N−1, the control part 123 sets i+1 as a new i and stores the setting in the memory 124, and the process returns to step S116 (step S118).
If it is determined that i=N−1, the GF(36m) calculation part 122-1 (first calculation part) reads y1[0], y2[0] and u[0]∈GF(3m) (i1=0) from the memory 124, performs the following calculation
g[0]=−{u[0]}2+y1[0]·y2[0]·σ−u[0]·ρ−ρ2∈GF(36m) (37)
and stores the calculation result g[0]∈GF(36m) in the memory 124 (step S119).
Furthermore, the GF(36m) calculation part 122-2 (second calculation part) reads y1[1], y2[1] and u[1]∈GF(3m) (i2=1) from the memory 124, performs the following calculation
g[1]=−{u[1]}2+y1[1]·y2[1]·σ−u[1]·ρ−ρ2∈GF(36m) (38)
and stores the calculation result g[1]∈GF(36m) in the memory 124 (step S120).
Then, the GF(36m) calculation part 122-3 (third calculation part) reads the calculation results g[0]∈GF(36m) and g[1]∈GF(36m) from the memory 124, performs the following calculation
g=g[0]·g[1]∈GF(36m) (39)
and stores the calculation result g∈GF(36m) in the memory 124 (step S121). Note that the GF(36m) calculation part 122-3 determines the product g[0]·g[1] ∈ GF(36m) without performing any calculation that involves as operands the terms, being previously determined to be 0∈GF(pm), of the calculation result g[0] and/or the calculation result g[1].
Then, the GF(3m) calculation part 121-1 reads y1[0] from the memory 124, performs the following calculation over the finite field GF(3m)
y
1[0]={−y1[0]}∈GF(3m) (40)
and stores the calculation result in the memory 124 as a new y1[0] (step S122).
Then, the GF(3m) calculation part 121-3 reads x2[0] from the memory 124, performs the following calculation over the finite field GF(3m)
x
2[0]={x2[0]}9∈GF(3m) (41)
and stores the calculation result in the memory 123 as a new x2[0] (step S123). Note that this calculation is performed using a Frobenius map, for example (the same holds true for the 3χ multiplication (χ represents an integer equal to or greater than 1) described later).
Then, the GF(3m) calculation part 121-3 reads y2[0] from the memory 124, performs the following calculation over the finite field GF(3m)
y
2[0]={y2[0]}9∈GF(3m) (42)
and stores the calculation result in the memory 123 as a new y2[0] (step S124).
Then, the GF(3m) calculation part 121-1 reads y1[1] from the memory 124, performs the following calculation over the finite field GF(3m)
y
1[1]={−y1[1]}∈GF(3m) (43)
and stores the calculation result in the memory 124 as a new y1[1] (step S125).
Then, the GF(3m) calculation part 121-3 reads x2[1] from the memory 124, performs the following calculation over the finite field GF(3m)
x
2[1]={x2[1]}9∈GF(3m) (44)
and stores the calculation result in the memory 123 as a new x2[1] (step S126).
Then, the GF(3m) calculation part 121-3 reads y2[1] from the memory 124, performs the following calculation over the finite field GF(3m)
y
2[1]={y2[1]}9∈GF(3m) (45)
and stores the calculation result in the memory 123 as a new y2[1] (step S127).
Then, the control part 123 sets i=2 and stores the setting in the memory 124 (step S128).
Then, the GF(36m) calculation part 122-1 (first calculation part) reads y1[i], y2[i] and u[i]∈GF(3m) (ii=i) from the memory 124, performs the following calculation
g[i]=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (46)
and stores the calculation result g[i]∈GF(36m) in the memory 124 (step S129).
In addition, the GF(36m) calculation part 122-2 (second calculation part) reads y1[i+1], y2[i+1] and u[i+1]∈GF(3m) (i2=i+1) from the memory 124, performs the following calculation
g[i+1]=−{u[i+1]}2+y1[i+1]·y2[i+1]·σ−u[i+1]·ρ−ρ2∈GF(36m) (47)
and stores the calculation result g[i+1]∈GF(36m) in the memory 124 (step S130).
