Pairings for Cryptography

Transcription

1 Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009

2 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +), (G 2, +), (G 3, ) are abelian groups. bilinear: e(p 1 + P 2, Q 1 ) = e(p 1, Q 1 )e(p 2, Q 1 ), e(p 1, Q 1 + Q 2 ) = e(p 1, Q 1 )e(p 1, Q 2 ), i.e. e(ap, Q) = e(p, Q) a = e(p, aq), a Z. non-degenerate: given 0 P G 1 there is a Q G 2 with e(p, Q) 1. Cryptographic applications require e to be efficiently computable and the DLPs in G 1, G 2, G 3 to be hard.

3 Applications of pairings in cryptography Attack DL-based cryptography on elliptic curves (Menezes-Okamoto-Vanstone-1993, Frey-Rück-1994). Construct crypto systems with certain special properties: One-round tripartite key agreement (Joux-2000), Identity-based, non-interactive key agreement (Ohgishi-Kasahara-2000), Identity-based encryption (Boneh-Franklin-2001), Hierarchical IBE (Gentry-Silverberg-2002), Short signatures (Boneh-Lynn-Shacham-2001), Searchable encryption (Boneh-Di Crescenzo-Ostrovsky-Persiano-2004), Non-interactive proof systems (Groth-Sahai-2008), much more...

4 Elliptic curves Take an elliptic curve E over F q (char(f q ) = p > 3) with Weierstrass equation E : y 2 = x 3 + ax + b, E(F q ) = {(x, y) F 2 q : y2 = x 3 + ax + b} {O}, n = #E(F q ) = q + 1 t, t 2 q, and r n a large prime divisor of n (r p). For F F q : E(F) = {(x, y) F 2 : y 2 = x 3 + ax + b} {O}, E = E(F q ), F q an algebraic closure of F q. E is an abelian group (written additively) with neutral element O.

5 Torsion points and embedding degree The set of r-torsion points on E is E[r] = {P E [r]p = O} = Z/rZ Z/rZ. Since r #E(F q ), we have E(F q )[r]. The embedding degree of E w.r.t. r is the smallest integer k with r q k 1. For k > 1 we have E[r] E(F q k), i. e. E(F q )[r] E(F q k)[r] = E[r].

6 The reduced Tate pairing Let k > 1. The reduced Tate pairing t r : E(F q k)[r] E(F q k)/[r]e(f q k) µ r F q k, (P, Q) f r,p (Q) qk 1 r is a non-degenerate, bilinear map, where f r,p is a function with divisor (f r,p ) = r(p) r(o), µ r is the subgroup of r-th roots of unity in F. q k The computation of the pairing has two stages: evaluation of the Miller function f r,p at Q, the final exponentiation to the power (q k 1)/r.

7 Specific parameters for crypto k should be small, DLPs in all groups must be hard, for efficiency reasons balance the security. Security Extension field EC base point ratio level (bits) size of q k (bits) order r (bits) ρ k ECRYPT II recommendations (2009), ρ = log(q)/ log(r).

8 Small embedding degree The embedding degree condition says r q k 1, r q m 1, m < k or q k 1 (mod r), q m 1 (mod r), m < k. This means: k is the (multiplicative) order of q modulo r, k r 1. There are only ϕ(k) < k elements of order k mod r. Given r and q, it is very unlikely that q is one of them. (Note: r has at least 160 bits.)

9 Pairing-friendly curves Fix a suitable value for k and find primes r, p and a number n with the following conditions: n = p + 1 t, t 2 p, r n, r p k 1, t 2 4p = Dv 2 < 0, D, v Z, D < 0 squarefree, D small enough to compute the Hilbert class polynomial in Q( D). Given such parameters, a corresponding elliptic curve over F p can be constructed by the CM method. See Freeman, Scott, and Teske (A taxonomy of pairing-friendly elliptic curves) for an overview of construction methods and recommendations.

10 MNT curves and Freeman curves MNT curves (2001): ρ 1 and k {3, 4, 6}. k p(u) t(u) 3 12u ± 6u 4 u 2 + u + 1 u or u u ± 2u Freeman curves (2006): ρ 1 and k = 10. p(u) = 25u u u u + 3, t(u) = 10u 2 + 5u + 3. In both families, curves are very rare. Need to solve a Pell equation to find curves. D is variable.

