LETTER Skew-Frobenius Maps on Hyperelliptic Curves

Transcription

1 189 Skew-Frobenus Maps on Hyperellptc Curves Shunj KOZAKI a, Nonmember, Kazuto MATSUO, Member, and Yasutomo SHIMBARA, Nonmember SUMMARY Scalar multplcaton methods usng the Frobenus maps are known for effcent methods to speed up (hyperellptc curve cryptosystems. However, those methods are not effcent for the cryptosystems constructed on felds of small extenson degrees due to costs of the feld operatons. Ijma et al. showed that one can use certan automorphsms on the quadratc twsts of ellptc curves for fast scalar multplcatons wthout the drawback of the Frobenus maps. Ths paper shows an extenson of the automorphsms on the Jacobans of hyperellptc curves of arbtrary genus. key words: hyperellptc curve cryptosystems, scalar multplcatons, Frobenus expansons, skew-frobenus maps 1. Introducton Hyperellptc curve cryptosystems [9] are publc-key cryptosystems whose keys are as short as those of ellptc curve cryptosystems. Furthermore, the defnton felds of hyperellptc curve cryptosystems can be more compact than those of ellptc curve cryptosystems. Choosng a compact feld sutable for a general-purpose processor acheves fast group operatons on the Jacoban of a hyperellptc curve [6], [1]. In the mplementaton of hyperellptc curve cryptosystems, fast scalar multplcaton methods are mportant. The scalar multplcaton method usng a subfeld curve [, Sect. 15.1] s one of the fastest methods. The method uses the q-th power Frobenus map for F q n-ratonal ponts on the Jacoban of a curve defned over F q. However, there s a drawback of the method,.e., the order of F q n-ratonal pont group s always composte, because the group contans F q -ratonal ponts as a subgroup. Hence, F q n s larger than the feld defnng a ratonal pont group of prme order wth the same securty level. Especally, those methods are neffcent when the extenson degree n s small. Ijma, Matsuo, Chao, and Tsuj [7] showed that, on the quadratc twsts of ellptc curves, one can obtan automorphsms whch have the smlar propertes to the Frobenus maps. We call these knds of automorphsms skew- Frobenus maps. The skew-frobenus maps are effcently computable and can be used to speed up scalar multplcatons. Ths paper extends the skew-frobenus maps n [7] to hyperellptc curves of any genus. The skew-frobenus map s obtaned as a computable map on the Jacoban of the Manuscrpt receved December 5, 007. Manuscrpt revsed March 4, 008. The authors are wth the Insttute of Informaton Securty, Yokohama-sh, Japan. a E-mal: dgs07410@sec.ac.jp DOI: /etfec/e91 a quadratc twst of a hyperellptc curve. The organzaton of ths paper s as follows: Sect. defnes the quadratc twsts of hyperellptc curves, the Frobenus maps on the Jacobans and the related facts. Secton presents a bref overvew of the skew-frobenus maps on ellptc curves proposed by [7]. Secton 4 constructs the skew- Frobenus maps for hyperellptc curves. Moreover, Sect. 5 shows the complexty of the maps, Sect. 6 brefly dscusses the effcency of the skew-frobenus maps for scalar multplcatons. Fnally, Sect. 7 concludes ths paper.. Prelmnares Let p be an odd prme, m a postve nteger and q = p m.let g be a postve nteger and F a monc square-free polynomal n F q [X] ofdegreeg + 1. A hyperellptc curve C over F q of genus g s defned by C : Y = F(X. (1 Let n be an nteger greater than 1 and c a quadratc non-resdue n F q n. The quadratc twst C t of C over F q n s defned by C t : Y = F t (X, ( F t (X = c g+1 F(c 1 X F q n[x]. ( J C denotes the Jacoban of C and F q denotes the algebrac closure of F q. Any element D J C can be unquely represented by a par of polynomals U and V n F q [X] whch satsfy the followng condtons [, Theorem 14.5]: U s monc, (4 deg V < deg U g, (5 F V 0 (mod U. (6 The par (U, V s called Mumford representaton of D and we wrte D = (U, V. An addton of two elements n J C can be computed by Cantor s algorthm (Algorthm 1 [1]. The Frobenus map φ q on J C s defned by φ q : J C J C (U, V (φ q (U,φ q (V, where φ q (U (resp., φ q (V s the polynomal obtaned by rasng each coeffcent of U (resp., V totheq-th power. Every element n J C s defned over F q n f and only f t s (7 Copyrght c 008 The Insttute of Electroncs, Informaton and Communcaton Engneers