Then, the GF(36m) calculation part 122-3 (third calculation part) reads the calculation results g[i]∈GF(36m) and g[i+1]∈GF(36m) from the memory 124, performs the following calculation
g[i]·g[i+1]∈GF(36m) (48)
and stores the calculation result g[i]·g[i+1]∈GF(36m) in the memory 124 (step S131). Note that the GF(36m) calculation part 122-3 determines the product g[i]·g[i+1]∈GF(36m) without performing any calculation that involves as operands the terms, being previously determined to be 0∈GF(pm), of the calculation result g[i] and/or the calculation result g[i+1].
Then, the GF(36m) calculation part 122-3 (fourth calculation part) reads g and g[i]·g[i+1]∈GF(36m) from the memory 124, performs the following calculation
g=g·g[i]·g[i+1]∈GF(36m) (49)
and stores the calculation result in the memory 124 as a new g∈GF(36m) (step S132).
As described above, each time the GF(36m) calculation part 122-1 (first calculation part), the GF(36m) calculation part 122-2 (second calculation part) and the GF(36m) calculation part 122-3 (third calculation part) perform the series of processing stages thereof, the GF(36m) calculation part 122-3 (fourth calculation part) according to this embodiment determines the multiplication value of the products g[i]·g[i+1] output from the GF(36m) calculation part 122-3 (third calculation part). As described above, this allows saving of the capacity of the memory 124.
Then, the GF(3m) calculation part 121-1 reads y1[i] from the memory 124, performs the following calculation over the finite field GF(3m)
y1[i]={−y[i]}∈GF(3m) (50)
and stores the calculation result in the memory 124 as a new y1[i] (step S133).
Then, the GF(3m) calculation part 121-3 reads x2[i] from the memory 124, performs the following calculation over the finite field GF(3m)
x
2
[i]={x
2
[i]}
9
∈GF(3m) (51)
and stores the calculation result in the memory 123 as a new x2[i] (step S134).
Then, the GF(3m) calculation part 121-3 reads y2[i] from the memory 124, performs the following calculation over the finite field GF(3m)
y
2
[i]={y
2
[i]}
9
∈GF(3m) (52)
and stores the calculation result in the memory 123 as a new y2[i] (step S135).
Then, the GF(3m) calculation part 121-1 reads y1[i+1] from the memory 124, performs the following calculation over the finite field GF(3m)
y
1
[i+1]={−y1[i+1]}∈GF(3m) (53)
and stores the calculation result in the memory 124 as a new y1[i+1] (step S136).
Then, the GF(3m) calculation part 121-3 reads x2[i+1] from the memory 124, performs the following calculation over the finite field GF(3m)
x
2
[i+1]={x2[i+1]}9∈GF(3m) (54)
and stores the calculation result in the memory 123 as a new x2[i+1] (step S137).
Then, the GF(3m) calculation part 121-3 reads y2[i+1] from the memory 124, performs the following calculation over the finite field GF(3m)
y
2
[i+1]={y2[i+1]}9∈GF(3m) (55)
and stores the calculation result in the memory 123 as a new y2[i+1] (step S138).
Then, the control part 123 determined whether or not i=N−2 (step S139). If it is not determined that i=N−2, the control part 123 sets i+2 as a new i and stores the setting in the memory 124, and the process returns to step S129 (step S140).
If it is determined that i=N−2, the GF(3) calculation part 125 reads c from the memory 124, performs the following calculation
c=(c−b) mod 3 (56)
and stores the calculation result in the memory 124 as a new c (step S141).
Then, the GF(36m) calculation part 122-5 (tenth calculation part) reads f and g from the memory 124, performs the following calculation
f=f·g∈GF(36m) (57)
and stores the calculation result in the memory 124 as a new f (step S142).
Then, the GF(36m) calculation part 122-5 (eleventh calculation part) reads f from the memory 124, performs the following calculation
f=f
3
∈GF(36m) (58)
and stores the calculation result in the memory 124 as a new f (step S143).
The processing stages in steps S141 to S143 are performed each time the “loop process (steps S115 to S140)”, in which the “series of processing stages” performed by the GF(36m) calculation part 122-1 (first calculation part), the GF(36m) calculation part 122-2 (second calculation part) and the GF(36m) calculation part 122-3 (third calculation part) is performed N/2 times, is performed.
