PAIRING COMPUTATION DEVICE, PAIRING COMPUTATION METHOD, AND PAIRING COMPUTATION PROGRAM

Abstract

Provided are a pairing computation device, a pairing computation method, and a pairing computation program all of which enable fast pairing computation. The pairing computation device includes, where: E is an additive group of rational points on a pairable elliptic curve defined over Fpk with an embedding degree of k, and the curve equation is given by y2=x3+ax+b where a∈Fp and b∈Fp,E[r] is a set of rational points of a prime order r,φp is Frobenius endomorphism, andthe order r and a trace t of the Frobenius endomorphism φp are used as functions of an integer variable χ:computation means for computing a rational function fχ,Q(S);computation means for computing a value of a rational point S(xs, ys) on a line passing through a predetermined rational point;computation means for computing a rational function f′χ,Q(S) using computation results of these computation means; andcomputation means for performing pairing computation by using the rational function f′χ,Q(S) as Formula (1):

Description

TECHNICAL FIELD

The present invention relates to a pairing computation device, a pairing computation method, and a pairing computation program all of which enable fast pairing computation.

BACKGROUND ART

Conventionally, when an individual user uses a variety of services offered over a network such as the Internet, an authentication process is carried out to verify that the individual user is a legitimate user. In such an authentication process, authentication generally uses an ID and a password preset for each individual user. For this purpose, a network is provided with an authentication server for carrying out an authentication process.

Recently, using a digital signature technique, digital signature data unique to an individual user is attached to individual data. This digital signature data ensures that data utilized by an individual user is not tampered by outsiders or is not leaked to outsiders, so that confidential information can be safely handled over a network.

Meanwhile, with a digital signature, an individual user is identified in association with an authentication process at an authentication server, and as a result, history of each individual user is accumulated as information one after another in the authentication server every time an authentication process is performed. Therefore, private information such as which site individual users have accessed and which service they have used is accumulated in the authentication server. Thus, in terms of protection of personal information, great caution is given to prevent leakage of such information.

In order to solve accumulation of history information of individual users caused by the use of digital signatures, it is proposed to use a digital group signature, which is the extended digital signature.

When a digital group signature is used, an individual user transmits, to an authentication server, signature data that certificates that the individual user anonymously belongs to a particular group. The authentication server then verifies that the individual user belongs to a particular group without specifying the individual user from the received signature data. Therefore, while preventing fraud by an individual user who does not belong to a group, the authentication server authenticates an individual user without accumulating history information for each individual user.

For anonymous authentication in such a digital group signature, pairing computation is used.

Pairing computation uses a two-input and one-output function. For example, letting S be a rational point over a prime field F_p and Q be a rational point over a k-degree extension field F_p^k, when the two rational points S and Q are input, an element z in the extension field F*_p^k is output. Moreover, pairing computation has a bilinear property such that when a times of the rational point S and b times of the rational point Q are input, the ab-th power of z is calculated. This bilinearity is utilized in authentication. Here, “k” is an embedding degree, and “F*_p^k” is, strictly speaking, expressed as:

F*_p^k   [Formula 1]

in mathematical representation, but is here represented as “F*_p^k” due to limitations in expression.

In general, for each of the rational points S, Q, a point on an elliptic curve is used. The pairing computation of a rational point on an elliptic curve includes a step of performing computation according to Miller's algorithm and a step of performing exponentiation on the computation result.

With a digital group signature, when access right of an individual user belonging to a group is authenticated, a pairing computation is first performed for excluding an individual user whose access right expires. Then, with the digital group signature, an authentication process is performed through a pairing computation for a predetermined individual user, so that an attribute change such as issue or expiration of access right for each individual user is flexibly handled.

Then, for example, in a case of a digital group signature for a group consisting of 10,000 individual users, if there are 100 individual users whose access rights expire, 100 pairing computations are required. At present, one pairing computation by a general electronic calculator requires about 0.1 second. Accordingly, 100 pairing computations require about 10 seconds. Therefore, in the present situation, a digital group signature scheme is not deemed to be practical and has not been widely used.

In the present situation, in order to put digital group signatures into practical use, researches are focused on improving the speed of pairing computations. For example, a technique for achieving fast pairing computations proposes using Tate pairing computation defined over an elliptic curve to reduce the computation load (see, for example, Patent Document 1).

• Patent Document 1: Japanese Patent Application Publication No. 2005-316267

DISCLOSURE OF INVENTION

Problems to be Solved by the Invention

However, the currently proposed techniques for faster pairing computation have not yet been sufficient, and there has been a growing demand for further acceleration of computation.

In view of the present situation, the present inventors have conducted research and development to increase the pairing computation speed and have conceived the present invention.

Means for Solving the Problems

A pairing computation device according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker (φ_p−[1])), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e: G₂×G₁→F*_p^k/(F*_p^k)^r,

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p^k with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_p and b∈F_p,
• E[r] is a set of rational points of a prime order r, and
• φ_p is Frobenius endomorphism,
• computing pairing e(Q,S) where S∈G₁ and Q∈G₂, and outputting a result of the computation. The pairing computation device includes, where t is a trace of the Frobenius endomorphism φ_p, instead of computing the pairing e(Q,S) by using a rational function f_t−1,Q(S) calculated according to Miller's algorithm as:

e(Q,S)=ƒ_t−1.Q(S)^(pk−1)/r, and   [Formula 2]

• the order r and the trace t of the Frobenius endomorphism φ_p are used as functions of an integer variable χ:
• computation means for computing a rational function f_χ,Q(S);
• computation means for computing a value of a rational point S(x_s, y_s) on a line passing through a predetermined rational point;
• computation means for computing a rational function f′_χ,Q(S) using computation results of these computation means; and
• computation means for performing pairing computation by using the rational function f′_χ,Q(S) as:

e(Q,S)=ƒ′_χ,Q(S)^(pk−1)/r.   [Formula 3]

The pairing computation device according to the present invention is characterized in that the computation means for computing the rational function f_χ,Q(S) includes computation means for computing χQ, storing a result of the computation in a predetermined register, and computing the predetermined rational point by using the result of the computation of χQ.

