Fast exponentiation via prime finite field isomorphism

Size: px

Start display at page:

Download "Fast exponentiation via prime finite field isomorphism"

Kimberly Carson
6 years ago
Views:

1 Alexander Rostovtsev, St Petersburg State Polytechnc Unversty Fast exponentaton va prme fnte feld somorphsm Rasng of the fxed element of prme order group to arbtrary degree s the man operaton specfed by dgtal sgnature algorthms DSA, ECDSA Fast exponentaton algorthms are proposed Algorthms use number system wth algebrac nteger base ± Prme group order r can be factored r =ππ n Eucldean rng [ ± ] by Pollard and Schnorr algorthm Farther factorzaton of prme quadratc nteger π=ρρ n the rng [ ± ] can be done smlarly Fnte feld r s represented as quotent rng [ ± ]/( ρ) Integer exponent k s reduced n correspondng quotent rng by mnmzaton of absolute value of ts norm Algorthms can be used for fast exponentaton n arbtrary cyclc group f ts order can be factored n correspondng number rngs If wndow sze s bts, ths approach allows speedng-up 5 tmes ellptc curve dgtal sgnature verfcaton comparatvely to known methods wth the same wndow sze Key words: fast exponentaton, cyclc group, algebrac ntegers, dgtal sgnature, ellptc curve 1 Introducton Let G be cyclc group of prme computable order Rasng of the fxed element a G to arbtrary degree s the man operaton specfed by many publc key cryptosystems, such as dgtal sgnature algorthms DSA, ECDSA [] In cryptographc applcatons prme group order s more then 100 Group G can be gven as subgroup of fnte feld [6], ellptc curve or Jacoban of hyperellptc curve over fnte feld, class group of number feld, etc Group operaton can be called both addton (addtve group) or multplcaton (multplcatve group) In addtve group rasng element a to exponent k s denoted as ka (scalar multplcaton), n multplcatve group t s denoted as a k Let r >0 be prme order of addtve group G and a G The general method for computng multple b = ka takes bnary representaton of the exponent N k = k [, 6] Let b N = 0 and for = N 1, N,, 0 compute b j = b j+1 f k = 0 = 0 and b = b +1 + a f k = 1 Ths method at average takes log r doublngs and 05 log r addtons There s natural way to speed-up ths method slghtly f element a s fxed Choose wndow sze w bts and compute base {a, a,, ( w 1)a} (snce element a s fxed, ths base can be stored n computer memory) Transton to next wndow takes w doublngs and one addton, so exponentaton takes log r doublngs and (log r)/w addtons Note that sze of the base grows as exponent of w, so wndow sze cannot be large n practce If w = and complextes of doublng and addton are equal, ths gves speedng-up about 0% wth respect to prevous method

