Recently, pairing-based cryptographies such as ID-based cryptography and group signature have been studied. For fast pairing calculation, not only pairing algorithms but also arithmetic operations in extension field must be efficiently carried out. The authors show efficient arithmetic operations of extension field for Xate pairing especially with Freeman curve

Kato, Hidehiro

Morikawa, Yoshitaka

Nekado, Kenta

Nogami, Yasuyuki

Okayama University Scientific Achievement Repository

Kenta NEKADO¤Graduate School of Natural Science andTechnology, Okayama University3-1-1, Tsushima-naka, Okayama, Okayama700-8530, JapanHidehiro KATO¤Graduate School of Natural Science andTechnology, Okayama University3-1-1, Tsushima-naka, Okayama, Okayama700-8530, JapanYasuyuki NOGAMI¤Graduate School of Natural Science andTechnology, Okayama University3-1-1, Tsushima-naka, Okayama, Okayama700-8530, JapanYoshitaka MORIKAWA¤Graduate School of Natural Science andTechnology, Okayama University3-1-1, Tsushima-naka, Okayama, Okayama700-8530, JapanRecently, pairing-based cryptographies such as ID-based cryptography and group signature havebeen studied. For fast pairing calculation, not only pairing algorithms but also arithmetic op-erations in extension ¯eld must be e±ciently carried out. The authors show e±cient arithmeticoperations of extension ¯eld for Xate pairing especially with Freeman curve.1 INTRODUCTIONIn recent years, pairing-based cryptographies such asID-based cryptography [1] and group signature [2] havebeen studied. For their implementations, pairings suchas Weil pairing [1], Tate pairing, Ate pairing [3] andXate pairing [4] have been used. In order to implementthese pairings, several kinds of ordinary pairing-friendlycurves such as Miyaji-Nakabayashi-Takano (MNT)curve [5], Barreto-Naehrig (BN) curve [6] and Freemancurve [7, 8] have been proposed. As the de¯nition ¯eldof these curves, many researchers use optimal extension¯eld (OEF) [9] because OEF carries out arithmetic oper-ations e±ciently. However, it is known that OEF is notavailable for the de¯nition ¯eld of Freeman curve due tothe condition of OEF. Our previous work namely TypeI-X all one polynomial ¯eld (AOPF) [11] is available forthe de¯nition ¯eld of Freeman curve. Type I-X AOPFcan carry out arithmetic operations as e±cient as OEF.In this paper, the authors consider how to const-ructed type I-X AOPF and optimize a multiplicationalgorithm for Xate pairing with Freeman curve. Addi-tionally, this paper shows some experimental results ofXate pairing with Freeman curve de¯ned over the type¤E-mail: f nekado, kato, nogami, morikawa g@trans.cne.okayama-u.ac.jpI-X AOPF. Then, it is shown that the proposed methodworks approximately 10 percent faster than the conven-tional method.Notation : Fp, Fpm , and F¤pm denote a prime ¯eld,m-th extension ¯eld over Fpm , and the multiplicativegroup in Fpm . For two integers m and n, mjn meansthat m divides n. E(Fpm) denotes the elliptic curvede¯ned over Fpm .2 XATE PAIRING WITH FREEMANCURVEThis section brie°y reviews Ate pairing, Freemancurve, and Xate pairing.2.1 Ate PairingThe smallest positive integer d such that rj(pd ¡ 1)is called embedding degree, then let G1 and G2 beG1 = E(Fpd)[r] \Ker(Á¡ [1]); (1a)G2 = E(Fpd)[r] \Ker(Á¡ [p]); (1b)where E(Fpd)[r] denotes the set of rational points oforder r in E(Fpd). Let P 2 G1 and Q 2 G2, Ate pairinge is de¯ned ase :(G2 £G1 ! F¤pd=(F¤pd)r;(Q;P ) 7! fT;Q(P )(pd¡1)=r:(2)Extension Field for Xate Pairing with Freeman CurveThis work is subjected to copyright.All rights are reserved by this author/authors.