Katherine Stange. Pairing, Tokyo, Japan, 2007

Transcription

1 via via Department of Mathematics Brown University Pairing, Tokyo, Japan, 2007

2 Outline via

3 Definition of an elliptic net via Definition (KS) Let R be an integral domain, and A a finite-rank free abelian group. An elliptic net is a map W : A R such that the following recurrence holds for all p, q, r, s A. W (p + q + s)w (p q)w (r + s)w (r) + W (q + r + s)w (q r)w (p + s)w (p) + W (r + p + s)w (r p)w (q + s)w (q) = 0 The recurrence generates the net from finitely many initial values.

4 in their Natural Habitat E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) [3]Q [1]P + [3]Q [2]P + [3]Q via [2]Q [1]P + [2]Q [2]P + [2]Q [1]Q [1]P + [1]Q [2]P + [1]Q [1]P [2]P

5 in their Natural Habitat E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) ( 56 25, 371 ) 125 ( 95 64, 495 ) 512 ( , 2800 ) 6859 via ( 6 1, 16 1 ) ( 1 9, 19 ) 27 ( 39 1, 246 ) 1 ( 1 1, 0 1) ( 2 1, 1 ) 1 ( 5 4, 13 ) 8 ( 0 1, 0 1) ( 3 1, 5 1)

6 in their Natural Habitat E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) ( ) 56, ( ) 95, ( ) 328, via ( 6 1 2, ) ( ) 1, ( 39, 246 ) ( 1 1 2, ) ( 2 1 2, ) ( 5 2 2, ) ( 0 1 2, ) ( 3 1 2, )

7 in their Natural Habitat E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) via

8 in their Natural Habitat E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) via

9 Curve + Points give Net via Theorem (KS) Let E be an elliptic curve defined over a field K. For all v Z n, there exist functions Ψ v : E n K such that the following holds: 1. Each Ψ v is elliptic in each variable. 2. For any fixed P E n, the function W : Z n K defined by W (v) = Ψ v (P) is an elliptic net.

10 Characterising Functions Ψ v via The functions Ψ v may be characterised uniquely by the additional assumptions that 1. Ψ v (P) vanishes exactly when v P = 0 on E. 2. Ψ v = 1 whenever v is e i or e i + e j for some standard basis vectors e i e j. We call W the elliptic net associated to E, P 1,..., P n, and write W E,P. We call P 1,..., P n the basis of W E,P.

11 Division Polynomials Any elliptic curve E has a Weierstrass equation. Suppose E : y 2 = x 3 + Ax + B. The elliptic functions Ψ k are the Division Polynomials in terms of x, y, A, B: via Ψ 1 = 1, Ψ 2 = 2y, Ψ 3 = 3x 4 + 6Ax Bx A 2, Ψ 4 = 4y(x 6 + 5Ax Bx 3 5A 2 x 2 4ABx 8B 2 A 3 ),

12 Net Polynomial Examples In higher rank case, we also have such polynomial representations. Ψ 1,1 = x 1 x 2, ( ) y2 y 2 1 Ψ 2,1 = 2x 1 + x 2, x 2 x 1 Ψ 2, 1 = (y 1 + y 2 ) 2 (2x 1 + x 2 )(x 1 x 2 ) 2, Ψ 1,1,1 = y 1(x 2 x 3 ) + y 2 (x 3 x 1 ) + y 3 (x 1 x 2 ) (x 1 x 2 )(x 1 x 3 )(x 2 x 3 ) Can calculate more via the recurrence..., via Ψ 3,1 = (x 2 x 1 ) 3 (4x1 6 12x 2x x 2 2 x x 2 3 x 1 3 4y2 2 x y 1 2 x 1 3 6x 2 4 x y 2 2 x 2x1 2 18y 1 2 x 2x y1 2 x 2 2 x 1 + x2 6 2y 2 2 x 2 3 2y 1 2 x y 2 4 6y 1 2 y y1 3 y 2 3y1 4 ).

13 Elliptic nets calculate the group law Consider the one-dimensional case. Suppose we have Define Then we have E : y 2 = x 3 + Ax + B. φ k = xψ 2 k Ψ k+1ψ k 1, 4yω k = Ψ k+2 Ψ 2 k 1 Ψ k 2Ψ 2 k+1. [k]p = ( ) φk (P) Ψ k (P) 2, ω k (P) Ψ k (P) 3. via In general, the elliptic net calculates the coordinates of any linear combination of its basis points.

14 Example via E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) Q P

15 Example via E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) Q P

16 Example via E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) Q P

17 Example via E : y 2 + y = x 3 + x 2 2x; P = (0, 0), Q = (1, 0) Q P

18 Lattice Property via For an integer elliptic net, for each prime p, there exists a Lattice of Apparition L A such that W (v) 0 mod p v L Let Ẽ, P 1,..., P n be the images of E, P 1,..., P n under reduction modulo p. Then WẼ, P (taking values in F p ) is simply the reduction of the values of W E,P modulo p. In particular, W E,P (v) 0 mod p if v P = 0 on Ẽ.

19 Example of Reduction Mod 5 of an Elliptic Net via Q P

20 Example of Reduction Mod 5 of an Elliptic Net via Q P

21 Example of Reduction Mod 5 of an Elliptic Net via Q P

22 Example of Reduction Mod 5 of an Elliptic Net via Q P The elliptic net is not periodic modulo the lattice of apparition.

23 Example of Reduction Mod 5 of an Elliptic Net via Q P The elliptic net is not periodic modulo the lattice of apparition. The appropriate translation property should tell how to obtain the green values from the blue values.

24 Example of Reduction Mod 5 of an Elliptic Net via Q P The elliptic net is not periodic modulo the lattice of apparition. The appropriate translation property should tell how to obtain the green values from the blue values. There are such translation properties, and it is within these that the Tate pairing information lies.