Furthermore, the pairing computation device according to the present invention is characterized in that, if the embedding degree k=12, using the integer variable χ, letting the order r and the trace t of the Frobenius endomorphism φ_p be:

r(χ)=36χ⁴−36χ³+18χ²−6χ+1,

t(χ)=6χ²+1,

• letting χQ=R, using a relation of Frobenius endomorphism φ_p of R being φ_p(R)=pR, rational points p¹⁰χQ, χQ+p¹⁰χQ, pχQ+p³χQ are computed,
• a value l₁ of the rational point S(x_s, y_s) on a line passing through rational points (χQ, p¹⁰χQ) and a value l₂ of the rational point S(x_s, y_s) on a line passing through rational points)(χQ+p¹⁰χQ, pχQ+p³χQ) are computed, and
• the rational function f′_χ,Q(S) is computed by using a value l₃ of the rational point S(x_s, y_s) on a line passing through rational points (pχQ, p³χQ) as:

ƒ′_χ,Q(S)=ƒ_χ,Q(S)^l+p+p3+p10·l₁·l₂·l₃.   [Formula 4]

Moreover, the pairing computation device according to the present invention is characterized in that using Frobenius endomorphism φ_p of the rational function f_χ,Q(S) being φ_p(f_χ,Q(S))=f_χ,Q(S)^p,

ƒ_χ,Q(S)^l+p10·l₁ is computed, and   [Formula 5]

• using Frobenius endomorphism φ_p of a value l of the rational point S(x_s, y_s) on a line passing through rational points (Q₁, Q₂), Q₁,Q₂∈G₂, being a value of the rational point S(x_s, y_s) on a line passing through rational points (pQ₁, pQ₂), the rational function f′_χ,Q(S) is computed by computing:

ƒ_χ,Q(S)^p+p3·l₃ which satisfies:   [Formula 7]

ƒ_χ,Q(S)^p+p3·l₃=φ_p³(ƒ_χ,Q(S)^l+p10·l₁).   [Formula 6]

A pairing computation method according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker(φ_p−[1]) , and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p^k/(F*_p^k)^r,

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p^k with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_p and b∈F_p,
• E[r] is a set of rational points of a prime order r, and
• φ_p is Frobenius endomorphism, and
• computing pairing e(Q,S) where S∈G₁ and Q∈G₂ by an electronic calculator including a CPU. The pairing computation method includes steps of, where t is a trace of the Frobenius endomorphism φ_p, instead of computing the pairing e(Q,S) by using a rational function f_t−1,Q(S) calculated according to Miller's algorithm as:

e(Q,S)=ƒ_t−1,Q(S)^(pk−1)/r, and   [Formula 2]

• the order r and the trace t of the Frobenius endomorphism φ_p are used as functions of an integer variable χ:
• causing the CPU of the electronic calculator to function as computation means for computing a rational function f_χ,Q(S);
• causing the CPU of the electronic calculator to function as computation means for computing a value of a rational point S(x_s, y_s) on a line passing through a predetermined rational point;
• causing the CPU of the electronic calculator to function as computation means for computing a rational function f′_χ,Q(S) using results of the computations; and
• causing the CPU of the electronic calculator to function as computation means for performing computation by using the rational function f′_χ,Q(S) as:

e(Q,S)=ƒ′_χ,Q(S)^(pk−1)/r   [Formula 3]

The pairing computation method according to the present invention is characterized by further including a step of causing the CPU of the electronic calculator to function as computation means for computing χQ and computing the predetermined rational point by using the result of the computation of χQ, after the step of computing the rational function f_χ,Q(S).

A pairing computation program according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker(φ_p−[1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p^k/(F*_p^k)^r,

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p^k with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_p and b∈F_p,
• E[r] is a set of rational points of a prime order r, and
• φ_p is Frobenius endomorphism, and
• causing an electronic calculator including a CPU to compute pairing e(Q,S) where S∈G₁ and Q∈G₂. The pairing computation program causes the electronic calculator to function as, where t is a trace of the Frobenius endomorphism φ_p, instead of causing computation of the pairing e(Q,S) by using a rational function f_t−1,Q(S) calculated according to Miller's algorithm as:

e(Q,S)=ƒ_t−1,Q(S)^(pk−1)/r, and   [Formula 2]

• the order r and the trace t of the Frobenius endomorphism φ_p are used as functions of an integer variable χ:
• computation means for computing a rational function f_χ,Q(S);
• computation means for computing a value of a rational point S(x_s, y_s) on a line passing through a predetermined rational point;
• computation means for computing a rational function f′_x,Q(S) using results of the computations; and
• computation means for performing computation by using the rational function f′_χ,Q(S) as:

e(Q,S)=ƒ′_χ,Q(S)^(pk−1)/r.   [Formula 3]

The pairing computation program according to the present invention is characterized in that the program causes the electronic calculator to function as computation means for computing χQ and computation means for computing the predetermined rational point by using the result of the computation of χQ.

EFFECTS OF THE INVENTION

In accordance with the present invention, a rational function calculated according to Miller's algorithm in pairing computation is given as a function of an integer variable x, so that the rational function can be calculated at high speed, thereby achieving faster pairing computation. Therefore, it is possible to provide digital group signature service of practical use.

