An Algorithm for the η T Pairing Calculation in Characteristic Three and its Hardware Implementation Jean-Luc Beuchat 1 Masaaki Shirase 2 Tsuyoshi Takagi 2 Eiji Okamoto 1 1 Graduate School of Systems and Information Engineering University of Tsukuba, Japan 2 Future University-Hakodate, Japan Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 1 / 25
Outline of the Talk Example: Three-Party Key Agreement 1 Computation of the η T Pairing 2 Hardware Architecture 3 Conclusion 4 Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 2 / 25
Example: Three-Party Key Agreement Key agreement How can Alice, Bob, and Chris agree upon a shared secret key? Alice Bob ? Chris Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 3 / 25
Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 4 / 25
Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice Bob a b aP bP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 4 / 25
Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice aP Bob a b aP bP bP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 4 / 25
Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice Bob a b abP abP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 4 / 25
Example: Three-Party Key Agreement Alice Bob a b aP bP Chris c cP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 5 / 25
Example: Three-Party Key Agreement Alice Bob a b aP bP bP First round aP cP Chris c cP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 5 / 25
Example: Three-Party Key Agreement Alice Bob a b abP bcP Chris c acP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 5 / 25
Example: Three-Party Key Agreement Alice Bob a b abP bcP bcP Second round abP acP Chris c acP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 5 / 25
Example: Three-Party Key Agreement Alice Bob a b abcP abcP Chris c abcP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 5 / 25
Example: Three-Party Key Agreement Three-party two-round key agreement protocol Does a three-party one-round key agreement protocol exist? Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 6 / 25
Example: Three-Party Key Agreement Bilinear pairing G 1 = � P � : additively-written group G 2 : multiplicatively-written group with identity 1 A bilinear pairing on ( G 1 , G 2 ) is a map ˆ e : G 1 × G 1 → G 2 that satisfies the following conditions: Bilinearity. For all Q , R , S ∈ G 1 , 1 ˆ e ( Q + R , S ) = ˆ e ( Q , S )ˆ e ( R , S ) and ˆ e ( Q , R + S ) = ˆ e ( Q , R )ˆ e ( Q , S ). Non-degeneracy. ˆ e ( P , P ) � = 1. 2 Computability. ˆ e can be efficiently computed. 3 Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 7 / 25
Example: Three-Party Key Agreement Bilinear Diffie-Hellman problem (BDHP) e ( P , P ) abc Given P , aP , bP , and cP , compute ˆ Assumption: the BDHP is difficult Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 8 / 25
Example: Three-Party Key Agreement Alice Bob a b aP bP Chris c cP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 9 / 25
Example: Three-Party Key Agreement bP Alice Bob a b aP bP aP aP cP bP cP Chris c cP Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 9 / 25
Example: Three-Party Key Agreement Alice Bob a b ˆ e ( bP , cP ) a e ( aP , cP ) b ˆ e ( bP , cP ) a = ˆ e ( aP , cP ) b = ˆ e ( aP , bP ) c = ˆ e ( P , P ) abc ˆ Chris c e ( aP , bP ) c ˆ Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 9 / 25
Example: Three-Party Key Agreement Examples of cryptographic bilinear maps Weil pairing Tate pairing η T pairing (Barreto et al. ) Ate pairing (Hess et al. ) Applications Identity based encryption Short signature Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 10 / 25
Computation of the η T Pairing Elliptic curve over F 3 m Q = ( x q , y q ) P = ( x p , y p ) P η T pairing η T ( P , Q ) η T ( P , Q ) W ∈ F 3 6 m Exponentiation calculation ( F 3 6 m ) Q Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 11 / 25
Computation of the η T Pairing – Tower Field ρ 2 1 ρ F 3 6 m = F 3 2 m [ ρ ] / ( ρ 3 − ρ − 1) 1 σ F 3 2 m = F 3 m [ σ ] / ( σ 2 + 1) x 2 x m − 3 x m − 2 x m − 1 1 x F 3 m = F 3 [ x ] / ( f ( x )) F 3 = Z / 3 Z = { 0, 1, 2 } Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 12 / 25
Computation of the η T Pairing – Tower Field F 3 2 m F 3 2 m F 3 2 m ρ 2 σρ 2 1 σ ρ σρ 12 m bits F 3 6 m x m − 3 x m − 2 x m − 1 x 2 1 x 2 m bits F 3 m 2 bits F 3 Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 13 / 25
Computation of the η T Pairing η T ( P , Q ) Addition Multiplication Cubing Cube root Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 14 / 25
Computation of the η T Pairing m +1 η T ( P , Q ) 3 2 η T ( P , Q ) Addition Addition Multiplication Multiplication Cubing Cubing Cube root Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 14 / 25
Computation of the η T Pairing m +1 η T ( P , Q ) 3 2 η T ( P , Q ) Addition Addition Multiplication Multiplication Cubing Cubing Cube root Bilinearity of η T ( P , Q ) W � 2 � W m +1 � � � 3 η T ( P , Q ) W = 3 m � �� m − 1 � η T 3 P , Q � 2 Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 14 / 25
Computation of the η T Pairing Multiplication over F 3 6 m – Exponentiation Only one multiplication Operands: A and B ∈ F 3 6 m Cost: 18 multiplications and 58 additions over F 3 m Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 15 / 25
Computation of the η T Pairing Multiplication over F 3 6 m – Exponentiation Only one multiplication Operands: A and B ∈ F 3 6 m Cost: 18 multiplications and 58 additions over F 3 m Multiplication over F 3 6 m – η T ( P , Q ) m +1 multiplications 2 Operands: A and B ∈ F 3 6 m with ρ 2 σρ 2 1 σ ρ σρ A = 0 − 1 0 a 0 a 1 a 2 a 0 , a 1 , and a 2 ∈ F 3 m Cost: 13 multiplications and 46 additions over F 3 m Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 15 / 25
Hardware Architecture P = ( x p , y p ) η T ( P , Q ) η T ( P , Q ) W Exponentiation Q = ( x q , y q ) η T pairing calculation Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 16 / 25
Hardware Architecture P = ( x p , y p ) η T ( P , Q ) η T ( P , Q ) W Exponentiation Q = ( x q , y q ) η T pairing calculation Multiplication over F 3 6 m New algorithm ◮ 15 multiplications and 29 additions over F 3 m ◮ Allows one to share operands between multipliers (less registers) Architecture ◮ 9 multipliers ◮ Most significant coefficient first (Horner’s rule) Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 16 / 25
Hardware Architecture Prototype Field: F 3 97 = F 3 [ x ] / ( x 97 + x 12 + 2) FPGA: Cyclone II EP2C35 (Altera) η T ( P , Q ) Exponentiation (Waifi 2007) Arithmetic over F 3 97 Unified operator ◮ 9 multipliers Area: 2787 LEs ◮ 2 adders Frequency: 159 MHz ◮ 1 cubing unit Computation time: 26 µ s Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µ s Jean-Luc Beuchat (University of Tsukuba) η T Pairing in Characteristic Three Arith 18 17 / 25
Recommend
More recommend