Then, the control part 123 determined whether or not j=(m−1)/2 (step S144). If it is not determined that j=(m−1)/2, the control part 123 sets j+1 as a new j and stores the setting in the memory 124, and the process returns to step S115 (step S145). If it is determined that j=(m−1)/2, the “loop process (steps S115 to S140)” is completed. That is, if m=1, the “loop process (steps S115 to S140)”, in which the “series of processing stages” is performed N/2 times, is performed only one time. If m≧3, the “loop process (steps S115 to S140)”, in which the “series of processings” is performed N/2 times, is performed multiple times.
When the “loop process” is completed, the GF(36m) calculation part 122-9 reads f from the memory 124, performs the following calculation (step S146)
output=ffinalpow∈GF(36m) (59)
[finalpow=(33m−1) (3m+1) (3m−3(m+1)/2+1)]
and outputs the calculation result output∈GF(36m) (steps S147). The calculation result output∈GF(36m) is the calculation result of the multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])). The calculation result output∈GF(36m) is output from the output part 30 (
As described above, according to this embodiment, the following polynomials for calculating each pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) forming the multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])) are determined.
g[i]=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (60)
g[i+1]=−{u[i+1]}2+y1[i+1]·y2[i+1]·σ−u[i+1]·ρ−ρ2∈GF(36m) (61 )
Then, the product thereof is determined as follows.
g[i]·g[i+1]∈GF(36m) (62)
Then, the following calculation is performed using the products (steps S119 to S121, steps S129 to S132).
g=Π
i=0
N−1
g[i]∈GF(36m) (63)
Note that the coefficients of the terms of the indeterminate elements ρ·σ∈GF(p6m) and ρ2·σ∈GF(p6m) of the polynomials (60) and (61) that express the sixth-order extension field GF(36m) are previously determined to be 0. Since the product of such polynomials is calculated in advance, the terms whose coefficients are previously determined to be 0 do not have to be calculated, and therefore, the number of multiplications can be reduced.
In the following, an algorithm according to this embodiment and the number of multiplications involved with the algorithm will be provided. Note that θM
represents θ multiplications, and
θC
represents θ cubic calculations.
1M
1M
6M
1M
15M
2M
2M
6M
2C
2C
2C
2C
2M
2M
6M
15M
2C
2C
2C
2C
15M
6C
As described above, according to this embodiment, g[0] and g[1] are determined according to the formulas (64) and (65), and then the product thereof is determined according to the formula (66). And g[i] and g[i+1] are determined according to the formulas (67) and (68), and then the product thereof is determined according to the formula (70). As a result, the calculation amount can be substantially reduced compared with the case where cumulative multiplication of g and g[i] according to the formula g=g·g[i] is performed each time g[i] is calculated. Since g[0], g[1], g[i] and g[i+1] are polynomials the coefficients of some of the terms of which are 0, the number of multiplications thereof is 6M. However, in the case where cumulative multiplication of g and g[i] according to the formula g=g·g[i] is performed each time g[i] is calculated, the cumulative multiplications involve 15M multiplications because the coefficient of every term of g can assume a value other than 0 except for those involved with the first multiplication. For example, as for the number of multiplications involved with the formulas (67) to (70), the number of calculations required in the method according to the present application is 25M (2M+2M+6M+15M), whereas the method of performing cumulative multiplication according to the formula requires 34M ((2M+15M)×2) calculations in the case where cumulative multiplication of g and g[i] according to the formula g=g·g[i] is performed each time g[i] is calculated. In this way, the number of multiplications can be substantially reduced by performing the calculations in the order according to this embodiment.
[Number of Multiplications in Algorithm (b=1) According to Extension of Prior Art]
As described above, the prior-art literatures 1 and 2 disclose no methods for efficient calculation of the product of a plurality of pairings. In the following, it will be shown that the calculation amount cannot be reduced more substantially than this embodiment even if the improved ηT pairing calculation algorithm disclosed in the prior-art literature 1 is simply extend to the multi-pairing calculation.
The following is the improved ηT pairing calculation algorithm disclosed in the prior-art literature 1 simply extended to the multi-pairing calculation. Note that the following description is intended to explain the characteristics of this embodiment but not to show that the algorithm described below for comparison was able to be easily invented at the time of application of the present invention.
1M
1M
6M
1M
15M
2M
2C
2C
2M
6M
2C
2C
14M
2C
2C
15M
6C
As described above, if the improved ηT pairing calculation algorithm disclosed in the prior-art literature 1 is simply extended to the multi-pairing calculation, 14M calculations are required for each value of i according to the formula (74), and 28M calculations are required for two values of i.