BRIEF DESCRIPTION OF THE DRAWINGS

[FIG. 1] is a schematic diagram of a pairing computation device according to an embodiment of the present invention.

[FIG. 2] is a flowchart of a pairing computation program according to the embodiment of the present invention.

[FIG. 3] is a flowchart for computing a rational function f_χ,Q(S).

[FIG. 4] is a flowchart of a pairing computation program according to another embodiment of the present invention.

DESCRIPTION OF THE REFERENCE SIGNS

• 10 electronic calculator
• 11 CPU
• 12 storage device
• 13 memory device
• 14 bus
• 15 input/output control unit
• 20 electrical communication line
• 30 client device

BEST MODE(S) FOR CARRYING OUT THE INVENTION

A pairing computation device, a pairing computation method, and a pairing computation program according to the present invention perform pairing computation including a first step of computing a rational function according to Miller's algorithm and a second step of performing exponentiation on the computation result. In the first step, the pairing computation device, the pairing computation method, and the pairing computation program compute a rational function using an integer variable χ to speed up the computation.

Specifically, in the conventional pairing computation, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_p−[1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p^k/(F*_p^k)^r,

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p^k with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_p and b∈F_p,
• E[r] is a set of rational points of a prime order r, and
• φ_p is Frobenius endomorphism, and
• pairing e(Q,S) is computed where S∈G₁ and Q∈G₂, and t is a trace of the Frobenius endomorphism φ_p, by using a rational function f_t−1,Q(S) calculated according to Miller's algorithm by the following formula known as Ate pairing:

e(Q,S)=ƒ_t−1,Q(S)^(pk−1)/r.   [Formula 2]

By contrast, the present inventors have found pairing that allows for faster computation by using an integer variable χ on an elliptic curve. This pairing is referred to as “Xate pairing.”

In other words, the pairing computation device, the pairing computation method, and the pairing computation program according to the present invention use Xate pairing rather than Ate pairing, thereby enabling fast computation.

In particular, the elliptic curves used in pairing computation are known as pairing-friendly curves corresponding to the respective embedding degrees. For example, with an embedding degree k=12, the order r and the trace t of the Frobenius endomorphism φ_p are known to be represented as follows using the integer variable χ:

r(χ)=36χ⁴−36χ³+18χ²−6χ+1,

t(χ)=6χ²+1.

With an embedding degree k=10, r and t are known to be represented as follows:

r(χ)=25χ⁴+25χ³+15χ²+5χ+1,

t(χ)=10χ²+5χ+3.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁸−1,

t(χ)=−χ⁶+χ⁴−χ²+2.

With an embedding degree k=8, r and t are known to be represented as follows:

r(χ)=9χ⁴+12χ³+8χ²+4χ+1,

t(χ)=−9χ³−3χ²−2χ.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁴−8χ²+25,

t(χ)=(2χ³−11χ+15)/15.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁸−χ⁴+1,

t(χ)=χ⁵−χ+1.

With an embedding degree k=18, r and t are known to be represented as follows:

r(χ)=(χ⁶+37χ³+343)/343,

t(χ)=(χ⁴+16χ+7)/7.

In the following, Xate pairing will be described with the embedding degree k=12, by way of example.

With the embedding degree k=12, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_p−[1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p¹²/(F*_p¹²)^r

where:

t is an additive group of rational points on a pairable elliptic curve defined over F_p¹², and the curve equation is given by y²=x³+b where b∈F_p, E[r] is a set of rational points of a prime order r, and φ_p is Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius Endomorphism φ_p can be represented as follows using the integer variable χ as described above.

r(χ)=36χ⁴−36χ³+18χ²−6χ+1   (Equasion 1)

t(χ)=6χ²+1   (Equasion 2)

Equasion 2 can be transformed as follows. Here, the notation (χ) will be omitted unless particularly necessary, for the sake of convenience.

6χ²≡t−1≡p (mod r)   (Equasion 3)

Here, a characteristic p has the following relational expression.

p=r+t−1   (Equasion 4)

Therefore, the characteristic p is represented as follows using the integer variable χ.

p(χ)=36χ⁴−36χ³+24χ²−6χ+1   (Equasion 5)

Using Equasion 3, Equasion 5 can be transformed as follows.

p≡p ²−6χ(p+1)+4p+1 (mod r)   (Equation 6)

Equasion 6 can be transformed as follows.

6χ(1+p)≡p²+3p+1 (mod r)   (Equasion 7)

Here, based on the already-known relational expression p⁴−p²+1≡0 (mod r), the following equation is obtained.

p ²(1−p)(1+p)≡1 (mod r)   (Equasion 8)

Equasion 8 can be transformed as follows.

(1+p)⁻¹≡p² (1−p) (mod r)   (Equasion 9)

Using Equasion 9 and from the relational expression p⁶≡−1 (mod r), Equasion 7 can be transformed as follows.

$\begin{array}{cc}\begin{array}{c}6\chi \equiv {\left(1+p\right)}^{-1}\left\{{\left(1+p\right)}^2+p\right\}\\ \equiv 1+p+p^3+p^{10}\left(\mathrm{mod}r\right)\end{array}& \left(\mathrm{Equasion}10\right)\end{array}$

Next, a rational function f_t−1,Q(·) of Ate pairing will be considered. In particular, with Equasion 3, the rational function f_t−1,Q( ) can be represented as follows, where t−1=T:

[Formula 8 ]

ƒ_6χ2,Q=ƒT,Q   (Equasion 11).

Here, Q∈G₂, and for ∀S∈G₁, the following equation is given:

[Formula 9]

ƒ_6χ2,Q(S)^(p12−1)/r=ƒ_T,Q(S)^(p12−1)/r=α(Q,S)   (Equasion 12).