(Received December 9, 2008)Memoirs of the Faculty of Engineering, Okayama University, Vol. 43, pp. 108-112, January 2009108It gives a non-degenerate and bilinear map. The pa-rameter T is given asT = (t¡ 1)i mod r (1 · i < d); (3)where t is Frobenius trace. Ate pairing consists of twosteps, one is fT;Q(P ) calculation by Miller's algorithm,and the other is the calculation called ¯nal exponentia-tion that fT;Q(P ) is raised to the ((pd¡1)=r)-th power.The number of iterations in Miller's algorithm of Atepairing is given by blog2(T )c.Devegili et al. have improved Ate pairing by usingsub¯eld-twisted curve [6]. However, this technique cannot be applied to Ate pairing with Freeman curve be-cause in order to apply this technique we need to useOEF as the de¯nition ¯eld. On the other hand, Nogamiet al. have also improved Ate pairing by using the simi-lar technique [10]. It is called cross-twisted Ate (Xt-Ate)paring and can be used even in the case of Freemancurve.2.2 Freeman CurveFreeman curve is a class of ordinary pairing-friendlycurves of embedding degree d = 10 [7, 8]. The parame-ters of Freeman curve E(Fp) are given asp(Â) = 25Â4 + 25Â3 + 25Â2 + 10Â+ 3; (4a)r(Â) = 25Â4 + 25Â3 + 15Â2 + 5Â+ 1; (4b)T (Â) = (t(Â)¡ 1)2 = 5Â2; (4c)where Â is an integer such that p(Â) becomes a primenumber. Xt-Ate pairing with Freeman curve E(Fp10)uses its quadratic twisted curve E0(Fp5). Thus, we needto prepare sub¯eld Fp5 besides the de¯nition ¯eld Fp10 .2.3 Xate PairingNogami et al. have proposed integer variable Â-basedAte (Xate) pairing [4]. In the case of Freeman curve,Xate paring e0 is given ase0 :(G2 £G1 ! F¤pd=(F¤pd)r;(Q;P ) 7! f^Â;Q(P )(pd¡1)=r:(5)It also gives a non-degenerate and bilinear map. f^Â;Q(P )can be calculated by Miller's algorithm, and the numberof iterations becomes only blog2(Â)c. Moreover, we canapply Xt-Ate paring technique to Xate pairing, namelyXt-Xate pairing.3 EXTENSION FIELD FOR FREEMANCURVEBailey et al. have proposed optimal extension ¯eld(OEF) [9]. It needs to satisfy the condition that eachprime factor ofm divides p¡1, for example. OEF carriesout arithmetic operations e±ciently. However, accord-ing to Eq.(4a), OEF technique can not be applied forconstructing Fp5 of Eq.(4a) because 5 does not dividesp(Â)¡ 1.The authors have proposed type I-X all one polyno-mial ¯eld (AOPF) [11]. Type I-X AOPF technique canbe applied for constructing Fp5 of Eq.(4a) because it hasbeen proven that type I-X AOPF is prepared for everypair of characteristic p and extension degree m whenp>m [11].First, we review type I-X AOPF and then considerhow to construct type I-X AOPF for Freeman curve.3.1 Type-hk;mi Gauss Period Normal BasisType I-X AOPF F(pn)m is constructed by m-th tow-ering over Fpn with type-hk;mi Gauss period normalbasis (GNB) [12] when gcd (m;n) = 1. Type-hk;miGNB is de¯ned with a certain integer k as follows.De¯ne 1 : Let km+1 be a prime number not equalto p and suppose that gcd (km=e;m) = 1, where e is theorder of p modulo km+1. Then, for any primitive k-throot µ of unity in Fkm+1 ,° =k¡1Xi=0¯µi(6)generates a normal basis f°; °p; ¢ ¢ ¢ ; °pm¡1g in Fpm ,where ¯ is a (km + 1)-st root of unity that belongs toFpe . This normal basis is called type-hk;mi GNB. ¥Type-hk;mi GNB is available when 4p does