[Number of Multiplications in Algorithm (b=1) Based on Loop Unrolling]
As described above, the prior-art literature 2 discloses no method for efficient calculation of the product of a plurality of pairings. However, the prior-art literature 2 discloses an algorithm based on the loop unrolling. In the following, it will be shown that the calculation amount cannot be reduced more substantially than this embodiment even if the concept of the algorithm based on the loop unrolling disclosed in the prior-art literature 2 is extend to the multi-pairing calculation.
The above polynomial −{u[i]}2+y1[i]·y2[i]·σ−u[i]·ρ−ρ2 has to be calculated for each of different pairings for different values of i and has to be calculated {(m−1)/2}+1 times in the loops for j=0 to (m−1)/2 for each of the pairings. According to the method according to this embodiment, the polynomials −{u[i]}2+y1[i]·y2[i]·σ−u[i]·ρ−ρ2 are separately determined for different pairings for different values of i, respectively, and the product thereof is determined. To the contrary, according to the concept based on the loop unrolling disclosed in the prior-art literature 2, the product of a plurality of polynomials −{u[i]}2+y1[i]·y2[i]·σ−u[i]·ρ−ρ2 calculated in the loops for j=0 to (m−1)/2 for the one of the pairings is determined.
The following is the algorithm based on the loop unrolling disclosed in the prior-art literature 2 extended to the multi-pairing calculation (unpublished). Note that the following description is intended to explain the characteristics of this embodiment but not to show that the algorithm described below for comparison was able to be easily invented at the priority data of this application or at the time of application of the present invention.
1M
1M
6M
1M
15M
2M
2C
2C
2M
6M
2C
2C
2M
2C
2C
2M
6M
15M
2C
2C
15M
6C
As described above, according to this algorithm, g1[0] and g2[0] for the same value i=0 are determined according to the formulas (75) and (77), and then, the product thereof is determined according to the formula (74). And g1[i] and g2[i] for the same values i=1, . . . , N−1 are determined according to the formulas (75) and (77), and then, the product thereof is determined according to the formula (82). According to this algorithm, however, cubic calculations in the formulas (76) and (80) are needed. This is because, although one calculation of f=f3 would otherwise be performed for each of the loops for j=0 to (m−1)/2, the algorithm based on the loop unrolling requires the cubic calculations of the formulas (76) and (80), which correspond to the one calculation of f=f3, to be performed for each value of i=0, . . . , N−1 in the loops, because each pair of loops for j is combined into one loop in the algorithm.
According to the algorithm according to this embodiment, the cubic calculations are performed as f=f3 outside the loops for j=0 to (m−1)/2, and therefore, the calculation amount can be reduced compared with the algorithm that extends the concept of the loop unrolling to the multi-pairing calculation.
The first embodiment concerns a case where N is an even number equal to or greater than 4. A modification of the first embodiment described below concerns a case where N is an odd number equal to or greater than 5.
According to this modification of the first embodiment, after the processing in step S138 described in the first embodiment, the control part 123 determines whether or not i=(N−1)−2 (step S159). If it is not determined that i=(N−1)−2, the control part 123 sets i+2 as a new i and stores the setting in the memory 124, and the process returns to step S129 (step S140).
If it is determined that i=(N−1)−2, the control part 123 sets i+2 as a new i and stores the setting in the memory 124 (step S160).
Then, the GF(36m) calculation part 122-1 reads y1[i], y2[i] and u[i] ∈ GF(3m) from the memory 124, performs the following calculation
g[i]=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (84 )
and stores the calculation result g[i]∈GF(36m) in the memory 124 (step S161).
Then, the GF(36m) calculation part 122-3 reads g∈GF(36m) and g[i]∈GF(36m) from the memory 124, performs the following calculation
g=g·g[i]∈GF(36m) (85)
and stores the calculation result in the memory 124 as a new g∈GF(36m) (step S162). Then, the processing stages in step S141 and the following steps described in the first embodiment are performed.
Next, a second embodiment of the present invention will be described.
The first embodiment is an example in which the present invention is applied to the part of calculation of g of the improved ηT pairing calculation algorithm. According to the second embodiment, the present invention is applied to the parts of calculation of both f and g of the improved ηT pairing calculation algorithm. This allows further reduction of the calculation amount.
