Presentation on theme: "Graduate School of Natural Science and Technology Okayama University Yumi Sakemi, Hidehiro Kato, Shoichi Takeuchi, Yasuyuki Nogami and Yoshitaka Morikawa."— Presentation transcript:
Graduate School of Natural Science and Technology Okayama University Yumi Sakemi, Hidehiro Kato, Shoichi Takeuchi, Yasuyuki Nogami and Yoshitaka Morikawa Two Improvements of Twisted Ate Pairing with Barreto–Naehrig Curve by Dividing Miller’s Algorithm
Elliptic curve cryptography Finite field theory Background Pairing based cryptography Identity(ID)-based cryptography ( Sakai et al. 2000 ) Group signature ( Boneh et al. 2003 ) An efficient algorithm for pairing calculation is required. 2 expensive operation!! Pairing Pairing based cryptography
Elliptic Curve over Finite Field ○ Finite fields ○ Elliptic curve over ● ： rational point Prime field Extension Field order of ： 3 Group of rational points on the curve ： ： embedding degree
Pairing 4 Group 1 Group 2 Group 3 order= r e additive multiplicative
Pairing 7 Group 1 Group 2 Group 3 order = r Bilinearity Innovative cryptographic applications are based on bilinearity of pairing.
Pairing 8 Group 1 Group 2 Group 3 order = r Final exponentiation Miller’s algorithm Weil Tate Ate Twisted Ate slow fast Miller’s algorithm Several improvements for pairing (1946) (2006) (1994) (2006)
Barreto-Naehrig(BN) Curve Elliptic curve of k =12 Parameters p, r and t of BN curve are given by integer variable as 9
Miller’s Algorithm Output : i-th bit of the binary representation of s from the lower Hw(s) : Hamming Weight of s Hw(s) is large → computationally expensive 10 yes no yes no additional operation main loop Input :
Twisted Ate Pairing with BN Curve It is not easy to control the Hw(s) small !! 11 : integer We can select of small hamming weight.
Improvement 1 conventional method Miller’s algorithm ( s ) 12 Out put Improvement 1 is based on divisor theorem proposed method Miller’s algorithm ( ) Miller’s algorithm ( ) Miller’s algorithm ( ) Combining Output
Improvement 2 Miller’s algorithm ( a ) Miller’s algorithm ( ab ) Output f ab Miller’s algorithm ( b ) combining fafa fbfb f ab = f a b ･ f b An exponentiation is additionally required !! f ap = f a p ･ f p Frobenius mapping 12
Improvement 2 conventional method Miller’s algorithm ( s ) Out put 13 proposed method Miller’s algorithm ( ) Miller’s algorithm ( p ) combining and some calculations Output s = ( 6 － 3 ) p + ( 6 － 1) s = 36 3 － 18 2 ＋ 6 － 1 f s is given by f and f p.