Using Equasion 10, the following equation is obtained:

[Formula 10]

ƒ_6χ2,Q=ƒ_6χ·χ,Q=ƒ₍1+p+p_3+p10)χ,Q   (Equation 13).

Here, it is supposed that the rational function satisfies the following relational expressions:

[Formula 11]

ƒ_a+b,Q=ƒ_a,Q·ƒ_b,Q·g_aQ,bQ   (Equasion 14),

[Formula 12]

ƒ_ab,Q=ƒ_b,Q^a·ƒ_a,bQ=ƒ_a,Q^bƒ_b,aQ   (Equasion 15),

and

[Formula 13]

ƒ_pi,Q=ƒ_p,Q^ipi−1   (Equasion 16).

Therefore, Equasion 13 can be transformed as follows:

[Formula 14]

ƒ_{(1+p+p3+p10)χ,Q}=ƒ_{χ, Q}·ƒ_χ,Q^p·g_χQ,pχQ·ƒ_χ,Q^p10·g_p3χQ,p10χQg_{χQ+pχQ,p3χQ+p10χQ}·ƒ_p,χQ^l+3p2+10p9   (Equasion 17).

Here, g_aQ,bQ=l_aQ,bQ/v_aQ+bQ where l_aQ,bQ denotes a value on the line passing through two rational points aQ and bQ, and v_aQ+bQ denotes a value on the vertical line of rational point aQ+bQ. When the embedding degree is an even number, the computation of V_aQ+bQ can be omitted.

Furthermore, in Equasion 17,

[Formula 15]

ƒ_p,χQ^l+3p2+10p9   (Equasion 18)

has bilinearity and can be transformed as follows:

[Formula 16]

ƒ_p,Q^{χ(1+3p2+10p9})   (Equasion 19).

Therefore, using Equasion 3, Equasion 13, and Equasion 19, the transformation of Equasion 17 results in the following.

[Formula 17]

ƒ_p,Q·{ƒ_p,Q^{χ(1+3p2+10p9)}}⁻¹=ƒ_χ,Q·ƒ_χ,Q^p·g_χQ,pχQ·ƒ_χ,Q^p3·ƒ_χ,Q^p10·g_{p3χ,Q,p10χQ}·g_{χQ+pχQ,p3χQ+p10χQ}   (Equasion 20).

Here, given that the left side of Equasion 20 has bilinearity, the present inventors have noticed that the right side of Equasion 20 has also bilinearity and set the right side of Equasion 20 as a new rational function f′_χ,Q(·).

More specifically, the computation of pairing e(Q,S) is carried out by the following equation:

e(Q,S)=ƒ′_χ,Q(S)^(p12−1)/r.   [Formula 18]

The present inventors call this pairing e(Q,S) as Xate pairing.

Furthermore, the right side of Equasion 20 can be transformed as follows:

[Formula 19]

ƒ_χ,Q^l+p+p3+p10·g_χQ,p10χQ·g_pχQ,p3χQ·g_{χQ+p10χQ,pχQ+p3χQ}   (Equasion 21).

In other words, in the case of the embedding degree k=12, if a value l₁ of a rational point S(x_s, y_s) on a line passing through rational points (χQ, p¹⁰χQ), a value l₂ of a rational point S(x_s, y_s) on a line passing through rational points (χQ+p¹⁰χQ, pχQ+p³χQ), and a value l₃ of a rational point S(x_s, y_s) on a line passing through rational points (pχQ, p³χQ) are calculated and specified, the computation according to Miller's algorithm can be speeded up based on the following equation:

ƒ′_{χ, Q}(S)=ƒ_χ,Q(S)^l+p+p3+p10·l₁·l₂·l₃.   [Formula 4]

Moreover, the right side of Equasion 20 can be transformed as follows, which makes the computation of f′_χ,Q(S) even faster:

[Formula 20]

{ƒ_χ,Q^l+p10·g_χQ,p10χQ}^l+p3·g_{χQ+p10χQ,pχQ+p3χQ}   (Equasion 22).

As described above, if pairing computation is carried out using Xate pairing, the computation can be performed using the rational function f_χ,Q(S) and a new rational function f′_χ,Q(S) obtained by using the values on the lines passing through predetermined rational points. In particular, the rational function f′_χ,Q(S) can be computed using χ having a size smaller than t−1, thereby achieving faster pairing computation.

The description has been given so far to the case of the embedding degree k=12. This is basically applicable to the cases of the embedding degrees k=8, 10, 18, and therefore, a detailed description thereof will not be repeated.

In the following, an embodiment with embedding degree k=12 will be detailed. It is noted that the present embodiment is intended for digital group signatures, and an authentication server configured with a predetermined electronic calculator is assumed as the pairing computation device. However, the pairing computation device may not be configured as an authentication server and may be any device as long as it includes at least computing means such as CPU and can perform pairing computation.

As shown in FIG. 1, an electronic calculator 10 which configures an authentication server includes a CPU 11 for performing computation, a storage device 12 such as a hard disk for storing a variety of programs such as a pairing computation program and data for use in the pairing computation program, and a memory device 13 configured with a RAM, for example, for expanding the pairing computation program so as to be executable and for temporarily storing data generated by execution of the pairing computation program. FIG. 4 also shows a bus 14.

The electronic calculator 10 is also connected to an electrical communication line 20 such as the Internet so as to be able to receive signature data of a digital group signature transmitted from a client device 30 connected to the electrical communication line 20. FIG. 1 shows that the electronic calculator 10 includes an input/output control unit 15.

When signature data of a digital group signature is transmitted from the client device 30 to the electronic calculator 10, the transmitted signature data is temporarily stored in the memory device 13. Then, the electronic calculator 10 performs pairing computation by executing the pairing computation program.