According to this embodiment, K=4, p=3, d=6, m is an odd number equal to or greater than 1, N is an even number equal to or greater than 4, W=N, elements R(i, 0), R(i, 1), R(i, 2) and R(i, 3) of the finite field GF(pm) are affine coordinate points X1[i], Y1[i], X2[i] and Y2[i]∈GF(pm), respectively, of two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) on the elliptic curve E defined on the finite field GF(pm), the calculation e(R(i, 0), . . . , R(i, K−1)) is a pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])), and the calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) is a multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])). Furthermore, according to this embodiment, the elliptic curve is the supersingular elliptic curve Eb expressed by the formula (10) (b=−1 or 1). Furthermore, the extension field calculation according to this embodiment is a calculation that determines polynomials that express elements of the sixth-order extension field GF(36m) of the finite field GF(3m)
f[i]=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (86)
g[i]=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (87)
where the affine coordinate points X1[i], Y1[i], X2[i] and Y2[i] input to the input part or the images thereof are represented by x1[i], y1[i], x2[i] and y2[i], respectively, u[i]=x1[i]+x2[i]+c∈GF(3m), the indeterminate element σ is a root of the irreducible polynomial σ2+1=0 whose coefficients are elements of the finite field GF(3m), and the indeterminate element ρ is a root of the irreducible polynomial ρ3−ρ−b=0. The following description will be focused mainly on differences from the first embodiment, and descriptions of things common to those in the first embodiment will be omitted.
<Configuration>
A finite field calculation apparatus according to the second embodiment is the finite field calculation apparatus shown in
As shown in
The finite field calculation part 220 is a special device that comprises a well-known or dedicated computer having a CPU, a RAM and a ROM, for example, and a special program. For example, the GF(36m) calculation parts 222-1 to 222-5 are functional parts that are implemented by a predetermined program read in by the CPU. At least a part of the finite field calculation part 220 may be formed by an integrated circuit.
<Process>
First, the processing stages in steps S101 to S105 described in the first embodiment are performed. Note that, as in the first embodiment, the processing stages in steps S102 to S105 are unnecessary when b=−1.
Then, the GF(36m) calculation part 222-1 (first calculation part or sixth calculation part) reads x1[0], y1[0], x2[0] and y2[0]∈GF(3m) (i3=0) from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f[0]=−y1[0]·(x1[0]+x2[0]+b)+y2[0]·σ+y1[0]·ρ ∈]GF(36m) (88)
and stores the calculation result f[0]∈GF(36m) in the memory 124 (step S206).
Then, the GF(36m) calculation part 222-1 (second calculation part or seventh calculation part) reads x1[1], y1[1], x2[1] and y2[1]∈GF(3m) (i4=1) from the memory 124, performs the following calculation over the sixth-order extension field GF(36m)
f[1]=−y1[1]·(x1[1]+x2[1]+b)+y2[1]·σ+y1[1]·ρ ∈]GF(36m) (89)
and stores the calculation result f[1]∈GF(36m) in the memory 124 (step S207).
Then, the GF(36m) calculation part 222-3 (third calculation part or eighth calculation part) reads the calculation results f[0]∈GF(36m) and f[1]∈GF(36m) from the memory 124, performs the following calculation
f=f[0]·f[1]∈GF(36m) (90)
and stores the calculation result f∈GF(36m) in the memory 124 (step S208). Note that the GF(36m) calculation part 222-3 determines a product f[0]·f[1]∈GF(36m) without performing any calculation that involves as operands the terms, being previously determined to be 0∈GF(pm), of the calculation result f[0] and/or the calculation result f[1].
Then, the control part 123 sets i=2 and stores the setting in the memory 124 (step S209).
Then, the GF(36m) calculation part 222-1 reads y1[i], y2[i], x2[i] and y2[i]∈GF(3m) (i3=i) from the memory 124, performs the following calculation
f[i]=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (91)
and stores the calculation result g[i]∈GF(36m) in the memory 124 (step S210).
In addition, the GF(36m) calculation part 222-2 reads y1[i+1], y2[i+1], x2[i+1] and y2[i+1]∈GF(3m) (i4=i+1) from the memory 124, performs the following calculation
f[i+1]=−y1[i+1]·(x1[i+1]+x2[i+1]+b)+y2[i+1]·σ+y1[i+1]·ρ∈GF(36m) (92)
and stores the calculation result f[i+1]∈GF(36m) in the memory 124 (step S211).