2 Ellptc curves over prme fnte felds belong to the set of most popular mathematcal structures n publc key cryptology For example, ellptc curve dgtal sgnature algorthm ECDSA and some natonal dgtal sgnature standards use such ellptc curves The most dffcult operaton durng sgnature generaton and verfcaton s (scalar) multplcaton of the ellptc curve pont by a number, that corresponds to exponentaton Let p > be a prme, p prme fnte feld and E( p ): Y Z = X + AXZ + BZ (1) Weerstrass equaton for ellptc curve Set of ponts (X, Y, Z)\(0, 0, 0), where (X, Y, Z) = (ux, uy, uz) for any u 0, form addtve Abelan group wth zero element P = (0, 1, 0), and (X, Y, Z) = (X, Y, Z) Ellptc curve up to somorphsm over quadratc extenson of prme feld s 1 A unquely determned by ts nvarant j = Ellptc curve arthmetc s A + 7B gven by polynomals over p If (X, Y, Z ) = (X 1, Y 1, Z 1 ), then X Y 1 Z 1 ((X 1 + AZ 1 ) 8X 1 Y 1 Z 1 ), Y Y 1 Z 1 (X 1 (X 1 + AZ 1 ) Y 1 Z 1 ) (X 1 + AZ 1 ), Z 8Y 1 Z 1 If (X, Y, Z ) = (X 1, Y 1, Z 1 ) + (X, Y, Z ), then X (X Z 1 X 1 Z )(Z 1 Z (Y Z 1 Y 1 Z ) (X Z 1 + X 1 Z )(X Z 1 X 1 Z ) ), Y (X Z 1 X 1 Z ) (Y Z 1 (X Z 1 + X 1 Z ) Y 1 Z (X 1 Z + X Z 1 )) Z 1 Z (Y Z 1 Y 1 Z ), Z Z 1 Z (X Z 1 X 1 Z ) Ellptc curve somorphsms are gven by maps: (A, B, X, Y) (u A, u 6 B, u X, u Y) If p (mod ), then usng sutable somorphsm one can obtan A = ±1 The most dffcult operaton durng ellptc curve pont exponentaton s modular multplcaton, so complexty of ellptc curve dgtal sgnature algorthms can be estmated as number of requred modular multplcatons Pont doublng takes 1 modular multplcatons, pont addton takes 15 modular multplcatons If addend pont has Z 1 = 1 (ths often holds n practce), then 1 modular multplcatons are needed for pont addton Some specfc groups admt addtonal exponentaton methods For example, f G s ellptc curve over fnte feld, then for any pont P G ts negatve P can be computed easly comparatvely to pont doublng or pont addton operatons Ths allows usng exponent representaton n number system wth elements ( 1, 0, 1} Hence chans of knd 0, 1, 1,, 1, 1 can be changed by chans 1, 0, 0,, 0, 1 wth reduced number of non-zero dgts (at average from N/ to N/) If wndow sze s 1 bt, ths allows speedng-up exponentaton about 10% But for larger wndow szes speedng-up s neglgble

3 If there exsts element (mod p) and j = 0, then ellptc curve s somorphc to curve Y Z = X tx Z + t XZ Transton to equaton (1) s gven by tz 10t changng X X +, A 56t =, B = Ths ellptc curve has complex 7 multplcaton by : Y( X tz) ( XYZ,, ) = Y Z,,X Z Ellptc curve complex multplcaton takes 7 modular multplcatons Usng complex multplcaton nstead or wth pont doublng gves addtonal acceleraton [8] Sometmes usng Hesse equaton for ellptc curve allows slghtly (about 1 tmes) speed-up pont doublng and pont addton [] But complex multplcaton formula for such equaton s nconvenent Cryptosystem parameters nclude ellptc curve E( p ), pont Q of prme order r, secret key l and publc key P = lq Sgnature generaton takes computng pont R = kq for random k Sgnature verfcaton takes multplcaton of both fxed ponts Q, P by exponents The purpose of ths paper s to propose new fast exponentaton method based on number system wth algebrac nteger base ± or ± and wndow sze two or four bts Then transton to next wndow takes only one doublng (comparatvely to two or four doublngs n known methods) Ths gves sgnfcant acceleraton (more then two tmes) wth respect to known methods Algorthms can be used for fast exponentaton n arbtrary cyclc group f ts order can be factored n correspondng number rngs Algebrac bascs Number felds [ ± ], [ ± ] have rngs of ntegers [ ± ], [ ± ] respectvely These rngs are Eucldean [5] and hence possess unque factorzaton property Group of unts s fnte for rng [ ] and s nfnte for three other rngs: n [ ] free group of unts s generated by number 1+, n [ ] ths group s generated by number 1+, n [ ] ths group s generated by numbers 1+ and 1 [1]± Feld [ ± ] and ts rng of ntegers s quadratc extenson of feld [ ± ] and ts rng of ntegers Galos group of feld [ ± ] over s cyclc of order, t s generated by automorphsm σ ( ± ) = ±, where = 1 In spte of ± defned [ ], norm of algebrac number from feld [ ± ] nto ts subfelds can be

