C ab, Algorithms for computations in Jacobian group of C ab curve and their application to discrete-log based public key cryptosystems.

Μέγεθος: px

Εμφάνιση ξεκινά από τη σελίδα:

Download "C ab, Algorithms for computations in Jacobian group of C ab curve and their application to discrete-log based public key cryptosystems."

Δημοστρατη Δελή
5 χρόνια πριν
Προβολές:

1 C ab Algorithms for computations in Jacobian group of C ab curve and their application to discrete-log based public key cryptosystems Seigo ARITA C ab C ab C ab C ab C ab 1 RSA 2 C 2 (1) [4] [5] (2) [6] [7] [11] [8] C ab [1] [3] [12] C ab C ab (1) C ab C ab C 2 Gröbner 3 C ab 4 NEC C&C C&C Media Research Laboratories NEC 1-1 Miyakzaki 4- chome Miyamae-ku Kawasaki Kanagawa 216 Japan 1 C C ab 5 4 A Vol J82 A No 8 pp

2 99/8 Vol J82 A No 8 deg(d) + 1 g [10] [18] Gröbner Z> = 0 n x α = x α 1 1 xα n n n 7 C ab α = (α 1 α n ) Z n > = 0 multi-degree / MD(x α ) Z n > = 0 < γ Z n > 2 = 0 α < β α + γ < β + γ < < multi-degree n Gröbner n f 2 1 f leading monomial K C K LM(f) f K m i C K ( ) i D = G n m i i 0 m i D = g 1 g m m i i m = m i D = g 1 g m m i i K[x 1 x n] I deg(d) C G = {g 1 g m} g 1 g m D 0 leading monomial I D 0 leading monomial Gal(K K) D D 0 LM(I) = LM(g 1 ) LM(g m ) D K DK 0 D K G I Gröbner K I Gröbner G = {g 1 g m } I C f :I = g 1 g m K[x 1 x n ] n (or ) v (f) = n(or n) Gröbner f (f) := v (f) 0 leading monomial multi-degree f (f) (f) 0 := α Z n > = 0 I v (f)> v = 0 (f) f (f) := (I) : v (f)< v = 0 (f) f (f) = (f) 0 (f) C (I) = {α Z n > = 0 x α LM(I)} {(f) f K(C)} D 0 (I) δ(i) C J(C) D 0 G = {g 1 g m } Gal(K K) K D g Riemann dim L(D) > = I I J K (C) K δ(g 1 g m ) := (Z n > = 0 m i=1(md(lm(g i )) + Z n > = 0)) J K (C) ( S S ) δ(i) I G = {g 1 g m } L(D) = {f K(C) (f) + D > = 0} {0} G I Gröbner basis δ(i) = δ(g 1 g m)(1) K C 2

3 C ab Gröbner n C ab (C ) f I f I Gröbner 0 C ab (a 1)(b 1)/2 I Gröbner C ab reduced Gröbner I C ab Gröbner reduced 1) G C ab > cab p LM(p) 1 2) G 2 C ab α = (α 1 α 2) β = p p (β 1 β 2) Z 2 > = 0 (i) (ii) LM(G {p}) α > cab β [17] 3 C ab [9] C ab X α Y β C ab C ab K K 1 X α Y β C C 1 v (x α y β ) = aα + bβ C X L( ) L( ) = {f K(C) v Q (f) > = 0 ( Q = )} L( ) f M [13] [14] Noether Residue Divisor Theorem [15] M = { v (f) f L( )} M ( ) 1 C ab M 2 a b (C ) C ab (C ) C ab C ab a x L( ) b y L( ) x y C ab C ab 0< = i< = b0< = j< = aai+bj< = ab α ijx i y j = 0 (2) α ij K α b0 α 0a 0 (2) C ab (C ) C ab J K (C) DK/ 0 K C j [D] α b0 α 0a 0 (2) C 23 C 2b (i) aα 1 + bα 2 > aβ 1 + bβ 2 (ii) aα 1 + bα 2 = aβ 1 + bβ 2 α 1 < β 1 4 K C ab C C g = (a 1)(b 1)/2 D K DK 0 K C K 0 C J K (C) = DK/ 0 K j D DK 0 j = [D] 3 E g n D = E n 0 D 3