More specifically, upon execution of the pairing computation program, the electronic calculator 10 performs pairing computation based on a flowchart shown in FIG. 2 to implement a digital group signature. It is noted that the authentication process in the digital group signature will not be detailed, and only the pairing computation as a subroutine in the authentication process will be detailed.

With the pairing computation program, the CPU 11 of the electronic calculator 10 functions as input means for inputting required data in step S1 as shown in FIG. 2. More specifically, in the electronic calculator 10, data of an integer variable χ and data of a rational point Q stored beforehand in the memory device 13 are input in a predetermined register provided inside the CPU 11, and in addition, data of a rational point S temporarily stored as signature data in the memory device 13 is input in a predetermined register provided inside the CPU 11.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as first computation means for performing computation of a rational function f_χ,Q(S) by Miller's algorithm, in step S2.

Specifically, the computation of the rational function f_χ,Q(S) is executed as shown in a flowchart in FIG. 3. In particular, in step S2, the computation of χQ is performed along with the computation of the rational function f_χ,Q(S), and the result of the computation of χQ is stored in a predetermined register provided inside the CPU 11.

More specifically, based on the flowchart in FIG. 3, the electronic calculator 10 performs initial settings in step S21. More specifically, the electronic calculator 10 performs an operation to set f←1, T←Q, and i←[log₂(χ)], where i is the number of bits if the integer variable x is in binary representation.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the rational function f_χ,Q(S) part, in step S22.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the χQ part, in step S23.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 determines whether value u_i of the i-th bit of the integer variable χ is “1” or “0”, in step S24.

If u_i=1, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the rational function f_χ,Q(S) part, in step S25, and then performs a predetermined computation for the χQ part, in step S26.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a termination determination, in step S27.

If i≠1 in step S27, based on the flowchart in FIG. 3, the electronic calculator 10 decrements i in step S28, and then, returning to step S22, repeatedly performs the computations of the rational functions f_χ,Q(S) and χQ until i=1 in step S27.

If i=1 in step S27, the electronic calculator 10 stores the computation result of the rational function f_χ,Q(S) and the computation result of χQ in predetermined registers and then ends the subroutine based on the flowchart in FIG. 3.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as second computation means for computing rational points p¹⁰χQ, χQ+p¹⁰χQ, pχQ+p³χQ, in step S3.

In particular, in the second computation means, letting χQ stored in the predetermined register in step S2=R, using the relation of Frobenius endomorphism φ_p of R being φ_p(R)=pR, computation is performed by assuming that the rational points are p¹⁰χQ=p¹⁰R, χQ+p¹⁰χQ=R+p¹⁰R, pχQ+p³χQ=pR+p³R.

Specifically, given T=χQ=R where X=p¹⁰R, Y=R+p¹⁰R, Z=pR+p³R, the electronic calculator 10 performs computation as follows:

X←φ_p¹⁰(T),

Y←T+X, and

Z←φ_p³(Y).

Therefore, since the electronic calculator 10 can perform computation without performing a multiplication process in step S3, the computation can be speeded up.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as third computation means for computing the value l₁ of the rational point S(x_s, y_s) on the line passing through the rational points (χQ, p¹⁰χQ) and the value l₂ of the rational point S(x_s, y_s) on the line passing through the rational points (χQ+p¹⁰χQ, pχQ+p³χQ), in step S4.

Specifically, in the electronic calculator 10, l₁=l_T,X(S) is computed as follows:

λ_T,X←(y_X−y_T)/(x_X−x_T), and

l_T,X(S)←(x_S−x_X) λ_T,X−(y_S-y_X).

Furthermore, in the electronic calculator 10, l₂=l_Y,Z(S) is computed as follows:

λ_Y,Z←(y_Z−y_Y)/(x_Z−x_Y), and

l_Y,Z(S)←(x_S−x_Z) λ_Y,Z−(y_S−y_Z).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as fourth computation means for computing, using the computation result in the first computation means, the computation result in the third computation means, and the value l₃ of the rational point S(x_s, y_s) on the line passing through the rational points (pχQ, p³χQ), a rational function f′_χ,Q(S) as follows, in step S5:

ƒ═_χ,Q(S)=ƒ_χ,Q(S)^l+p+p3+p10·l₁·l₂·l₃.   [Formula 4]

In particular, in this case, given that Frobenius endomorphism φ_p of the rational function f_χ,Q(S) is χ_p(f_χ,Q(S))=f_χ,Q(S)^p, using φ_p¹⁰(f_χ,Q(S))=f_χ,Q(S)^{p{circumflex over (0)}10} (here, p^{{circumflex over (0)}10} represents p¹⁰), the electronic calculator 10 computes:

ƒ_χ,Q(S)^l+p10·l₁.   [Formula 5]

Furthermore, using Frobenius endomorphism φ_p of a value l of a rational point S(x_s, y_s) on a line passing through rational points (Q₁, Q₂), Q₁, Q₂∈G₂, being a value of a rational point S(x_s, y_s) on a line passing through rational points (pQ₁, pQ₂), the electronic calculator 10 computes a rational function f′_χ,Q(S) by computing:

ƒ_χ,Q(S)^p+p3·l₃ which satisfies:   [Formula 6]

ƒ_χ,Q(S)^p+p3·l₃−φ_p³(ƒ_χ,Q(S)^l+p10·l₁).   [Formula 6]

Specifically, the electronic calculator 10 performs computation as follows. Here, p^{{circumflex over (0)}3} represents p³.

• 1. C←f^{p{circumflex over (0)}10}
• 2. C←C·f
• 3. A←C·l_T,X(S)
• 4. B←A^{p{circumflex over (0)}3}
• 5. return A,B

Therefore,

ƒ′_χ,Q(S)=ƒ_χ,Q(S)^l+p+p3+p10·l₁·l₂·l₃   [Formula 4]

can be calculated as:

f′←A·B·l_Y,Z(S).

