Finite field multiplication combining AMNS and DFT approach for Pairing Based Cryptography Nadia El Mrabet (1) and Christophe Negre (2) (1) Team Arith/LIRMM, Universit´ e Montpellier 2 (2) Team DALI/ELIAUS, Universit´ e de Perpignan Queensland University of Technology, July 2009 1 / 27
Outline Pairing over Elliptic Curves 1 Definition and Properties Implementation aspect Arithmetical aspect of Pairing Based cryptography 2 Fields used in Pairing Based Cryptography Multiplication in F p k with Karatsuba Pairing Friendly Fields Multiplication combining AMNS and DFT (Our contribution) 3 Arithmetic modulo p in an AMNS Multiplication in F p k with DFT Complexity and conclusion 4 2 / 27
Outline Pairing over Elliptic Curves 1 Definition and Properties Implementation aspect Arithmetical aspect of Pairing Based cryptography 2 Fields used in Pairing Based Cryptography Multiplication in F p k with Karatsuba Pairing Friendly Fields Multiplication combining AMNS and DFT (Our contribution) 3 Arithmetic modulo p in an AMNS Multiplication in F p k with DFT Complexity and conclusion 4 3 / 27
What is a pairing ? Properties Let G 1 , G 2 and G 3 be three groups with the same order r . A pairing is a map : e : G 1 × G 2 → G 3 which verifies the following properties : Non degenerate ; Bilinearity ; 4 / 27
What is a pairing ? Properties Let G 1 , G 2 and G 3 be three groups with the same order r . A pairing is a map : e : G 1 × G 2 → G 3 which verifies the following properties : Non degenerate ; Bilinearity ; Consequences ∀ j ∈ N , e ([ j ] P , Q ) = e ( P , Q ) j = e ( P , [ j ] Q ) 4 / 27
Elliptic Curve Cryptography and pairings Cryptanalysis Pairings was used to transporte the discrete logarithme problem from an elliptic curve sub group to a finite field. Cryptography Pairings allow the construction of novel protocols and simplification of existing protocols. The tri partite Diffie Hellman key exchange protocol (Joux 2001) The Identity Based Encryption (Boneh and Franklin 2001) Short signature scheme (Boneh, Lynn, Schackamm 2001) Group signatures schemes (Boneh, Schackamm, 2004) 5 / 27
Pairings used In cryptography, four pairings are principally used : the Weil pairing, the Tate pairing, the η pairing, the Ate pairing. All of them involved computation over a finite field F p and over F p k an extension of this finite field. 6 / 27
Pairings over elliptic curves : Implementation aspect The Ate pairing is computed trought the Miller’s algorithm. The complexity of one step during the Miller’s algorithm is : 2 kM p + 6 S p k + 7 M p k for the Ate pairing. To improve the efficiency of the pairing we can ◮ reduce the number of multiplication and addition in F p k . ◮ improve multiplication and addition in F p k . 7 / 27
Pairings over elliptic curves : Implementation aspect The Ate pairing is computed trought the Miller’s algorithm. The complexity of one step during the Miller’s algorithm is : 2 kM p + 6 S p k + 7 M p k for the Ate pairing. To improve the efficiency of the pairing we can ◮ reduce the number of multiplication and addition in F p k . ◮ improve multiplication and addition in F p k . 7 / 27
Outline Pairing over Elliptic Curves 1 Definition and Properties Implementation aspect Arithmetical aspect of Pairing Based cryptography 2 Fields used in Pairing Based Cryptography Multiplication in F p k with Karatsuba Pairing Friendly Fields Multiplication combining AMNS and DFT (Our contribution) 3 Arithmetic modulo p in an AMNS Multiplication in F p k with DFT Complexity and conclusion 4 8 / 27
Finite fields used in pairings evaluation The field F p ◮ is the set of integer modulo a prime p ≥ 2 160 . ◮ The curve with fixed embedding degree k are constructed with the Complex Multiplication method. ◮ Consequence, the prime p cannot be chosen freely and do not have peculiar property. ◮ The multiplication modulo p is done with generic algorithm (Montgomery, Barett). The field F p k ◮ It is the set of polynomials F p [ X ] modulo an irreducible polynomial P of degree k . ◮ k is in the interval [6 , 32] such that p k ≥ 2 1024 . ◮ P = X k − µ where µ is small and as much as possible a power of 2. 9 / 27