11 BN curves (Barreto-N., 2005) If u Z such that p = p(u) = 36u u u 2 + 6u + 1, n = n(u) = 36u u u 2 + 6u + 1 are both prime, then there exists an ordinary elliptic curve with equation E : y 2 = x 3 + b, b F p, r = n = #E(F p ) is prime, i. e. ρ 1, the embedding degree is k = 12, t 2 4p(u) = 3(6u 2 + 4u + 1) 2. BN curves are ideal for the 128-bit security level.

12 Specific parameters Security Family r k ρ ρ k p k level (bits) (bits) (bits) 80 MNT Fre BN KSS KSS Cyc

13 Three groups In practice, restrict the arguments of the Tate pairing to groups of prime order r. Assume r 2 #E(F p k), k > 1. Define: G 1 = E(F p k)[r] ker(φ p [1]) = E(F p )[r], G 2 = E(F p k)[r] ker(φ p [p]), G 3 = µ r F p k. φ p is the p-power Frobenius on E, i. e. φ p (x, y) = (x p, y p ). It is E(F p k)[r] = G 1 G 2. If P E(F p )[r], then t r (P, P) = 1. Take Q / P = G 1. Can compute the Tate pairing on G 1 G 2 or on G 2 G 1.

14 Two choices The reduced Tate pairing: t r : G 1 G 2 G 3, (P, Q) The ate pairing: Let T = t 1. a T : G 2 G 1 G 3, (Q, P) f r,p (Q) pk 1 r. f T,Q (P) pk 1 r.

15 Miller s algorithm (Tate) Input: P G 1, Q G 2, r = (r m,...,r 0 ) 2 Output: t r (P, Q) = f r,p (Q) pk 1 r R P, f 1 for (i m 1; i 0; i ) do f f 2 l R,R (Q) v [2]R (Q) R [2]R if (r i = 1) then f f l R,P (Q) v R+P (Q) R R + P end if end for f f pk 1 r return f

16 Miller s algorithm (ate) Input: P G 1, Q G 2, T = (t m,...,t 0 ) 2 Output: a T (P, Q) = f T,Q (P) pk 1 r R Q, f 1 for (i m 1; i 0; i ) do f f 2 l R,R (P) v [2]R (P) R [2]R if (t i = 1) then f f l R,Q(P) v R+Q (P) R R + Q end if end for f f pk 1 r return f

17 Line functions Line functions correspond to the lines in the point doubling/addition, l P1,P 2 : line through P 1 and P 2, tangent if P 1 = P 2, v P3 : vertical line through P 3 = P 1 + P 2. P 3 l P1,P 2 P 1 P 2 P 3 l P1,P 1 P 1 v P3 v P3 E P 3 E P 3 (a) addition (b) doubling

18 The final exponentiation Let Φ d be the d-th cyclotomic polynomial. We have X k 1 = Φ d (X). d k r p k 1, r p d 1 for d < k r Φ k (p). Write the final exponent as: p k 1 r = d k, d k Φ d (p) Φk(p). r Let e k, e k, then α (pk 1)/r = 1 for all α F p e since (p e 1) d k, d k Φ d(p). Factors in proper subfields of F p k are mapped to 1 by the final exponentiation.

19 The final exponentiation (k even) p k 1 r = (p k/2 1) pk/2 + 1 Φ k (p) Φk(p). r Use F p k = F p k/2(α), α 2 = β, β a non-square in F p k/2. For f = f 0 + f 1 α F p k: (f 0 + f 1 α) pk/2 = f 0 f 1 α, and (f 0 + f 1 α) pk/2 1 = (f 0 f 1 α)/(f 0 + f 1 α). (p k/2 + 1)/Φ k (p) is a sum of p-powers, use the p-power Frobenius automorphism. k = 12 : f (p6 +1)/r = f (p2 +1) p4 p 2 +1 r = ((f p ) p f) (p4 p 2 +1)/r. The last part is done with multi-exponentiation or by finding a good addition chain for Φ k (p)/r.