In this manner, the use of Xate pairing can significantly reduce the computation amount thereby achieving faster pairing computation.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as fifth computation means for performing final exponentiation in the pairing e(Q,S) in step S6.

Specifically, the electronic calculator 10 performs computation as follows.

• 1. f′←f′^{p{circumflex over (0)}6}·f′⁻¹
• 2. f′←f′^p̂2·f′
• 3. a←(f′⁶)^χ·(f′⁵)^{p{circumflex over (0)}6}
• 4. b←a^p
• 5. b←a·b
• 6. compute f′^p,f′^{p{circumflex over (0)}2}, and f′^p̂3
• 7. c←b·(f′^p)²·f′^{p{circumflex over (0)}2}
• 8. f′←f′^{p{circumflex over (0)}3}·(c⁶)^{χ{circumflex over (0)}2}·c b·(f′^p·f′)⁹·a·f′⁴
• 9. Return f′

In the electronic calculator 10 that configures an authentication server, an authentication process is performed using the result of pairing computation obtained as described above.

In the present embodiment, the description has been made to the case of the embedding degree k=12. However, for example, in the case of an embedding degree k=10, similar computation can also be performed.

With the embedding degree k=10, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_p−[1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p¹⁰/(F*_p¹⁰)^r

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p¹⁰ with an embedding degree of 10, and the curve equation is given by y²=x³+ax+b where a∈F_p and b∈F_p, E[r] is a set of rational points of a prime order r, and φ_p is Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius endomorphism φ_p are represented as follows, using an integer variable χ.

r(χ)=25χ⁴+25χ³+15χ²+5χ+1

t(χ)=10χ²+5χ+3

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

5χ=p⁴+p⁵+p⁷+p⁸=p⁴(1+p+p³+p⁴) (mod r(χ))

Then, a value l₄ of a rational point S(x_s, y_s) on a line passing through rational points (χQ, pχQ) and a value l₅ of a rational point S(x_s, y_s) on a line passing through rational points (χQ+pχQ, p³χQ+p⁴χQ) are computed, and then using a value l₆ of a rational point S(x_s, y_s) on a line passing through rational points (p³χQ, p⁴χQ), a rational function f′_χ,Q(S) is computed by the following equation:

ƒ′_χ,Q(S)=φ_p⁴(ƒ_χ,Q(S)^l+p+p3+p4·l₄·l₅·l₆).   [Formula 21]

Similarly to the case of the embedding degree k=12, also in the case of the embedding degree k=10, the authentication server performs pairing computation based on a flowchart shown in FIG. 4 by executing the pairing computation program.

With the pairing computation program, as shown in FIG. 4, in step T1, the CPU 11 of the electronic calculator 10 functions as input means for inputting required data. More specifically, in the electronic calculator 10, data of the integer variable χ and data of the rational point Q stored beforehand in the memory device 13 are input in a predetermined register provided inside the CPU 11, and in addition, data of the rational point S temporarily stored as signature data in the memory device 13 is input in a predetermined register provided inside the CPU 11.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the first computation means for performing computation of a rational function f_χ,Q(S) by Miller's algorithm, in step T2.

It is noted that in this step T2, the first equation in step S22 in the flowchart shown in FIG. 3 is given as follows.

λ_T,T←(3x_T²+a)/(2y_T)   1.

Here, “a” denotes the first-order coefficient in the elliptic curve given by y²=x³+ax+b where a∈F_p and b∈F_p. Except for this first equation, computation of the rational function f_χ,Q(S) is performed similarly to the flowchart shown in FIG. 3.

Furthermore, in step T2, the electronic calculator 10 also computes χQ along with the rational function f_χ,Q(S) and stores the computation result in a predetermined register.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the second computation means for computing rational points pχQ, χQ+pχQ, p³χQ+p⁴χQ in step T3.

In particular, in the second computation means, letting χQ stored in the predetermined register in step T2=R, using the relation of Frobenius endomorphism φ_p of R being φ_p(R)=pR, computation is performed by assuming that the rational points are pχQ=pR, χQ+pχQ=R+pR, p³χQ+p⁴χQ=p³R+p⁴R.

Specifically, given T=χQ=R where X=pR, Y=R+pR, Z=p³R+p⁴R, the electronic calculator 10 performs computation as follows:

X←φ_p(T),

Y←+X, and

Z←φ_p³(Y).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the third computation means for computing the value l₄ of the rational point S(x_s, y_s) on the line passing through the rational points (χQ, pχQ) and the value l₅ of the rational point S(x_s, y_s) on the line passing through the rational points (χQ+pχQ, p³χQ+p⁴χQ), in step T4.

Specifically, in the electronic calculator 10, l₄=l_T,X(S) is computed as follows:

λ_T,X←(y_X−y_T)/(x_X−x_T),

l_T,X(S)←(x_S−x_X)λ_T,X−(y_S−y_X).