4 semi-normal 4 J K (C) j 99/8 Vol J82 A No 8 semi-normal 7 [D] Riemann dim L(D + g ) > = g + 1 g = 1 0 D + g + (f) > = 0 E = D + g + (f) j = [E g ] f E 1 n 1 D 2 = E 2 n 2 4 semi- 1 D 1 + D 2 = (E 1 + E 2) (n 1 + n 2) normal semi- 1 normal D = E n normal 2 normal D = E n D = E n E D semi-normal G 1 (f) 0 > = E L( ) f v (f) f 2 G D + (f) Algorithm1 j J K (C) semi-normal 1 D 1 = E 1 n D 2 = E 2 n C ab semi-normal 1 0 λ E 1 n 1 = E 2 2 n 2 + (λ) D Supp((f 1) ) = { } (f 1) 0 > = K F (X Y ) = E 1 f 1 ( Supp(D) 0< = i< = b0< = j< = aai+bj< = ab αijxi Y j = 0 C ab D ) (f 1λ 1 ) = (f 1) (λ) = (f 1) 0 E 1 + E 2 + (n 1 k 1 n 2) (f 1) 0 C C ab C K[x y] K[X Y ]/(F (X Y )) E 1 + E 2 > = E 2 f 2 = f 1λ 1 f 2 Supp((f 2 ) ) = { } (f 2 ) 0 > = E 2 λ f 1 A K f 2 f 1 f 2 = C J K (C) f 1 λ 1 A K H(A K ) [16] E 2 + n 2 + (f 2 ) = E 2 + n 2 + C ab C Φ (f 1 ) E 1 + E 2 + (n 1 n 2 ) = E 1 + n 1 + (f 1 ) D 1 D 2 1 Φ : 6 1 (semi-normal ) normal Φ normal 1-1 normal (A K 2 semi-normal normal C ab normal 0 D j = 4 2 semi-normal D 1 = D 1 + D 2 normal D 3 = E 3 n 3 normal D 3 = E 3 n J K (C) H(A K ) [ n n ] [L( n )] C ab

5 C ab 1 2 Φ δ(i) A K I K I normal J E = n I I = Φ(E) = 1 I C ab I n I f( = 0) 2 (f) = I J J 4 A K I 1 dim KA/I n = n I 2 dima/i = n = deg(e) I 1 I 2 normal 8 C ab I 3 1 I 1 I 2 3 normal J 2 J 3 normal C 34 {a 0 +a 1 X+ I C g(c) = (3 1)(4 1)/2 = 3 J K (C) j = [ f 3 3 ] C 3 { } J (f) = I 1 I 2 J C 34 4 X XY 6 Y 2 j g I 3 (g) = J I 3 I 1 I 2 (g) = I 1 I 2 J I 3 = (f) I 3 4 ) δ(x 2 + XY + Y 2 + ) = 3 I 3 I 3 = g/f I 1 I 2 8 δ(i) = deg( ) = 3 C ab 22 (1) {X 2 + XY + 5 Y 2 + } I Gröbner 5 C ab 5 C ab F (X Y ) = 0 : K[X Y ]/(F (X Y )) I 1 I 2 K[X Y ]/(F (X Y )) normal I 3 1 J I 1 I 2 2 f f( = 0) J 3 g g( = 0) st g J = f F 4 I 3 g/f J 5 2 C ab Gröbner 5 C ab ) I = {f 1 = X Y + 4X + 5 f 2 = Gröbner XY + 3Y + 4X + 9 f 3 = Y 2 + 9Y + 16X + 2} ( C ab Gröbner 9 ) 2 8 semi-normal E n Φ I deg(e) = [17]Chap5Sec3rop4 δ(i) = dim K A/I A/I = A/In C ab C Gröbner C 34 9 C 34 C J K(C) a 2 Y +X 2 b 0 +b 1 X +b 2 Y +XY c 0 +c 1 X +c 2 Y +Y 2 } reduced Gröbner I X 2 + XY + Y ( C 34 normal C ab semi-normal Gröbner C ab Gröbner a GF (17) F = Y 3 + X C 34 C J GF (17) (C) ( C 34 1 X Y X 2 XY Y 2 X 3 X 2 Y XY 2 5