Then, the GF(36m) calculation part 222-3 reads the calculation results f[i]∈GF(36m) and f[i+1]∈GF(36m) from the memory 124, performs the following calculation
f[i]·f[i+1]∈GF(36m) (93)
and stores the calculation result f[i]·f[i+1]∈GF(36m) in the memory 124 (step S212). Note that the GF(36m) calculation part 222-3 determines a product f[i]·f[i+1]∈GF(36m) without performing any calculation that involves as operands the terms, being previously determined to be 0∈GF(pm), of the calculation result f[i] and/or the calculation result f[i+1].
Then, the GF(36m) calculation part 222-4 (fourth calculation part or ninth calculation part) reads f∈GF(36m) and f[i]·f[i+1]∈GF(36m) from the memory 124, performs the following calculation
f=f·f[i]·f[i+1]∈GF(36m) (94)
and stores the calculation result in the memory 124 as a new f∈GF(36m) (step S213).
Then, the control part 123 determines whether or not i=−2 (step S214). If it is not determined that i=N−2, the control part 214 sets i+2 as a new i and stores the setting in the memory 124, and the process returns to step S210 (step S215).
If it is determined that i=N−2, the processing stages in step S112 and the following steps in the first embodiment are performed.
As described above, according to this embodiment, in addition to the improved calculation of g[i] and g[i+1] described in the first embodiment, the following polynomials are determined.
f[i]=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (95)
f[i+1]=−y1[i+1]·(x1[i+1]+x2[i+1]+b)+y2[i+1]·σ+y1[i+1]·ρ∈GF(36m) (96)
Then, the product thereof is determined as follows.
f[i]·f[i+1]∈GF(36m) (97)
Then, the following calculation is performed using the product (steps S206 to S208, steps S210 to S213).
f=Π
i=0
N−1
f[i]∈GF(36m) (98)
Note that the coefficients of the terms of the indeterminate elements ρ2∈GF(p6m), ρ·σ∈GF(p6m) and ρ2·σ∈GF(p6m) of the polynomials (95) and (96) that express the sixth-order extension field GF(36m) are previously determined to be 0. Since the product of such polynomials is calculated in advance, the terms whose coefficients are previously determined to be 0 do not have to be calculated, and therefore, the number of multiplications can be reduced.
The second embodiment concerns a case where N is an even number equal to or greater than 4. A modification of the second embodiment described below concerns a case where N is an odd number equal to or greater than 5.
According to this modification of the second embodiment, after the processing in step S213 described in the second embodiment, the control part 123 determines whether or not i=(N−1)−2 (step S254). If it is not determined that i=(N−1)−2, the control part 123 sets i+2 as a new i and stores the setting in the memory 124, and the process returns to step S210 (step S215).
If it is determined that i=(N−1)−2, the control part 123 sets i+2 as a new i and stores the setting in the memory 124 (step S255).
Then, the GF(36m) calculation part 222-1 reads y1[i], y2[i], x2[i] and y2[i]∈GF(3m) (i3=i) from the memory 124, performs the following calculation
f[i]=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (86)
and stores the calculation result g[i]∈GF(36m) in the memory 124 (step S256).
Then, the GF(36m) calculation part 222-4 reads f∈GF(36m) and f[i]∈GF(36m) from the memory 124, performs the following calculation
f=f·f[i]∈GF(36m) (100)
and stores the calculation result in the memory 124 as a new f∈GF(36m) (step S257). Then, the processing stages in step S112 and the following steps described in the first embodiment are performed.
Next, a third embodiment of the present invention will be described.
The first embodiment is an example in which the present invention is applied to the part of calculation of g of the improved ηT pairing calculation algorithm. According to the second embodiment, the present invention is applied to only the part of calculation of f of the improved ηT pairing calculation algorithm.