Furthermore, in the electronic calculator 10, l₅=l_Y,Z(S) is computed as follows:

λ_Y,Z←(y_Z−y_Y)/(x_Z−x_Y),

l_T,Z (S)←(x_S−x_Z) λ_Y,Z−(y_S−y_Z).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the fourth computation means for computing, using the computation result in the first computation means, the computation result in the third computation means, and the value l₆ of the rational point S(x_s, y_s) on the line passing through rational points (p³χQ, p⁴χQ), a rational function f′_χ,Q(S) as follows, in step T5:

ƒ′_χ,Q(S)=φ_p⁴(ƒ_χ,Q(S)^l+p+p3+p4·l₄·l₅·l₆).   [Formula 21]

In particular, in this case, using Frobenius endomorphism φ_p of the rational function f_χ,Q(S) being φ_p(f_χ,Q(S))=f_χ,Q(S)^p, the electronic calculator 10 computes:

ƒ_χ,Q(S)^l+p·l₄.   [Formula 22]

Furthermore, using Frobenius endomorphism φ_p of the value l of the rational point S(x_s, y_s) on the line passing through the rational points (Q₁, Q₂), Q₁,Q₂∈G₂, being a value of the rational point S(x_s, y_s) on a line passing through the rational points (pQ₁, pQ₂), the electronic calculator 10 computes a rational function f′_χ,Q(S) by computing:

ƒ_χ,Q(S)^p3+p4·l₆ which satisfies:   [Formula 24]

ƒ_χ,Q(S)^p3+p4·l₆=φ_p³(ƒ_χ,Q(S)^l+p·l₄).   [Formula 23]

Specifically, the electronic calculator 10 performs computation as follows. Here, p^{{circumflex over (0)}3} represents p³.

• 1. C←f^p
• 2. C←C·f
• 3. A←C·l_T,X(S)
• 4. B←A^{p{circumflex over (0)}3}
• 5. return A,B

Furthermore, the electronic calculator 10 performs computation as:

• 1. f′←A B·l_Y,Z(S)
• 2. f′←f′^{p{circumflex over (0)}4} thereby computing:

ƒ′_χ,Q(S)=φ_p⁴(ƒ_χ,Q(S)^l+p+p3+p4·l₄·l₅·l₆).   [Formula 21]

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the fifth computation means for performing final exponentiation in the pairing e(Q,S) in step T6.

In the electronic calculator 10 that configures an authentication server, an authentication process is performed using the result of pairing computation obtained as described above.

Furthermore, in the case of the embedding degree k=10, letting the rational function calculated according to Miller's algorithm be given by f_{χ{circumflex over (0)}2,Q}(S) (χ^{{circumflex over (0)}2} represents χ²), pairing e(Q,S) can also be computed.

In this case, the order r and the trace t of the Frobenius endomorphism φ_p is represented as follows, using an integer variable χ.

r(χ)=χ⁸−1

t(χ)=−χ⁶+χ⁴−χ²+2

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

pχ ²=−p (mod r(χ))

Then, the electronic calculator 10 computes a rational function f′_χ,Q(S) by the following equation:

ƒ′_χ,Q(S)=ƒ_χ2,Q(S)^p   [Formula 25]

Therefore, according to the pairing computation program, in the electronic calculator 10, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_χ,Q(S)^(p10−1)/r.   [Formula 26]

With the embedding degree k=8, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_p−[1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_p⁸/(F*_p⁸)^r

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p⁸, and the curve equation is given by y²=x³+ax where a∈F_p, E[r] is a set of rational points of a prime order r, and φ_p is the Frobenius endomorphism.

In this case, the order r and the trace t of Frobenius endomorphism φ_p are represented as follows, using an integer variable χ.

r(χ)=9χ⁴+12χ³+8χ²+4χ+1

t(χ)=−9χ³−3χ²−2χ

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

3χ=−l−p²+p³ (mod r(χ))

Then, using a value l₇ of a rational point S(x_s, y_s) on a line passing through rational points (χQ, χQ), a value l₈ of a rational point S(x_s, y_s) on a line passing through rational points (2χQ, χQ), a value l₉ of a rational point S(x_s, y_s) on a line passing through rational points (p²Q, (3χ+1)Q), and a value l₁₀ of a rational point S(x_s, y_s) on a line passing through rational points (3χQ, Q), the electronic calculator 10 computes a rational function f′_χ,Q(S) using the following equation:

ƒ′_χ,Q(S)=ƒ_χ,Q(S)³·l₇·l₈·l₉˜l₁₀.   [Formula 27 ]

In other words, with the pairing computation program, the electronic calculator 10 performs computation of the rational function f_χ,Q(S) by Miller's algorithm as described above, computes χQ along with the rational function f_χ,Q(S), and then stores the computation result in a predetermined register.

Then, letting χQ stored in a predetermined register =R, using the relation of Frobenius endomorphism φ_p of R being φ_p(R)=pR, the electronic calculator 10 computes rational points 2χQ, p²χ, 3χQ, (3χ+1)Q, computes the values l₇, l₈, l₉, l₁₀ using the computation result, and computes the rational function f′_χ,Q(S).

Then, in the electronic calculator 10, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_χ,Q(S)^(p8−1)/r.   [Formula 28]

It is noted that, in the case of the embedding degree k=8, the order r and the trace t of the Frobenius endomorphism φ_p may also be represented as follows, using the integer variable χ.

r(χ)=χ⁴−8χ²+25

t(χ)=(2χ³−11χ+15)/15

In this case, p-adic expansion by the characteristic p of the integer variable χ is represented as follows.

χ=−p+2p³ (mod r(χ))

In this case, using a value l₁₁ of a rational point S(x_s, y_s) on a line passing through rational points (pQ, χQ), the rational function f′_χ,Q(S) can also be computed by the following equation:

ƒ′_χ,Q(S)=ƒ_χ,Q(S)·l₁₁.   [Formula 29]

Alternatively, in the case of the embedding degree k=8, letting the rational functions calculated according to Miller's algorithm be given by f_{χ{circumflex over (0)}2,Q}(S) (χ^{{circumflex over (0)}2} represents χ²) and f_χ,Q(S), the pairing e(Q,S) can also be computed.

Here, the order r and the trace t of the Frobenius endomorphism φ_p can also be represented as follows, using the integer variable χ.

r(χ)=χ⁸−χ⁴+1

t(χ)=χ⁵−χ+1

In this case, p-adic expansion by the characteristic p of the integer variable χ is represented as follows.