2 1840 Algorthm 1 Cantor s algorthm Input: C: a hyperellptc curve of genus g over F q, D 1 = (U 1, V 1, D = (U, V J C Output: D = (U, V J C such that D = D 1 + D /*composton part*/ 1: Compute G, S 1, S, S F q [X] such that G = gcd (U 1, U, V 1 + V = S 1 U 1 + S U + S (V 1 + V : U U 1U G : V S 1U 1 V +S U V 1 +S (F+V 1 V G mod U /*reducton part*/ 4: repeat 5: U F V U 6: V V mod U 7: untl deg U g 8: Make U monc 9: return (U, V fxed by φ n q. The set of the elements defned over F q n s denoted by J C (F q n. J C (F q n s a fnte abelan subgroup of J C. The characterstc polynomal of φ q s of the form χ q (X = X g + g g 1 a X g + a q g X =1 =1 + q g Z[X], a Z, 1 g [, Corollary 5.8]. By usng χ q (φ q = 0, one can expand an nteger k n Z[φ q ] as follows [, Sect ]: k = s r φ q, r Z, s N. (8 Snce the map φ q s more effcently computable than the group operaton of J C (F q n, the φ q -expanson (8 leads to fast scalar multplcatons. In order to use the φ q -expansons, however, we must buld a cryptosystem on J C (F q n/j C (F q. Therefore, the defnton feld F q n s larger than that of a ratonal pont group of prme order wth the same securty level. Snce (J C (F q n/j C (F q q g(n 1 from the Hasse-Wel theorem [, Theorem 14.15], the methods usng the φ q -expansons are not effcent when n s small.. Skew-Frobenus Maps on Ellptc Curves [7] Ijma, Matsuo, Chao, and Tsuj [7] showed the skew- Frobenus maps on the quadratc twsts of ellptc curves. Those maps can be used for expandng ntegers n the endomorphsm rngs of curves smlar to the Frobenus map. [7] also showed that there are ratonal pont groups of prme order on whch the skew-frobenus maps can be used. Ths secton recalls the skew-frobenus maps on ellptc curves proposed n [7]. Let E be an ellptc curve over F q defned by (1 wth g = 1andE t the quadratc twst of E defned by ( usng a quadratc non-resdue c n F q n.amap τ 0 : E t E (9 (x,y (c 1 x, c y defnes an somorphsm from E t to E. The skew-frobenus map on E t s defned by τ 1 0 φ q τ 0,.e., φ t : E t E t (x,y (c 1 q x q, c (1 q y q. The restrcton of φ t to the F q n-ratonal pont group E t (F q ns also a non-trval automorphsm whch satsfes χ q (φ t = 0. Then [7] showed that there s the quadratc twst E t of E such that E t (F q n s a prme when n = d, d > 0. Moreover, Furukawa, Kobayash, and Aok [5] showed the fnte feld representatons sutable for the skew-frobenus maps. Furhata, Kobayash, and Sato [4] showed the skew-frobenus maps on ellptc curves over felds of characterstcs two. 4. Skew-Frobenus Maps on Hyperellptc Curves Ths secton shows the skew-frobenus map on J Ct of the quadratc twst C t of a hyperellptc curve C of any genus. Lemma 1 descrbed below gves the somorphsm from J Ct to J C. Ths map s an extenson of the map (9. Lemma 1. τ : J Ct J C (10 (U, V (Ũ, Ṽ Ũ(X = c l U(cX,l= deg U (11 Ṽ(X = c g+1 V(cX (1 s an somorphsm from J Ct to J C, where c s the quadratc non-resdue n F q n that appears n (. Proof. Frst, we show that τ s a well defned map from J Ct to J C,thats,J C contans (Ũ, Ṽ gven by (11 and (1 for any (U, V J Ct. Obvously, Ũ satsfes the condton (4. Snce deg V < deg U g, deg Ṽ = deg V < deg Ũ = deg U g. Therefore, (Ũ, Ṽ satsfes the condton (5. From F(X = c (g+1 F t (cx and (1, F(X Ṽ (X = c (g+1 ( F t (cx V (cx. Then F t (cx V (cx 0(modU(cX mples F(X Ṽ (X 0 (mod Ũ(X, that s, (Ũ, Ṽ satsfes the condton (6. Consequently, (Ũ, Ṽ s contaned n J C. Next, we show that τ s a group homomorphsm, that s, τ(d 1 +D s equal to τ(d 1 +τ(d foranyd 1, D J Ct by usng Algorthm 1. Let (Ũ, Ṽ := τ(d ford = (U, V J Ct, = 1,. From (11 and (1, Ũ (X = c l U (cx, l = deg U (1 Ṽ (X = c g+1 V (cx (14