20 Using a twist to represent G 2 Here: A twist E of E is a curve isomorphic to E over F p k. A twist is given by E : y 2 = x 3 + (a/ω 4 )x + (b/ω 6 ), ω F p k with isomorphism ψ : E E, (x, y ) (ω 2 x, ω 3 y ). If E is defined over F p k/d and ψ is defined over F p k and no smaller field, d is called the degree of E. Define G 2 := E (F p k/d)[r], then ψ : G 2 G 2 is a group isomorphism. Points in G 2 have a special form.

21 Maximal possible twist degrees d j(e) fields of definition a, b for powers of ω 2 {0, 1728} ω 2 F q k/2 a 0, b 0 ω 3 F q k \ F q k/ ω 4 F q k/4, ω 2 F q k/2 a 0, b = 0 ω 3 F q k \ F q k/2 6 0 ω 6 F q k/6, ω 3 F q k/3 a = 0, b 0 ω 2 F q k/2 E : y 2 = x 3 + (a/ω 4 )x + (b/ω 6 ) ψ : E E, (x, y ) (ω 2 x, ω 3 y )

22 Advantages of using twists If E has a twist of degree d and d k: Replace all curve arithmetic in G 2 (over F p k) by curve arithmetic in G 2 (over F p k/d) For d > 2, curve arithmetic is faster since a = 0 or b = 0. For even k, the x-coordinates of points in G 2 lie in F p k/2, i. e. the vertical line function values v P3 (Q) = x Q x 3 lie in F p k/2 and can be omitted. Can use the twisted ate pairing (e = k/d and T e = (t 1) e mod r): η Te : G 1 G 2 G 3, (P, Q) f Te,P(Q) (pk 1)/r. For d > 2, can have log(t e ) < log(r).

23 Loop shortening There are several possibilities to reduce the number of iterations in Miller s algorithm: Can take Te j mod r for 1 j d 1 instead of T e in the twisted ate pairing. Choose the shortest non-trivial power. For the ate pairing, can replace T by T j mod r for 1 j k 1 to possibly get a shorter loop. More combinations are possible, often leading to optimal pairings with a minimal loop length of log(r)/ϕ(k). For BN curves, the R-ate pairing is optimal: (p R(Q, P) = f c,q (P)(f c,q (P)l [c]q,q (P)) p 12 1)/n, l φp([c]q+q),[c]q(p) where c = 6u + 2.

24 Line functions for ate pairings f f l R,Q (P), R R + Q Do curve arithmetic in Miller s algorithm in G 2. Replace points R, Q G 2 by corresponding points R, Q G 2. Using the slope on the twist: λ = y R y Q x R x Q = ω3 y R ω 3 y Q ω 2 x R ω 2 x Q = ω y R y Q x R x Q Computing the line function on the twist: l R,Q (P) = y R y P λ(x R x P ) = ω 3 y R ω 3 y P ωλ (ω 2 x R ω 2 x P ) = ωλ = ω 3 (y R y P λ(x R x P )) = ω 3 l R,Q (P )

25 Choice of coordinates For real implementations, one tries to avoid inversions by using projective coordinates. Can do pairing computation with only 1 finite field inversion (needed in the final exponentiation). Can avoid inversions completely when using compressed representation of pairing values. The best choice of coordinates is different for different classes of curves. For the fastest explicit formulas to compute the DBL and ADD steps in Miller s algorithm on curves with twists of degree d > 2, see preprint Faster Pairing Computations on Curves with High-Degree Twists (joint work with Craig Costello and Tanja Lange, will be out soon).

26 Thanks for your attention Database and web interface to get and compute parameters of BN curves: ØØÔ»»ÛÛÛºØ ºÖÛØ ¹ Òº»Ö Ö»ÖÝÔØÓ Ö Ô Ý» ÒÙÖÚ ºÔ Ô C-Implementation of several pairings on BN curves: ØØÔ»»ÛÛÛºÖÝÔØÓ ºÓÖ»ÖÝÔØÓ Ñ ÐÖÝÔØÓ ºÓÖ