Pχ+χ ² =−o ² (mod r(χ))

In this case, using a value l₁₂ of a rational point S(x_s, y_s) on a line passing through rational points (χ²Q, pχQ), the rational function f′_χ,Q(S) can be computed by the following equation:

ƒ′_χ,Q(S)=ƒ_χ2,Q(S)·ƒ_χ,Q(S)^p·l₁₂.   [Formula 30]

Here, the electronic computation device 10 computes χQ, along with the computation of the rational function f_{χ{circumflex over (0)}2,Q}(S) and the rational function f_χ,Q(S) by Miller's algorithm as described above, and stores the computation result in a predetermined register.

Then, letting χQ stored in a predetermined register=R, using the relation of Frobenius endomorphism φ_p of R being φ_p(R)=pR, the electronic calculator 10 computes a rational point pχQ, and computes the above-noted value l₁₂ using this computation result, and computes the rational function f′_χ,Q(S). Then, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_χ,Q(S)^(p8−1)/r.   [Formula 28]

With the embedding degree k=18, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_p−1]), and

G ₂ =E[r]∩Ker(φ_p−[p]),

as a nondegenerate bilinear map:

e:G₂×G₁←F*_p¹⁸/(F*_p¹⁸)^r

where:

• E is an additive group of rational points on a pairable elliptic curve defined over F_p¹⁸, and the curve equation is given by y²=x³+b where b∈F_p, E[r] is a set of rational points of a prime order r, and φ_p is Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius endomorphism φ_p are represented as follows, using an integer variable χ.

r(χ)=(χ⁶+37χ³+343)/343

t(χ)=(χ⁴+16χ+7)/7

In this case, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

χ=−3p+p⁴ (mod r(χ))

Then, a value l₁₃ of a rational point S(x_s, y_s) on a line passing through rational points (3pQ, χQ), the electronic calculator 10 computes a rational function f′_χ,Q(S) by the following equation:

ƒ′_χ,Q(S)=ƒ_χ,Q(S)·l₁₃.   [Formula 31]

In other words, with the pairing computation program, the electronic calculator 10 performs computation of the rational function f_χ,Q(S) by Miller's algorithm as described above, computes χQ together with the rational function f_χ,Q(S), and then stores the computation result in a predetermined register.

Then, the electronic calculator 10 computes the above-noted value l₁₃ using the rational function f_χ,Q(S) and the computation result of χQ, and computes the rational function f′_χ,Q(S). Then, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_χ,Q(S)^(p18−1)/r.   [Formula 32]

As described above, pairing computation is performed with Xate pairing to achieve faster pairing computation, thereby making group signatures using pairing computation into practical use.

INDUSTRIAL APPLICABILITY

In accordance with the present invention, it is possible to provide a high-speed pairing computation device and to provide digital group signature service of practical use.

Claims

1. A pairing computation device for defining pairing e by using: G1=E[r]∩Ker(φp−[1]), andG2=E[r]∩Ker(φp−[p]),

2. The pairing computation device according to claim 1, wherein the computation means for computing the rational function fχ,Q(S) includes computation means for computing χQ, storing a result of the computation in a predetermined register, and computing the predetermined rational point by using the result of the computation of χQ.

3. The pairing computation device according to claim 2, wherein, if the embedding degree k=12, using the integer variable χ, letting the order r and the trace t of the Frobenius endomorphism φp be: r(χ)=36χ4−36χ2+18χ2−6χ+1,t(χ)=6χ2+1,letting χQ=R, using a relation of Frobenius endomorphism φp of R being φp(R)=pR, rational points p10χQ, χQ+p10χQ, pχQ+p3χQ are computed,a value l1 of the rational point S(xs, ys) on a line passing through rational points (χQ, p10χQ) and a value l2 of the rational point S (xs, ys) on a line passing through rational points (χQ+p10χQ, pχQ+p3χQ) are computed, andthe rational function f′χ,Q(S) is computed by using a value l3 of the rational point S(xs, ys) on a line passing through rational points (pχQ, p3χQ) as: ƒ′χ,Q(S)=ƒχ,Q(S)l+p+p3+p10·l1l2l3.   [Formula 4]

4. The pairing computation device according to claim 3, wherein using Frobenius endomorphism φp of the rational function fχ,Q(S) being φp(fχ,Q(S))=fχ,Q(S)p, ƒχ,Q(S)l+p10·l1 is computed, and   [Formula 5]using Frobenius endomorphism φp of a value l of the rational point S(xs, ys) on a line passing through rational points (Q1, Q2), Q1,Q2∈G2, being a value of the rational point S(xs, ys) on a line passing through rational points (pQ1, pQ2), the rational function f′χ,Q(S) is computed by computing: ƒχ,Q(S)p+p3·l3 which satisfies:   [Formula 7]ƒχ,Q(S)p+p3·l3=φp3(ƒχ,Q(S)1+p10·l1).   [Formula 6]

5. A pairing computation method for defining pairing e by using: G1=E[r]∩Ker(φp−[1]), andG2=E[r]∩Ker(φp−[p]),

6. The pairing computation method according to claim 5, further comprising a step of causing the CPU of the electronic calculator to function as computation means for computing χQ and computing the predetermined rational point by using the result of the computation of χQ, after the step of computing the rational function fχ,Q(S).

7. A pairing computation program for defining pairing e by using: G1=E[r]∩Ker(φp−[1]), andG2=E[r]∩Ker(φp−[p]),

8. The pairing computation program according to claim 7, wherein the pairing computation program causes the electronic calculator to function as computation means for computing χQ; andcomputation means for computing the predetermined rational point by using the result of the computation of χQ.