4 Norms of quadratc numbers a+ b, a+ b n are a + b, a b respectvely Norm of algebrac number 0 1 ξ= a + a ± + a ± + a ± n [ ± ] s ξ σ (ξ), and ts norm n feld s ξ σ(ξ) σ (ξ) σ (ξ) Let K = [ z]/( f( z)) s number feld, obtaned by adjonng root α of rreducble polynomal f(z) and O K s Eucldean rng of ntegers n feld K Prme r splts n O K, f f(z) has root (and hence splts completely) modulo r Element α (mod r) s one of roots of f(z) modulo r One can choose ths root ρ so that congruence ρ 0 (mod r) holds Changng element α by a root of the polynomal gves homomorphsm O K r Prme algebrac nteger ρ generates maxmal deal (ρ), so there exsts somorphsm of prme fnte felds r O K /(ρ) Proposed algorthms for rasng to power k use fnte feld representaton r O K /(ρ) and exponent k representaton as element of O K /(ρ) Element of O K /(ρ) s resdue class of algebrac ntegers Congruence k k + βρ (mod ρ) holds for any β O K Chose algebrac nteger β so that absolute norm of k + βρ s mnmal Isomorphsm r O K /(ρ) for felds [ ± ], [ ± ] s computable n both drectons: to compute O K /(ρ) r substtute α α (mod r) Consder nverse somorphsm Rngs [ ± ], [ ± ] are Eucldean over [5], dvson s defned by mn- mzaton of absolute value of the norm Snce norm from [ ± ] to [ ± ] s defned by subgroup of Galos group, rngs [ ± ] are Eucldean over [ ± ] Prme r such that = 1 can be factored n magnary quadratc order by algorthm of Pollard and Schnorr [7], whch s smlar to extended Eucldean algo- r rthm Algorthm 1 Prme nteger factorzaton n magnary quadratc order Input Prme r Output Numbers a, b such that r = a + b Method 1 Compute Jacob symbol If t s 1, then there are no solutons r Compute u (mod r), for example by algorthm n [6] 0, u u, m r Compute m + 1 u +, m u +1 mn{u (mod m +1 ), m +1 u (mod m +1 )}

5 5 If m +1 = 1, then go to step 6 (n ths case equaton holds m = u + 1 ), else + 1 and go to step 6 a u, b 1 7 If = 0, then a a, b b and go to step 9 Else a u a b a u b ± +, b ± a + b a + b Sgns are to be chosen so that dvson result s nteger 8 Set 1 and go to step 7 9 Return: a, b Ths algorthm can be appled to real quadratc order [ ], whch dffers from magnary order by nfnte group of unts In practce t s never mnd whch of numbers r, r s represented as a b If r = a b = ( a+ b )( a b ), then r = b a = ( a+ b )(1+ )( a b )(1 ) So more convenent representaton can be obtaned by multplcaton of dvsor a+ b by unt 1± wth norm 1 For factorng prme number n [ ] frstly factor r n rng [ ] : r a b a b a b = ( + )( ) =ππ= +, () where a+ b 0(mod r), and then fnd factorzaton of ths prme quadratc number n rng [ ] : a+ b = ( c+ d + e + f )( c d + e f ) =ρρ () Prme quadratc number π= a+ b defnes fnte feld [ ]/( π) of r elements Ths feld conssts of resdue classes modulo π quadratc ntegers τ, whch norm Nτ () =ττ satsfes nequalty N(τ) N(τ + βπ) for any β [ ] Snce norm of magnary quadratc nteger s non-negatve, such τ always exsts To compute such τ defne quadratc nteger β= n0 + n1, that norm N(τ + βπ) s mnmal Norm N(τ + βπ) s quadratc functon of n 0, n 1 Optmal ntegers n 0, n 1 can be defned by computng dervatons of norm N(τ + βπ) by varables n 0, n 1 and fndng the nearest ntegers Algorthm Computng feld somorphsm r [ ]/( π) Input: k r, r, π= a+ b Output: k0 + k1 [ ]/( π) Method 1 Set k 0 k, k 1 0 Untl n 0 0, n 1 0, do