3 1841 for = 1,. Accordng to the step 1 n Algorthm 1, let G := gcd (U 1, U, V 1 + V and G := gcd ( 1,, 1 +, where both G and G are monc. By usng (1 and (14, the followng s obtaned: G = gcd (U 1 (cx, U (cx, V 1 (cx + V (cx = c l G G(cX, l G = deg G. (15 Moreover, let S 1, S, S F q n[x] (resp., S 1, S, S F q n[x] such that G = S 1 U 1 + S U + S (V 1 + V (resp., G = S S + S ( 1 +. Then, applyng (1 and (14 to (15, we obtan G = c l G (S 1 (cxu 1 (cx + S (cxu (cx + S (cx(v 1 (cx + V (cx = c l 1 l G S 1 (cx 1 (X + c l l G S (cx (X + c g+1 l G S (cx( 1 (X + (X. Therefore, S 1, S and S satsfy S = c l l G S (cx, l = deg S, = 1,, (16 S = c g+1 l G S (cx. (17 Accordng to the step n the algorthm, let U := U 1U,l G = deg U = l 1 + l l G, U := 1, G then applyng (1 and (15 to U yelds U = c l U (cx. (18 Accordng to the step n the algorthm, let V := S 1U 1 V + S U V 1 + S (F t + V 1 V mod U, G S := S 1 + S (F + 1 mod, G then applyng (1, (14, (15, (16, (17 and (18 to yelds = c g+1 V (cx. (19 Accordng to the step 5 n the algorthm, let U := F t V,l U = deg U = g + 1 l, F :=, then by usng (18, (19 and F(X = c (g+1 F t (cx, U = c l U (cx (0 s obtaned. Accordng to the step 6 n the algorthm, let V := V mod U, := mod, then by usng (19 and (0, = c g+1 V (cx (1 s obtaned. Snce (0 and (1 are always satsfed between the step 4 and 7 n the algorthm, D 1 + D = (U, V mples ( τ(d 1 + τ(d = c l U(cX, c g+1 V(cX, where l := deg U g. Therefore, τ(d 1 + τ(d = τ(d 1 + D, that s, τ s a group homomorphsm. Smlarly, we can show that a map σ : J C J Ct ( (U, V c l U(c 1 X, c g+1 V(c 1 X, ( l = deg U s a group homomorphsm. Moreover, τ σ = d JC, σ τ = d JCt are satsfed. Therefore, τ s an somorphsm from J Ct to J C. The Frobenus map φ q on J C and the somorphsm τ n Lemma 1 provde an automorphsm on J Ct as follows. Defnton 1. The skew-frobenus map φ q on J Ct s defned by φ q : J Ct J C J C J Ct. τ φq τ 1 From the defnton, φ q satsfes χ q ( φ q = 0. Theorem 1 descrbed below shows an explct map of φ q wth respect to the Mumford representaton. Theorem 1. The skew-frobenus map φ q on J Ct s gven by φ q : J Ct J Ct (U, V (Ū, V, Ū(X = X l + c (1 q(l u q X, V(X = where U(X = X l + u X F q n[x], V(X = c (1 q( g+1 v q X, ( v X F q n[x].

4 184 Proof. From (11, (7 and (, Ū(X = c (q 1l φ q (U(c q 1 X = X l + c (1 q(l u q X s obtaned. From (1, (7 and (, g+1 (q 1 V(X = c φ q (V(c q 1 X = c (1 q( g+1 v q X s obtaned. From Theorem 1, the restrcton of φ q to J Ct (F q nsalso a non-trval automorphsm on J Ct (F q n, because c (1 q( g+1 n ( s n F q n for any. Therefore, one can use φ q to expand ntegers n Z[ φ q ] for scalar multplcatons on J Ct (F q n. 5. Complexty of Skew-Frobenus Map Ths secton dscusses the complexty of computng φ q wth respect to g. From Theorem 1, the precomputaton of {c (1 q, c (1 q, c (1 q,...,c g(1 q, c g+1 (1 q } allows us to compute φ q by usng at most g F q n- multplcatons and at most g q-th powers. Therefore, φ q can be computed usng O(g operatons n F q n. On the other hand, a group operaton on J Ct (F q n needs O(g (oro(g operatons n F q n. Comparng the cost of φ q computaton wth that of the group operaton wth respect to g, thencrease n the cost of φ q computaton wth g s smaller than that n the cost of the group operaton. Moreover, φ q allows us to use J Ct (F q n of prme order [8], so that we can reduce the cost of operatons n F q n compared to usng a ratonal pont group of composte order wth the same securty level. 