6 99/8 Vol J82 A No 8 f G hg 5 hg 4 {f F } 1 I I I I 6 C 34 f G 7 X 3 9 I I = {X Y + 5X + 15 XY + 13Y + 5X + 11 Gröbner {X 3 + X 2 Y + XY 2 + } Y 2 + 5Y + 12X + 6} I 3 Gröbner I I 5 g 1 f1 2 {F } = X g 2 f 1 f 2 {g 1 F } = X 3 Y + g 3 f 2 2 {g 2 g 1 F } = X 2 Y 2 + g 4 f 1 f 3 {g 3 g 2 g 1 F } = XY 2 + g 5 f 2 f 3 {g 4 g 3 g 2 g 1 F } = X 2 Y + g 6 f 2 3 {g 5 g 4 g 3 g 2 g 1 F } = X 3 + J I I = {g 6 g 5 g 4 } 2 f g 6 = X Y 2 + 5XY + 7Y + 11X h J f F h( = 0) LM(f) = X 3 LM(F ) = Y 3 RETURN I 3 X 2 {ff } g 5 4X 2 Y 2 + leading monomial X 2 Y 2 {ff } Y g 5 X 2 g 5 4Y g Xg 5 + 2g 5 (mod {f F }) h X Y + 5X (h/f) J = (h/f) {g 6 g 5 g 4} = {h (hg 5)/f (hg 4)/f} {a 5 b 5 } {a 4 b 4 } I 3 {h (hg 5)/f (hg 4)/f} {h a 5 a 4} (mod {F }) {{c 1 c 2 c a } r} Division(g G) g G {c 1 c 2 c a } r ( [17] ) {{a 1 a i } r} Coefficients(f r 1 r i ) f r 1 r i {a 1 a i } r ( f = i a k=1 kr k + r) Mono i C ab i (Mono 1 = 1 Mono 2 = J Gröbner X ) 6 algorithm JacobianSum(inputs I 1 I 2 output I 3) I 3 Compose(I 1 I 2) f the minimum element of I 3 I 3 Reduce(f I 3) {f F } f F Gröbner subroutine Compose(inputs I 1 = {f 1 f 2 f a} I 2 = {g 1 g 2 g a} output I g 5 {f F } 3) I 3 {F } FOR i = 1 TO a j = 1 TO a DO I {ff g } 5 = X 2 g f i g 3 j Y + I 3 {g} I 3 {ff } Xg 5 = XY 2 IF δ(i 3 ) > δ(i 1 ) + δ(i 2 ) THEN I 3 Buchberger(δ(I 1 ) + δ(i 2 ) I 3 ) + I 3 the set of the minimum a elements of I 3 {ff } Y g 5 = X 2 Y 2 RETURN I + 3 subroutine Reduce(inputs f I = {f 1 f 2 f a } output J) G {f f y {F } f y a 1{F } F } LABEL(retry) X 2 g 5 4Y g 5 +12XY 2 + J {} a (mod {f F }) XY 2 {ff } h (random number) fi Xg i=1 5 g Divide(G h) leading monomial FOR i = 1 TO a 6 {{c 1 c 2 c a } r} Division(g f i G) IF r = 0 THEN GOTO retry k c 1 + c 2 y + + c a y a 1 J J {k} RETURN J subroutine Divide(inputs G h output s) r 1 Mono 1 h G s 1 Mono 1 i 1 WHILE r i = 0 DO

7 C ab i i + 1 r i Mono i h G {{A 1 A i 1 } r i } Coefficients(r i {r 1 r i 1 }) s i Mono i i 1 j=1 A js j RETURN s i subroutine Buchberger(inputs m I = {f 1 f s } output G = {g 1 g t }) B {(i j) 1 < = i < j < = s} G F t s WHILE B = φ AND δ(g) > m DO Select (i j) B IF LCM(LT(f i ) LT(f j )) = LT(f i )LT(f j ) THEN S S(f i f j) G IF S = 0 THEN t t + 1; f t S G G {f t} B B {(i t) 1 < = i < = t 1} B B {(i j)} RETURN G B O(g 2 ) O(g 2 ) S G 160 ( SumDoubleScalar )O(g 4 ) 6 simple Y a + αx b + β Buchberger Gröbner C ab random 8 C ab Buchberger G 1 C 35 (ms on 266MHZentiumII) Table 1 erformance for C 35 curve(ms on 266MHZ entiumii) simple random Sum Double Scalar C 37 (ms on 266MHZentiumII) Table 2 erformance for C 37 curve(ms on 266MHZ entiumii) simple random Sum Double Scalar S 6 O(g 3 ) 6 subroutine Compose 6 1subroutine Divide 3 subroutine Reduce C 35 C 37 C Buchberger Buchberger 266MHZentium II millisecond m 2 Gröbner 1 23 Buchberger B 160 C 37 (i j) 300ms C ms O(g) (i j) S G C ab 6 O(g 3 ) 7 / GF (q) C 34 C C / ( 10 F q C 34 C 3 log(q) ) J GF (q) (C) q 3 7