6 ak0 + bk1 a Fnd: n0 = r and set k0 + k1 k0 + k1 n0π ak1 bk0 b Fnd: n1 = r and set k0 + k1 k0 + k1 n1π Return: k 0, k 1 Algorthm determnes reducton n rng [ ] modulo prme deal (π) and hence determnes somorphsm of fnte felds r [ ]/( π) Now one can apply algorthm 1 to fnd factorzaton () of quadratc prme nteger π n rng [ ] In ths case all computaton s performed n rng [ ], and n correspondng formulas nteger s to be changed by quadratc nteger Accordng to () number π= a+ b s determned up to sgn, hence, any one of ntegers π, π can be factored General length of coeffcents of number ρ must be mnmal To mnmze the general length obtaned prme algebrac number ρ can be multpled by a unt of rng [ ] Notce that number ρ can be defned once, when cryptosystem parameters are computed Smlarly prme factorzaton of group order can be determned n rng [ ] Snce the quadratc nteger norm can be negatve, n algorthm absolute norm must be mnmzed Accordng to quadratc recprocty low prme r can be factored n [ ] and n [ ] f r (mod 8) Smlarly prme r can be factored n [ ] and n [ ] f r 7 (mod 8) Fast exponentaton method Consder fast exponentaton methods for the fxed element of cyclc group Few varants are possble: usng rngs [ ± ] or [ ± ], usng wndow sze or bts In dependence of rng used the number of doublngs can be reduced or tmes wth respect to usual bnary exponent representaton and the same wndow sze For example, f rng [ ] s used, four bt wndow corresponds to elements = 0 e P, e { 1, 0, 1} Snce we rase the fxed element of cyclc group, then all such elements can be stored n computer memory Transton to next wndow takes only one doublng Two bt wndow corresponds to elements ep+ e P If cyclc group s ellptc curve wth j = 0, then transton to next 0 1 wndow takes only one complex multplcaton by If quadratc order [ ± ] and fnte feld [ ± ]/( π) s used, any exponent 0 < k < r can be represented as k k0 + k1 ± (mod π ) by algorthms 1 and so that ts absolute norm s mnmal Total length of k 0, k 1 s less or equal to length of r

7 Let prme dvsor ρ [ ] of the group order r wth mnmal norm over s computed Then any exponent 0 < k < r can be represented as set (k 0, k 1, k, k ): k ρ k (mod ) so that norm of ths algebrac nteger s mnmal Fnd alge- = 0 β= n so that norm N(k βρ) n s mnmal For ths frstly = 0 brac nteger fnd approxmaton to k n quadratc order [ ] usng algorthm, then apply algorthm to extenson [ ]/ [ ] Dervaton of norm functon s lnear functon of n, what smplfes computaton (drectly norm [ ]/ computaton leads to solvng cubc equatons, ths wll complcate fndng of n ) Algorthm Computng feld somorphsms [ ]/( ρ) and [ ]/( π) Input: k0 + k [ ]/( π), π, ρ= c+ d + e + f Output: k0 + k1 + k + k [ ]/( ρ) Method 1 Set k 1 0, k 0, 0 1 κ= k + k + k + k Whle n 0, n 1, n, n 0, fnd ntegers n that gve mnmal norm n of n κ ρ and set κ κ n ρ k0 k1 k k Return: κ= [ ]/( ρ) Consder varants of exponentaton algorthm Let rng [ ] s used ( s quadratc resdue modulo r) Fnd factorzaton () usng algorthm 1 and fnd representaton k k0 + k1 (mod π ) usng algorthm : k 0 = k 00 + k 01 + k 0 +, k 1 = k 10 + k 11 + k 1 + Wrte exponent k n number system wth base : k k + k k k + (mod π ) If sgns of ntegers k 0, k 1 are the same, then sgns alternaton s +, +,,, +, +,, or ts nverse Ths s normal alternaton sgns If sgns of k 0, k 1 are dfferent, then alternaton of sgns s not normal (+,,, + or ts nverse) Sometmes t s suffcent to use precomputaton base only for normal alternaton of sgns, e { ep+ e P ep e P}, e {0, 1} For example, f ellptc curve has 0 1 complex multplcaton by, normal alternaton of sgns can be obtaned by exponent representaton as k k + ( k k k + )(mod π ) () Number n brackets has normal alternaton of sgns Assume that we can multply ellptc curve pont by an exponent wth normal alternaton of sgns Then we