Multiplication in F p k with Karatsuba We want to compute U ( X ) × V ( X ) mod ( X k − µ ) where k = 2 s 10 / 27
Multiplication in F p k with Karatsuba We want to compute U ( X ) × V ( X ) mod ( X k − µ ) where k = 2 s Multiplication. We first compute W = U × V . 1 We split U and V into two parts U 0 + X k / 2 U 1 , V 0 + X k / 2 V 1 U = V = 2 We compute recursivelly = U 0 V 0 , W 0 W 2 = U 1 V 1 , W 1 = ( U 0 + U 1 )( V 0 + V 1 ) − W 0 − W 2 . 3 We deduce W = W 0 + X k / 2 W 1 + X k W 2 which is equal to U × V . 10 / 27
Multiplication in F p k with Karatsuba Reduction. The reduction modulo X k − µ of W is done as follows � k − 1 � 2 k − 2 � � � � w i X i w i X i − k + µ . i =0 i = k Toom-Cook-3 approach works like Karatsuba but with decomposition in 3 parts. 11 / 27
Pairing-Friendly Fields Definition F q k is a pairing friendly field if p ≡ 1 mod (12) & k = 2 i . 3 j . Theorem F p k a pairing friendly field, β neither a square or a cube in F p . Then X k − β irreducible over F p . Consequences F p k can be constructed as a tower of quadratic and cubic extensions. ⇒ a perceptible reduction of the cost of a multiplication in F p k . The cost of one multiplication is equal to 3 i 5 j multiplications in F p . 12 / 27
Outline Pairing over Elliptic Curves 1 Definition and Properties Implementation aspect Arithmetical aspect of Pairing Based cryptography 2 Fields used in Pairing Based Cryptography Multiplication in F p k with Karatsuba Pairing Friendly Fields Multiplication combining AMNS and DFT (Our contribution) 3 Arithmetic modulo p in an AMNS Multiplication in F p k with DFT Complexity and conclusion 4 13 / 27
Adapted Modular Number System Classical representation n − 1 a i β i with a i ∈ { 0 , . . . , β − 1 } . � a = i =0 Example :for β = 8 we have a = 1315 = [2 , 4 , 4 , 3] 8 ,i.e., a = 2 × 8 3 + 4 × 8 2 + 4 × 8 + 3. 14 / 27
Adapted Modular Number System Classical representation n − 1 a i β i with a i ∈ { 0 , . . . , β − 1 } . � a = i =0 Example :for β = 8 we have a = 1315 = [2 , 4 , 4 , 3] 8 ,i.e., a = 2 × 8 3 + 4 × 8 2 + 4 × 8 + 3. Representation in AMNS : let 0 < γ < p and n > 0 n − 1 � a i γ i mod p with a i < p 1 / n . a = i =0 and γ satisfies γ n = λ mod p with λ small. n − 1 a i t i in polynomial form the AMNS � We will note a ( t ) = i =0 representation of a . 14 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 15 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 0 1 6 7 8 9 10 11 12 13 14 15 16 − 1 15 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 0 1 6 7 8 9 10 11 − 1 + γ γ 1 + γ 12 13 14 15 16 − 1 15 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 0 1 6 7 8 9 10 11 − 1 + γ γ 1 + γ 12 13 14 15 16 − 1 + γ 2 γ 2 − 1 15 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 − γ 2 1 − γ 2 0 1 6 7 8 9 10 11 − 1 + γ γ 1 + γ − γ − 1 − γ − γ + 1 12 13 14 15 16 − 1 + γ 2 γ 2 − 1 15 / 27
AMNS example Let p = 17 and n = 3 and γ = 7. γ 0 = 1 mod p , γ 1 = 7 mod p , γ 2 = 15 mod p . 0 1 2 3 4 5 − γ 2 1 − γ 2 − 1 + γ + γ 2 γ + γ 2 0 1 6 7 8 9 10 11 − 1 + γ γ 1 + γ − γ − 1 − γ − γ + 1 12 13 14 15 16 − γ − γ 2 1 − γ − γ 2 − 1 + γ 2 γ 2 − 1 15 / 27
Lattice related to an AMNS The set L = { a ( t ) ∈ Z [ t ] t.q. deg a ( t ) < n et a ( γ ) = 0 mod p } is a lattice of rank n . The row of the following matrix form a basis of a lattice 0 0 0 . . . 0 ← p p − γ 1 0 0 . . . 0 ← t − γ ← t 2 − γ 2 − γ 2 0 1 0 . . . 0 B = . . . . ... . . . . . . ← t n − 2 − γ n − 2 − γ n − 2 0 0 . . . 1 0 ← t n − 1 − γ n − 1 − γ n − 1 0 0 . . . 0 1 There exists a polynomial m ( t ) such that m ( γ ) = 0 and � m � ∞ ≤ p 1 / n . 16 / 27
Lattice related to an AMNS p 2 / n p 1 / n p 1 / n p 2 / n 17 / 27
Lattice related to an AMNS 2 ρ 2 | λ | ρ 2 ρ 2 | λ | ρ m There exist m ∈ L such that � m � ∞ ≤ p 1 / n 17 / 27
Lattice related to an AMNS p 2 / n ρ b p 1 / n ρ 2 / n a 17 / 27
Lattice related to an AMNS λρ 2 ˜ c ρ b λρ 2 ρ a 17 / 27
Lattice related to an AMNS p 2 / n c p 1 / n p 1 / n p 2 / n c = a × b mod t n − λ satisfies � c � ∞ ≤ np 2 / n 17 / 27
Lattice related to an AMNS p 2 / n c p 1 / n p 1 / n p 2 / n 17 / 27
Lattice related to an AMNS ρ 2 c ˜ c ρ ρ 2 ρ r satisfait � r � ∞ ≤ np 1 / n and represents r = a × b mod p 17 / 27
Recommend
More recommend