According to this embodiment, K=4, p=3, d=6, m is an odd number equal to or greater than 1, N is an even number equal to or greater than 4, L=N, elements R(i, 0), R(i, 1), R(i, 2) and R(i, 3) of the finite field GF(pm) are affine coordinate points X1[i], Y1[i], X2[i] and Y2[i]∈GF(pm), respectively, of two points P(X1[i], Y1[i]) and Q(X2[i], Y2[i]) on the elliptic curve E defined on the finite field GF(pm), the calculation e(R(i, 0), . . . , R(i, K−1)) is a pairing calculation e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])), and the calculation Πi=0N−1e(R(i, 0), . . . , R(i, K−1)) is a multi-pairing calculation Πi=0N−1e(P(X1[i], Y1[i]), Q(X2[i], Y2[i])). Furthermore, according to this embodiment, the elliptic curve is the supersingular elliptic curve Eb expressed by the formula (10) (b=−1 or 1). Furthermore, the extension field calculation according to this embodiment is a calculation that determines a polynomial that expresses elements of the sixth-order extension field GF(36m) of the finite field GF(3m)
f[i]=−y
1
[i]·(x1[i]+x2[i]+b)+y2[i]·σ+y1[i]·ρ∈GF(36m) (101)
where the affine coordinate points X1[i], Y1[i], X2[i] and Y2[i] input to the input part or the images thereof are represented by x1[i], y1[i], x2[i] and y2[i], respectively, u[i]=x1[i]+x2[i]+c∈GF(3m), the indeterminate element σ is a root of the irreducible polynomial σ2+1=0 whose coefficients are elements of the finite field GF(3m), and the indeterminate element ρ is a root of the irreducible polynomial ρ3−ρ−b=0. The following description will be focused mainly on differences from the first embodiment, and descriptions of things common to those in the first embodiment will be omitted.
<Configuration>
A finite field calculation apparatus according to the third embodiment is the finite field calculation apparatus shown in
As shown in
The finite field calculation part 320 is a special device that comprises a well-known or dedicated computer having a CPU, a RAM and a ROM, for example, and a special program. For example, the GF(36m) calculation parts 322-1 and 322-2 are functional parts that are implemented by a predetermined program read in by the CPU. At least a part of the finite field calculation part 320 may be formed by an integrated circuit.
<Process>
First, the processing stages in steps S101 to S105 and S206 to S215 described in the second embodiment (
g=−{u[0]}2+y1[0]·y2[0]·σ−u[0]·ρ−ρ2∈GF(36m) (102)
and stores the calculation result g∈GF(36m) in the memory 124 (step S319).
Then, the GF(36m) calculation part 322-1 reads y1[1]∈GF(3m), y2[1]∈GF(3m) and u[1]∈GF(3m) (i1=1) from the memory 124, performs the following calculation
g′=−{u[1]}2+y1[1]·y2[1]·σ−u[1]·ρ−ρ2∈GF(36m) (103)
and stores the calculation result g′∈GF(36m) in the memory 124. Furthermore, the GF(36m) calculation part 322-2 reads g∈GF(36m) and g′∈GF(36m) from the memory 124, performs the following calculation
g=g·g′∈GF(36m) (104)
and stores the calculation result in the memory 124 as a new g (step S321).
Then, the control part 123 sets i=2 and stores the setting in the memory 124 (step S128).
Then, the GF(36m) calculation part 322-1 reads y1[i]∈GF(3m), y2[i]∈GF(3m) and u[i]∈GF(3m) (i1=i) from the memory 124, performs the following calculation
g′=−{u[i]}
2
+y
1
[i]·y
2
[i]·σ−u[i]·ρ−ρ
2
∈GF(36m) (105)
and stores the calculation result in the memory 124 as a new g′∈GF(36m) (step S329).
Then, the GF(36m) calculation part 322-2 reads the calculation results g∈GF(36m) and g′∈GF(36m) from the memory 124, performs the following calculation
g=g·g′∈GF(36m) (106)
and stores the calculation result in the memory 124 as a new g (step S330).
Then, the processing stages in step S133 and the following steps in the first embodiment are performed.