not di-vide m(p ¡ 1) [13]. Therefore, type I-X AOPF F(pn)mcan be constructed for every pair of characteristic p andextension degree m when p>m, for instance.3.2 Cyclic Vector Multiplication AlgorithmAs an e±cient multiplication algorithm in type I-XAOPF, the authors have proposed cyclic vector multi-plication algorithm (CVMA) [13]. Fig.1 shows CVMAin F(pn)m .In the algorithm of Fig.1, q[0] becomes 0 when k iseven [13]. Then, the calculation cost of CVMA is ex-plictly given as follows. Note that An and Mn denotethe computational costs of an addition and a multipli-cation in Fpn , respectively.Mmn =m(m+ 1)2Mn+8>>>>>><>>>>>>:µµm(m¡1)(k+2)2¡ 1¶+k¡1+m¶Anwhen k is odd;µm(m¡1)(k+2)2¶An when k is even:(7)Kenta NEKADO et al. MEM.FAC.ENG.OKA.UNI. Vol. 43109As shown in Eq.(7), CVMA needs more additions in Fpnas k becomes larger. Usually, An is much smaller thanMn. However, if the number of additions in Fpn is muchmore than that of multiplications in Fpn , it will not benegligible.Input: X =m¡1Xi=0xi°pi ; Y =m¡1Xi=0yi°pi (xi; yi 2 Fpn).Output: Z = XY =m¡1Xi=0zi°pi (zi 2 Fpn).Preparation:1. Determine k that satis¯es the conditions in Def.1.2. For 0 · i · m; q[i]Ã 0.3. For 0 · t < m and 0 · h < k; g[pt+hm]Ã t+ 1.4. g[0]Ã 0.Procedure:1. For 0 · i < m; q[i+ 1]Ã xtyt.2. For 0 · i < j · m¡ 1, f3. Rij Ã (xi ¡ xj)(yi ¡ yj),4. For 0 · h · k ¡ 1, f5. qg[pi + pj+hm]Ã q g[pi + pj+hm]+Rij .6. g7. g8. For 0 · i < m; zi Ã kq[0]¡ q[i+ 1].(End of algorithm)y hxi means x mod km+ 1.Figure 1: CVMA in F(pn)m3.3 Itoh-Tsujii AlgorithmAs an inversion algorithm in type I-X AOPF F(pn)m ,Itoh-Tsujii algorithm (ITA) [14] that uses Frobeniusmap is available. Consider a non-zero element X thatbelongs to F(pn)m , its inverse element is given asX¡1 =Xpn ¢ ¢ ¢X(pn)m¡1XXpn ¢ ¢ ¢X(pn)m¡1 : (8)Then, XXpn ¢ ¢ ¢X(pn)m¡1 becomes a non-zero elementthat belongs to Fpn because it is the norm of X with re-spect to Fpn . In the case of type I-X AOPF, Frobeniusmap X ! Xpn dose not need any algebraic calculationssuch as additions and multiplications because the coef-¯cients of Xpnis just a cyclic shift of the coe±cients ofX [12].4 TYPE I-X AOPF FOR FREEMANCURVEFreeman has shown four kinds of pairing-friendlycurves [7, 8]. Their characteristic p's are given as follows.p=503189899097385532598615948567975432740967203(149¡bit) (9a)p=6109996327108312874607376956794487035427061646150914794603 (196¡bit) (9b)p=18211650803969472064493264347375950045934254696657090420726230043203803 (234¡bit) (9c)p=6462310997348816962203124910505252082673338846966431201635262694402825461643 (252¡bit) (9d)In these cases, each minimal k such that type I-X AOPFFp5 can be constructed is given as Table 1, and typeI-X AOPF F(p5)2 can be prepared by 2nd towering overFp5 with type-h2; 2i GNB.Table 1: The minimal kp Eq.(9a) Eq.(9b) Eq.(9c) Eq.(9d)k 2 6 8 6In order to make pairing-based cryptography practical,the characteristic p needs to be larger than or equal to160-bit. The k of Eqs.(9b), (9c), or (9d) that satis¯esp¸160 are larger than or equal to 6 as shown Table 1.For example, with type-h6; 5i GNB as Fig.2, thecomputation amount of a multiplication in Fp5 is givenasM5 = 15M1 + 80A1: (10)If we can apply type-h2; 5i GNB, the computationamount of a multiplication in Fp5 is given asM5 = 15M1 + 40A1: (11)Thus, a multiplication in Fp5 with type-h6; 5i GNBneeds twice as many additions in Fp as that with type-h2; 5iGNB. In what follows, we consider how to decreasethe number of additions in Fp of a multiplication in Fp5with type-h6; 5i GNB.F(p5)2Fp5Fp662nd toweringwith type-h2; 2i GNB5th extendingwith type-h6; 5i GNBFigure 2: Type I-X AOPF F(p5)2January 2009 Extension Field for Xate Pairing with Freeman Curve1104.1 Improvement Of CVMA For Freeman CurveFor example, in type I-X AOPF Fp5 of Eq.