8 can multply t by an exponent wth arbtrary alternaton: frstly multply pont by an exponent n brackets (), apply complex multplcaton and add pont k 00 P If real quadratc rng [ ] s used and factorzaton of group order s ± r =ππ= a b, normal alternaton of sgns corresponds to the same sgns of k 0, k 1 To obtan normal alternaton of sgns t s necessary to transform n () k k ± u ε π, where u s fundamental unt and ε { 1, 0, 1} Both n magnary and real quadratc rngs transton to next number takes two doublngs for bt wndow and one doublng for bt wndow Let rng [ ] s used and prme dvsor ρ [ ] of group order s known For multply pont P by nteger k, fnd algebrac representaton of k: k + k + k + k [ ]/( ρ) Let k = k 0 + k 1 + bnary 0 1 dgts of ts coeffcents Wrte exponent k n number system wth base : k = k + k + k + k k (5) Defne normal alternaton of sgns: +, +, +, +,,,, or ts nverse Ths corresponds to the case when all k has the same sgn Normal alternaton can by obtaned by changng n (5): k k ± βρ, where β [ ] s small algebrac n- teger (wth small absolute norm) Precomputaton table contans 15 or elements for wndow sze or bts respectvely If wndow sze s bts, then transmttng to next wndow takes only one pont doublng If wndow sze s bts, then transmttng to next wndow takes only one complex multplcaton by For rng [ ] exponentaton method s performed smlarly But exponent representaton takes consderng two generators of group of unts, so exponent representng as element of rng [ ] wth mnmal length s less convenent Ths 8 reasonng shows that use of rngs [ ± ] may have lttle or no advantage snce rank of ts group of unts ncreases Consder the complexty of ellptc curve pont multplcaton f length of exponent s N bts and wndow sze s bts Usual method takes 1 + 1N modular N N N multplcatons If rng [ ± ] s used, pont multplcaton takes modular multplcatons If rng [ ± ] s used, pont multplcaton takes N N modular multplcatons Hence, for N = 160 bts pont exponentaton can be speeded-up about 16 tmes for quadratc rng and about 5 tmes for rng [ ± ] comparatvely to known methods The hardest operaton durng dgtal sgnature verfcaton accordng to ECDSA s ellptc curve fxed pont multplcaton So proposed method allows speedng-up dgtal sgnature verfcaton 16 or 5 tmes for wndow sze or bts respectvely

9 Consder small numercal example for the rngs [ ], [ ] Let r = 6019 Fnd 565(mod r), 91(mod r) Fnd prme algebrac dvsors of prme nteger r usng algorthm 1: π= 1+ 7, ρ= Let k = 15 Fnd mage of k n fnte feld [ ]/( π) Algorthm gves n 0 = 5, n 1 = 1 and exponent s k 9 51 (mod π ) Fnd mage of the exponent n fnte feld [ ]/( ρ) : (mod ρ ) Exponent k representaton base s k + + (mod ρ ) If wndow sze s bts, then exponent k s gven by quadrples (0, 0, 1, 0), (0, 0, 1, 1), (0, 0, 0, 1) (begnnng from the least sgnfcant dgts) Alternaton of sgns s normal The next wndow passage takes one doublng So only two doublngs and two addtons are needed If known method wth the same wndow sze s used, then 15 = Exponentaton takes two addtons and eght doublngs References 1 J Cohen A course n computatonal algebrac number theory, Sprnger- Verlag, 1996 FIPS 186, Dgtal Sgnature Standard, Federal Informaton Processng Standards Publcaton 186, US Department of Commerce/ NIST, Natonal Techncal Informaton Servce, Sprngfeld, Vrgna HR Frum The group low on ellptc curves n Hesse form Techncal report corr D Gordon A survey of fast exponentaton methods // Journal of algorthms, 7 (1998), F Lemmermeyer The Eucldean algorthm n algebrac number felds, Expo Math 1, No 5 (1995), A Menezes, P van Oorchot and S Vanstone Handbook of appled cryptography CRC Press, J Pollard and C Schnorr An effectve soluton of the congruence x + ky = m (mod n) // IEEE proceedngs on Informaton theory, v (1987), AG Rostovtsev and EB Makhovenko Ellptc curve pont multplcaton // IACR e-prnt archve, 00/088

2x x l. Module 3: Element Properties Lecture 4: Lagrange and Serendipity Elements

2x x l. Module 3: Element Properties Lecture 4: Lagrange and Serendipity Elements Module 3: Element Propertes Lecture : Lagrange and Serendpty Elements 5 In last lecture note, the nterpolaton functons are derved on the bass of assumed polynomal from Pascal s trangle for the fled varable.