8 99/8 Vol J82 A No 8 3 C 213 (ms on 266MHZentiumII) Table 3 erformance for C 213 curve(ms on 266MHZ entiumii) simple random Sum Double Scalar C ab 160 C ms C ab C ab C ab NEC SONY 1 C 34 / Fig 1 Encryption and decryption functions on C 34 curve [1] IASemaev Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curves in characteristic p Math Comp (1998) [2] TSatoh KAraki Fermat Quotients and the olynomial Time Discrete Log Algorithm for Anomalous Elliptic Curves COMMENTARII MATHEMATICI UNIVERSITATIS SANCTI AULI vol 47 No q [3] NSmart The discrete logarithm problem on elliptic curves of trace one To appear in J Cryptol- 9 J GF (q) (C) ogy {a 0 + a 1 X + a 2 Y + X 2 b 0 + b 1 X + b 2 Y + XY c 0 + [4] DGCantor Computing in the Jacobian of a hy- c 1 X + c 2 Y + Y 2 } perelliptic curve Mathematics of Computation 48(177) pp a 2 = 0 2 a 0 + a 1 X + a 2 Y + X 2 [5] NKoblitz Hyperelliptic cryptosystems JCryptography1(1989) b 0 + b 1 X + b 2 Y + XY pp a 2 = 0 [6] NKoblitz A Very Easy Way to Generate Curves over rime Fields for Hyperelliptic Cryptosytems 1/q Rump Talk Crypto 97 J GF (q) (C) 6 log 2 (q) [7] NMatsudaJChaoSTsujii Efficient construction (a 0 a 1 a 2 b 0 b 1 b 2 ) algorithms of secure hyperelliptic discrete logarithm problems IEICE ISEC96-18(1996) J GF (q) (C) ( ) j 0 = [8] SMiuraNKamiya Geometric Goppa codes on (a 0 a 1 a 2 b 0 b 1 b 2 ) 6 some maximal curves and their minimum distance C(n) = n j 0 C(n) in roc IEEE Workshop on Information Theory (Susono-shiJapanJune 1993) pp85-86 [9] (A)vol 1 / 1 J81-A No Oct 1998 X j = (a 0 a 1 a 2 b 0 b 1 b 2) J GF (q) (C) [10] JHSilverman The Arithmetic of Elliptic Curves X(j) = a0 a 1 a 2( ) Springer-Verlag [11] A-MSpallek Kurven vom Geshlecht 2 und ihre Anwendung in ublick-key-kryptosystemen Doctor 8 thesis Universität GH Essen 1994 [12] IEICE ISEC98(1998) 8

9 C ab [13] EJVolcheck Computing in the Jacobian of a plane algebraic curve ANTS-I Lecture Notes in Computer Science vol 877(1994) Springer-Verlag pp [14] M-DHuang DIerardi Efficient Algorithms for the Riemann-Roch roblem and for Addition in the Jacobian of a Curve J Symbolic Computation (1994) [15] WFulton Algebraic Curves Addison-Wesley [16] RHartshorne Algebraic Geometry Springer- Verlag [17] DCox JLittle DO Shea Ideals Varieties and Algorithms Springer-Verlag [18] HStichtenoth Algebraic Function Fields and Codes Springer-Verlag 1990 NEC C&C 9

Σχετικά έγγραφα

IUTeich. [Pano] (2) IUTeich

IUTeich. [Pano] (2) IUTeich 2014 12 2012 8 IUTeich 2013 12 1 (1) 2014 IUTeich 2 2014 02 20 2 2 2014 05 24 2 2 IUTeich [Pano] 2 10 20 5 40 50 2005 7 2011 3 2 3 1 3 4 2 IUTeich IUTeich (2) 2012 10 IUTeich 2014 3 1 4 5 IUTeich IUTeich