6. Effcency of Skew-Frobenus Maps for Scalar Multplcatons Usng the results n [11] and [], ths secton brefly dscusses the effcency of the skew-frobenus maps for scalar multplcatons. φ q has the same characterstc polynomal as φ q.therefore, accordng to [11, Algorghm 1], we can obtan the skew-frobenus expanson for an nteger k q gn as λ 1 k = a φ q, a { } 0, ±1,...,± qg 1. (4 Most of these expansons have fnte length due to [11, Sect. 4., 4.], and [11, Summary 1] shows that the upper bound of λ s logq ( ( q 1k + kq,g, where k q,g g + 1 as an expermental result n [11]. From log q ( q 1 < 1andlog q k < ng + 1, we see that logq ( ( q 1k + kq,g log q (( q 1k + g + 1 < 1 + log q k + g + 1 = log q k + g + < (ng g + = g(n Thus, the upper bound of λ s g(n Moreover, φ q satsfes φ n q(d = D for any D J Ct (F q n,.e. φ n q = 1. Therefore, the expanson (4 can be rewrtten wth the terms of degree less than n: where k = r φ q, log r M, (5 L = n 1, (( q g 1 g(n M = log. n Accordng to [, Sect. 4], we can compute kd by usng the expanson (5 as follows. kd = φ q(d + + r (M 1 r (0 φ q(d, where (r (M 1,...,r (0 s the bnary representaton of r for 0 L. Consequently, kd can be computed by usng LM + M 1 addtons on average and M 1 doublngs. For example, takng a typcal case, let g =, q 0, and n = 4, then the cost of a scalar multplcaton usng the skew-frobenus map can be estmated as follows. We can consder the cost of addtons and doublngs are roughly the same, then the computaton of kd needs ( L + M group operatons. Therefore, kd can be computed wthn ( L + M = n log (( q g 1 g(n n group operatons. On the other hand, the bnary method [, Sect ] needs about 8 group operatons wth the same parameters. Therefore, the scalar multplcaton usng the skew-frobenus map reduces about 9% of the group operatons compared wth the bnary method. Moreover, the NAF w method [, Sect ] needs about 19 group operatons when the wndow sze w = 5. Therefore, the scalar multplcaton usng the skew-frobenus map reduces about 5% of the group operatons compared wth the NAF w method wth w = 5.

5 Concluson Ths paper showed the skew-frobenus maps φ q on the Jacobans of hyperellptc curves of any genus. The map can be used for the expanson of an nteger n Z[ φ q ] smlar to the Frobenus maps. Then the maps can be more effcently computable for hyperellptc curves compared wth ellptc curves. Furthermore, by usng a ratonal pont group of prme order, the operaton cost of the defnton feld can be reduced. Ths paper also dscussed the effcency of the skew-frobenus maps for scalar multplcatons brefly. An applcaton of the proposed skew-frobenus maps to scalar multplcatons on the Jacobans of hyperellptc curves needs a further study on effcent algorthms usng the skew-frobenus expanson and effcent mplementatons of the scalar multplcatons. Acknowledgement The authors are grateful to the anonymous referee for her/hs valuable comments. References [1] D.G. Cantor, Computng n the Jacoban of hyperellptc curve, Math. Comp., vol.48, no.177, pp , [] H. Cohen, G. Frey, R. Avanz, C. Doche, T. Lange, K. Nguyen, and F. Vercauteren, Handbook of ellptc and hyperellptc curve cryptography, Chapman & Hall/CRC, 005. [] Y. Choe and J.W. Lee, Speedng up the scalar multplcaton n the Jacobans of hyperellptc curves usng Frobenus map, IN- DOCRYPT 00, LNCS 551, pp.85 95, 00. [4] S. Furhata, T. Kobayash, and T. Sato, Scalar multplcaton on twst ellptc curves over F m, Proc. SCIS00, pp , 00. [5] K. Furukawa, T. Kobayash, and K. Aok, The cost of ellptc operatons n OEF usng a successve extenson, Proc. SCIS00, pp.99 94, 00. [6] M. Gonda, K. Matsuo, K. Aok, J. Chao, and S. Tsuj, Improvements of addton algorthm on genus hyperellptc curves and ther mplementaton, IEICE Trans. Fundamentals, vol.e88-a, no.1, pp.89 96, Jan [7] T. Ijma, K. Matsuo, J. Chao, and S. Tsuj, Cnstructon of Frobenus maps of twst ellptc curves and ts applcaton to ellptc scalar multplcaton, Proc. SCIS00, pp , 00. [8] N. Kanayama, K. Nagao, and S. Uchyama, Generatng secure genus two hyperellptc curves usng Elkes pont countng algorthm, IEICE Trans. Fundamentals, vol.e86-a, no.4, pp , Aprl 00. [9] N. Kobltz, Hyperellptc curve cryptosystems, J. Cryptol., vol.1, no., pp , [10] S. Kozak, K. Matsuo, and Y. Shmbara, Skew-Frobenus maps on hyperellptc curves, Proc. SCIS007, 007. [11] T. Lange, Kobltz curve cryptosystems, Fnte Felds Appl., vol.11, no., pp.0 9, 005. [1] J. Nyuka, K. Matsuo, J. Chao, and S. Tsuj, On the resultant computaton n the addton Harley algorthms on hyperellptc curves, IEICE Techncal Report, ISEC006-5, 006.