(9b),CVMA needs to calculate the following equations.q[0] = 0; (12a)q[1] = x0y0 + 2R01 + R03 + R12 + 2R13+ R14 + 2R23 + 2R24 + R34; (12b)q[2] = x1y1 + R02 + 2R03 + R04 + 2R12+ R14 + R23 + 2R24 + 2R34; (12c)q[3] = x2y2 + R01 + R02 + 2R03 + 2R04+ R13 + 2R14 + 2R23 + R34; (12d)q[4] = x3y3 + 2R01 + 2R02 + R04 + R12+ R13 + 2R14 + R24 + 2R34; (12e)q[5] = x4y4 + R01 + 2R02 + R03 + 2R04+ 2R12 + 2R13 + R23 + R24: (12f)Eqs.(12) except for xiyi can be expressed with the ma-trix shown as Eq.(13). In this matrix, the lows corre-spond to q[1], q[2], q[3], q[4] and q[5], and the columnscorrespond to the coe±cients of R01, R02, R03, R04,R12, : : : , R24 and R34.0BBBBB@2 0 1 0 1 2 1 2 2 10 1 2 1 2 0 1 1 2 21 1 2 2 0 1 2 2 0 12 2 0 1 1 1 2 0 1 21 2 1 2 2 2 0 1 1 01CCCCCA (13)Then, it can be decomposed as0BBBBB@0 0 1 0 1 0 1 0 0 10 1 0 1 0 0 1 1 0 01 1 0 0 0 1 0 0 0 10 0 0 1 1 1 0 0 1 01 0 1 0 0 0 0 1 1 01CCCCCA+0BBBBB@2 0 0 0 0 2 0 2 2 00 0 2 0 2 0 0 0 2 20 0 2 2 0 0 2 2 0 02 2 0 0 0 0 2 0 0 20 2 0 2 2 2 0 0 0 01CCCCCA : (14)Then, consider the following components Cj whose suf-¯xes j means the column vector of the former matrix ofEq.(14).C00101 = R01 + 2R04; C01100 = R02 + 2R03; (15a)C10001 = R03 + 2R13; C01010 = R04 + 2R34; (15b)C10010 = R12 + 2R01; C00110 = R13 + 2R14; (15c)C11000 = R14 + 2R24; C01001 = R23 + 2R12; (15d)C00011 = R24 + 2R02; C10100 = R34 + 2R23: (15e)Then, Eq.(12) can be recomposed asq[0] = 0; (16a)q[1] = x0y0 + C11000 + C10100 + C10010 + C10001;(16b)q[2] = x1y1 + C11000 + C01100 + C01010 + C01001;(16c)q[3] = x2y2 + C10100 + C01100 + C00110 + C00101;(16d)q[4] = x3y3 + C10010 + C01010 + C00110 + C00011;(16e)q[5] = x4y4 + C10001 + C01001 + C00101 + C00011:(16f)In this case, the computation amount of a multiplica-tion in Fp5 is given as follows. Note that Dn denotesthe computational cost of a doubling in Fpn .M5 = 15M1 + 50A1 + 10D1: (17)Table 2 shows the computation amounts of a mul-tiplication in each Fp5 and Fp10 .Table 2: The computation amounts of a multiplicationwith original CVMA with improved CVMAFp5 (15, 80, 0) y (15, 50, 10) yF(p5)2 (45, 260, 0) y (45, 185, 30) yy For example, (15, 50, 10) denotes 15M1 + 50A1 + 10D1.4.2 Reduction Of Modulo p OperationsA multiplication in extension ¯eld needs a lot of mul-tiplications in prime ¯eld Fp, thus we need a lot of mod-ulo p operations. However, the calculation time of mod-ulo p operation is much larger than that of other oper-ations such as addition and multiplication. If we haveenough memory, we do not need to carry out modulo poperation for every multiplication in Fp. Therefore, theauthors carried out modulo p operation only at step 8.4.3 Improvement Of The Inversion AlgorithmAs previously introduced, we use ITA as the inver-sion algorithm in type I-X AOPF. In ITA, we calculatean inversion in F(p5)2 with a norm in Fp. In general, wedirectly calculate this norm. However, by calculatingthis norm after the calculation of the norm with respectto the sub¯eld Fp5 , we can carry out an inversion moree±ciently. Table 3 shows the computation amounts of ainversion in