25 and Linear Combinations of Points via If W i is the elliptic net associated to E, P i, Q i for i = 1, 2, and [a 1 ]P 1 + [b 1 ]Q 1 = [a 2 ]P 2 + [b 2 ]Q 2 then W 1 (a 1, b 1 ) is not necessarily equal to W 2 (a 2, b 2 ). So how do we propose to compare two elliptic nets supposedly associated to the same linear combinations?

26 Defining a Net on a Free Abelian Cover Let K be a finite or number field. Let Ê be any finite rank free abelian group surjecting onto E(K ). π : Ê E(K ) For a basis P 1, P 2, choose p i Ê such that π(p i ) = P i. We specify an identification via via e i p i. Z 2 = p1, p 2 The elliptic net W associated to E, P 1, P 2 and defined on Z 2 is now identified with an elliptic net W defined on Ê. This allows us to compare elliptic nets associated to different bases.

27 Defining a Special Equivalence Class via Definition Let W 1, W 2 : A K. Suppose f : A K is a quadratic function. If W 1 (v) = f (v)w 2 (v) for all v, then we say W 1 is equivalent to W 2. The basis change formula is an equivalence, when the elliptic nets are viewed as maps on Ê as explained in the previous slide. In this way, we can associate an equivalence class to a subgroup of E(K ).

28 Statement of Theorem via Theorem (KS) Fix a positive m Z. Let E be an elliptic curve defined over a finite field K containing the m-th roots of unity. Let P, Q E(K ), with [m]p = O. Choose S E(K ) such that S / {O, Q}. Choose p, q, s Ê such that π(p) = P, π(q) = Q and π(s) = S. Let W be an elliptic net in the equivalence class associated to a subgroup of E(K ) containing P, Q, and S. Then the quantity T m (P, Q) = is the Tate pairing. W (s + mp + q)w (s) W (s + mp)w (s + q)

29 Choosing an Elliptic Net via Corollary Let E be an elliptic curve defined over a finite field K, m a positive integer, P E(K )[m] and Q E(K ). Then τ m (P, P) = W E,P(m + 2)W E,P (1) W E,P (m + 1)W E,P (2), and τ m (P, Q) = W E,P,Q(m + 1, 1)W E,P,Q (1, 0) W E,P,Q (m + 1, 0)W E,P,Q (1, 1).

30 Elliptic Net Outline 1. Given E, P, Q with [m]p = 0, calculate the initial terms of W E,P,Q. 2. Using the recurrence relation, calculate the terms W (m + 1, 0), W (m + 1, 1). 3. Calculate T m (P, Q) = W (m + 1, 1)/W (m + 1, 0). 4. Perform final exponentiation exactly as in Miller s algorithm. Remarks: There are polynomial formulae for the initial terms of Step 1. Step 4 is also performed in Miller s algorithm and the same efficient methods apply here. The challenge lies in efficient computation of large terms of the net W E,P,Q. via

31 Computing Terms of W E,P,Q via (k-1,1) (k,1) (k+1,1) (k-3,0) (k-2,0) (k-1,0) (k,0) (k+1,0) (k+2,0) (k+3,0) (k+4,0) Figure: A block centred at k

32 Computing Terms of W E,P,Q via Double and add algorithm: Block centred at 2k Block centred at k Block centred at 2k + 1 Each term of the new block requires one instance of the recurrence relation, i.e. several multiplications and an addition.

33 Complexity Let k be the embedding degree. Let P E(F q ) and Q E(F q k ). via S S k M M k squaring in F q squaring in F q k multiplication in F q multiplication in F q k : Double: DoubleAdd: Elliptic Net 6S + (6k + 26)M + S k M k 6S + (6k + 26)M + S k + 2M k : Optimised Miller s 1 Double: 4S + (k + 7)M + S k + M k DoubleAdd: 7S + (2k + 19)M + S k + 2M k 1 Koblitz N., Menezes A., Pairing-based cryptography at high security levels, 2005

34 In Practice Thank you to Michael Scott, Augusto Jun Devigili and Ben Lynn for implementing the algorithm. A timing comparison program is bundled with Ben Lynn s Pairing-Based Cryptography Library at type a: 512 bit base-field, embedding degree 2, 1024 bits security, y 2 = x 3 + x, group order is a Solinas prime. type f: 160 bit base-field, embedding degree 12, 1920 bits security, Barreto-Naehrig curves [Pairing Friendly Elliptic Curves of Prime Order, SAC 2005] via : Miller s Elliptic Net type a ms ms type f ms ms average time of a test suite of 100 randomly generated pairings in each of the two cases

35 Potential Advantages via Naturally inversion-free. Naturally deterministic. Since Double and DoubleAdd steps are similar or the same, is independent of hamming weight and avoids side-channel attacks. Lends itself to time-saving precomputation for repeated pairings e m (P, Q), e.g. where E, m, and P are fixed. Code is simple.

36 Improving the To compute a given pairing, we have many choices: Choice of a point S. Choice of lifts of P, Q, S. Choice of a subgroup of E(K ) containing P and Q, and S. Choice of an elliptic net in the given equivalence class. Choice of scaling of the chosen net. Choice of recurrences used to compute the terms of the net. Choice of order of operations for the computations. In the algorithm I have given, I have made apparently convenient choices for these things. It is very probable significant improvement is possible. via

37 via Elliptic nets provide an alternate computational model for elliptic curves. The terms of an elliptic net compute the Tate and Weil pairings. The resulting algorithm is of comparable complexity to Miller s and is likely to yield to further optimisation. The algorithm may have inherent security and computational benefits. Slides and Pari/GP scripts available at