[Other Modifications]
Note that the present invention is not limited to the embodiments described above. For example, in the embodiments described above, i1=0 and i2=1, i1=i and i2=i+1, i3=0 and i4=1, and i3=i and i4=i+1. However, other values of i1, i2, i3 and i4∈{0, . . . , N−1} can also be used as far as i1 differs from i2, and i3 differs from i4. That is, a loop process can be performed in which the series of processing stages performed by the first calculation part, the second calculation part and the third calculation part is performed L/2 times while changing i1 and i2 in such a manner that each element of a subset including L (which represents an even number) different elements of the set {0, . . . , N−1} is used one time as i1 or i2, and the series of processing stages performed by the sixth calculation part, the seventh calculation part and the eighth calculation part can be performed W/2 times while changing i3 and i4 in such a manner that each element of a subset comprising W (which represents a positive even number) different elements of the set {0, . . . , N−1} is used one time as i3 or i4. In other words, each element of a subset including L (which represents an even number) different elements of the set {0, . . . , N−1} is selected one time as i1 or i2, and first processing stages, each of which includes processing stages performed by the first calculation part, the second calculation part and the third calculation part are performed one time for each pair of selected i1 and i2, thereby performing the first processing stages for the L/2 pairs (i1, i2), respectively. And, each element of a subset comprising W (which represents a positive even number) different elements of the set {0, . . . , N−1} is selected one time as i3 or i4, and second processing stages, each of which includes processing stages performed by the sixth calculation part, the seventh calculation part and the eighth calculation part one time for each pair of selected i3 and i4, thereby performing the second processing stages for the W/2 pairs (i3, i4), respectively.
Furthermore, with regard to the embodiments described above, configurations in which N is an even number equal to or greater than 4 and L=N and/or W=N and in which N is an odd number equal to or greater than 5 and L=N−1 and/or W=N−1 have been described. However, other positive even numbers smaller than N may be L and/or W. In that case, the processing for i to which the method according to the present invention is not applied can be performed by repeating the cumulative calculation in steps S161 and S162 shown in
In the embodiments described above, it is assumed that the parameters, such as b, are previously set. However, the parameters may be input to the apparatus.
In the embodiments described above, it is assumed that the product poly(R(ii, 0), . . . , R(i1, K−1))·poly(R(i2, 0), . . . , R(i2, K−1)) is determined without performing any calculation that involves as operands the terms, being previously determined to be 0∈GF(pm), of the polynomial poly(R(i1, 0), . . . , R(i1, K−1)) and/or the polynomial poly(R(i2, 0), . . . , R(i2, K−1)). However, a calculation that involves as operands some of these terms that are previously determined to be 0∈GF(pm) may be performed.
Furthermore, in the embodiments described above, the present invention is applied to the improved ηT pairing calculation algorithm of characteristic 3. However, the present invention may be applied to other pairing calculations in characteristic 3, pairing calculations in characteristic 2, or pairing calculations in other characteristics.
The processings described above can be performed not only sequentially in the order described above but also in parallel with each other or individually as required or depending on the processing power of the apparatus that performs the processings. Furthermore, of course, other various modifications can be appropriately made to the processings without departing form the spirit of the present invention.
In the case where the configurations described above are implemented by a computer, the specific processings of the apparatuses are described in a program. The computer executes the program to implement the processings described above.
The program that describes the specific processings can be recorded in a computer-readable recording medium. The computer-readable recording medium may be any type of recording medium, such as a magnetic recording device, an optical disk, a magneto-optical recording medium and a semiconductor memory.
The program may be distributed by selling, transferring or lending a portable recording medium, such as a DVD and a CD-ROM, in which the program is recorded, for example. Alternatively, the program may be distributed by storing the program in a storage device in a server computer and transferring the program from the server computer to other computers via a network.
The computer that executes the program first temporarily stores, in a storage device thereof, the program recorded in a portable recording medium or transferred from a server computer, for example. Then, when performing the processings, the computer reads the program from the recording medium and performs the processings according to the read program. In an alternative implementation, the computer may read the program directly from the portable recording medium and perform the processings according to the program. As a further alternative, the computer may perform the processings according to the program each time the computer receives the program transferred from the server computer. As a further alternative, the processings described above may be performed on an application service provider (ASP) basis, in which the server computer does not transmit the program to the computer, and the processings are implemented only through execution instruction and result acquisition. The programs according to the embodiments of the present invention include a quasi-program, which is information processed by a computer (data or the like that is not a direct instruction to a computer but has a property that defines the processings performed by the computer).
Industrial applications of the present invention include cryptographic applications that use a multi-pairing calculation, such as the inner product predicate encryption.
1 finite field calculation apparatus
10 input part
30 output part
20, 120, 220, 320 finite field calculation part
| Number | Date | Country | Kind |
|---|---|---|---|
| 2009-106029 | Apr 2009 | JP | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/JP2010/057281 | 4/23/2010 | WO | 00 | 10/19/2011 |