each Fp5 and F(p5)2 with the sub¯eld. Notethat In means the computational cost of an inversion inFpn .Kenta NEKADO et al. MEM.FAC.ENG.OKA.UNI. Vol. 43111Table 3: The computation amounts of an inversionwith original CVMA with improved CVMAFp5 (44, 188, 0, 1) y (44, 124, 24, 1) yF(p5)2 (104, 523, 0, 1) y (104, 339, 64, 1) yy For example, (44, 124, 24, 1) denotes 44M1+114A1+24D1+I1.5 SIMULATIONThis section shows the implementation result of theproposed method. In this implementation, we use char-acteristic p of Eq.(9b). Table 4 shows the calculationtimings of a multiplication and an inversion in each Fp5and F(p5)2 with the computational environment Table5. Table 6 shows the implementation result of Xt-Xatepairing with the extension ¯eld proposed in this paper.Table 4: Timing of each operationwith original with improvedCVMA CVMAFp5mul 8.03 ¹s 7.31 ¹sinv 30.0 ¹s 28.4 ¹sF(p5)2mul 21.6 ¹s 19.2 ¹sinv 59.4 ¹s 55.5 ¹sTable 5: Computational environmentCPU Pentium4 3.00GHzCache Size 512 KBOS Linux 2.6.27Language CCompiler gcc 4.3.2Library GNU MP 4.2.4 [15]Table 6: Timing of Xt-Xate pairingwith original with improvedCVMA CVMAMiller's algorithm 7.74 ms 6.94 msFinal exponentiation 4.28 ms 3.79 msTotal 12.0 ms 10.7 msTable 6 shows that the extension ¯eld Fp5 and F(p5)2proposed in this paper are more e±cient for Xt-Xatepairing with Freeman.6 CONCLUSIONIn this paper, we have considered how to constructedtype I-X AOPF and optimized CVMA for Ate pairingwith Freeman curve. Additionally, we showed the imple-mentation result of Xt-Xate pairing with Freeman curvede¯ned over type I-X AOPF. Then, it was shown thatthe proposed method works approximately 10 percentfaster than the conventional method.ACKNOWLEDGMENTThis research is supported by \Strategic Informa-tion and Communications R&D Promotion Programme(SCOPE)" from Ministry of Internal A®airs and Com-munications (MIC), Japan.We thank A. J. Devegili for reading our paper andnotifying some typos.REFERENCES[1] R. Sakai, K. Ohgishi and M. Kasahara: SCIS 2000,Jun. 2000, Okinawa, 26-28.[2] D. Boneh, X. Boyan and H. Shacham: Proc.of Crypto2004, Lect. Notes Comput. Sci., 3152(2004), 41-55.[3] H. Hess, N. P. Smart and F. Vercauteren: IEEETrans. Inf. Theory, 52 (2006), 4595-4602 .[4] Y.Nogami, M.Akane, Y.Sakemi, H.Kato andY.Morikawa: Pairing 2008, LNCS, 5209 (Aug.2008), 178-191.[5] A. Miyaji, M. Nakabayashi and S. Takano: IEICETrans. Fundam., E84-A(5) (2001), 1234-1243.[6] A. J. Devegili, M. Scott and R. Dahab: LNCS, 4575(2007), 197-207.[7] D. Freeman: ePrint (2006).[8] D. Freeman: LNCS, Springer Berlin/Heidelberg,4076 (Oct. 2006), 452-465.[9] H. Cohen and G. Frey: Chapman & Hall/CRC(2005).[10] Y.Nogami, M.Akane, Y.Sakemi and Y.Morikawa:ICCIT2008, 2 (Nov. 2008), Busan, 430-439.[11] T. Yoshida, H. Kato, Y. Nogami and Y. Morikawa:The 2nd Joint Workshop on Information Security,Aug. 2007, Tokyo, Japan, 469-483.[12] S. Gao: Doctoral thesis, 1993, Waterloo, Ontario,Canada.[13] Hidehiro Kato, Yasuyuki Nogami, Tomoki Yoshidaand Yoshitaka Morikawa: ETRI Journal, 29-6(Dec. 2007).[14] T. Itoh and S. Tsujii: Inf. and Comp., 78 (1988),171-177.[15] GNU Multiple Precision Arithmetic Library, avail-able at \http://gmplib.org".January 2009 Extension Field for Xate Pairing with Freeman Curve112

Extension Field for Xate Pairing with Freeman Curve

Abstract

Similar works

Full text

Available Versions

Okayama University Scientific Achievement Repository